Edit tour

Windows Analysis Report
qBtDOzhQnS.exe

Overview

General Information

Sample name:	qBtDOzhQnS.exe renamed because original name is a hash value
Original sample name:	70fcbdde18d2955bde7dda2f561f66d4.exe
Analysis ID:	1540303
MD5:	70fcbdde18d2955bde7dda2f561f66d4
SHA1:	b85aa453d12edff3e22ca6ef8489be5a84f9493a
SHA256:	63322da9e2112712b4ef2c0b357a9ef93c38c6f9681938f19686ca055776a0ee
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sigma detected: New RUN Key Pointing to Suspicious Folder

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

qBtDOzhQnS.exe (PID: 7616 cmdline: "C:\Users\user\Desktop\qBtDOzhQnS.exe" MD5: 70FCBDDE18D2955BDE7DDA2F561F66D4)

MSBuild.exe (PID: 7672 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

Honda.exe (PID: 7848 cmdline: "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7780 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 224 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Honda.exe (PID: 8052 cmdline: "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 8064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Honda.exe (PID: 7312 cmdline: "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 7328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Honda.exe (PID: 3420 cmdline: "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 5972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 7672, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleApp_a868971b3da640c9994a6c830e22261b

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 7672, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleApp_a868971b3da640c9994a6c830e22261b

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 7672, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_b15445d604f64b66a25f8010e88b0dd0.lnk

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: qBtDOzhQnS.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: qBtDOzhQnS.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: qBtDOzhQnS.exe

Joe Sandbox ML: detected

Source: qBtDOzhQnS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49813 version: TLS 1.2

Source: qBtDOzhQnS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: Honda.exe, 00000006.00000000.1373292066.0000000000112000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.2.dr

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

Code function: 0_2_00E9D2FE FindFirstFileExW,

0_2_00E9D2FE

Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user	Jump to behavior

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.38.233
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.38.233
Source: unknown	TCP traffic detected without corresponding DNS query: 172.64.149.23
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.38.233
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.38.233
Source: unknown	TCP traffic detected without corresponding DNS query: 172.64.149.23
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240

Source: qBtDOzhQnS.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: qBtDOzhQnS.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: qBtDOzhQnS.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: qBtDOzhQnS.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: qBtDOzhQnS.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: qBtDOzhQnS.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: qBtDOzhQnS.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: qBtDOzhQnS.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: qBtDOzhQnS.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: qBtDOzhQnS.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: qBtDOzhQnS.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: qBtDOzhQnS.exe	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49813 version: TLS 1.2

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00EA10A3	0_2_00EA10A3
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E9F840	0_2_00E9F840
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E82805	0_2_00E82805
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E8F9EC	0_2_00E8F9EC
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E82A0F	0_2_00E82A0F
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E89B05	0_2_00E89B05
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E9943C	0_2_00E9943C
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E97C32	0_2_00E97C32
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E92D90	0_2_00E92D90
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E8FD34	0_2_00E8FD34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01453108	2_2_01453108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01450848	2_2_01450848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01457850	2_2_01457850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01459A30	2_2_01459A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_014542E8	2_2_014542E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01450702	2_2_01450702
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_014507D7	2_2_014507D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_014507E5	2_2_014507E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_014542C8	2_2_014542C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01457A9C	2_2_01457A9C
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 6_2_02245A41	6_2_02245A41
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 6_2_02242788	6_2_02242788
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 6_2_02241E2F	6_2_02241E2F
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 9_2_01662788	9_2_01662788
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 9_2_01665A41	9_2_01665A41
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 9_2_01661E2F	9_2_01661E2F
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 12_2_013C2CC9	12_2_013C2CC9
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 12_2_013C5AB1	12_2_013C5AB1
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 12_2_013C1E41	12_2_013C1E41
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 14_2_00775A41	14_2_00775A41
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 14_2_00772788	14_2_00772788
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 14_2_00771E2F	14_2_00771E2F

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

Code function: String function: 00E8A280 appears 50 times

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 224

Source: qBtDOzhQnS.exe

Static PE information: invalid certificate

Source: qBtDOzhQnS.exe	Binary or memory string: OriginalFilename vs qBtDOzhQnS.exe
Source: qBtDOzhQnS.exe, 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLKSM.exe< vs qBtDOzhQnS.exe

Source: qBtDOzhQnS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Honda.exe.2.dr, TaskParameter.cs	Task registration methods: 'CreateNewTaskItemFrom'
Source: Honda.exe.2.dr, OutOfProcTaskHostNode.cs	Task registration methods: 'RegisterTaskObject', 'UnregisterPacketHandler', 'RegisterPacketHandler', 'UnregisterTaskObject', 'GetRegisteredTaskObject'
Source: Honda.exe.2.dr, TaskLoader.cs	Task registration methods: 'CreateTask'
Source: Honda.exe.2.dr, RegisteredTaskObjectCacheBase.cs	Task registration methods: 'GetLazyCollectionForLifetime', 'RegisterTaskObject', 'DisposeObjects', 'IsCollectionEmptyOrUncreated', 'UnregisterTaskObject', 'DisposeCacheObjects', 'GetRegisteredTaskObject', 'GetCollectionForLifetime'

Source: Honda.exe.2.dr, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
Source: Honda.exe.2.dr, NodeEndpointOutOfProcBase.cs	Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: Honda.exe.2.dr, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Honda.exe.2.dr, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Honda.exe.2.dr, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: Honda.exe, 00000009.00000002.1475753880.0000000001405000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Users\user\AppData\Local\Temp\Honda\<.slnt
Source: Honda.exe, 00000009.00000002.1477103845.0000000003221000.00000004.00000800.00020000.00000000.sdmp, Honda.exe, 0000000C.00000002.1557189653.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,C:\Users\user\AppData\Local\Temp\Honda\*.sln
Source: Honda.exe, 0000000E.00000002.1638798270.0000000002321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qQC:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.sln
Source: Honda.exe, 00000006.00000000.1373292066.0000000000112000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.2.dr	Binary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
Source: Honda.exe, 00000006.00000000.1373292066.0000000000112000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.2.dr	Binary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: Honda.exe, 00000006.00000000.1373292066.0000000000112000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.2.dr	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
Source: Honda.exe, 00000006.00000002.1380581367.0000000000797000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Users\user\Desktop\<.sln\|e
Source: Honda.exe, 00000006.00000000.1373292066.0000000000112000.00000002.00000001.01000000.00000008.sdmp, Honda.exe, 00000006.00000002.1381697257.00000000023D1000.00000004.00000800.00020000.00000000.sdmp, Honda.exe, 00000009.00000002.1477103845.0000000003221000.00000004.00000800.00020000.00000000.sdmp, Honda.exe, 0000000C.00000002.1557189653.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, Honda.exe, 0000000E.00000002.1638798270.0000000002321000.00000004.00000800.00020000.00000000.sdmp, Honda.exe.2.dr	Binary or memory string: *.sln
Source: Honda.exe, 0000000C.00000002.1555857019.0000000001256000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Users\user\AppData\Local\Temp\Honda\<.slnnA
Source: Honda.exe, 00000006.00000000.1373292066.0000000000112000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.2.dr	Binary or memory string: MSBuild MyApp.csproj /t:Clean
Source: Honda.exe, 00000006.00000000.1373292066.0000000000112000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.2.dr	Binary or memory string: /ignoreprojectextensions:.sln
Source: Honda.exe, 00000006.00000002.1381697257.00000000023D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\*.sln
Source: Honda.exe, 00000006.00000000.1373292066.0000000000112000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.2.dr	Binary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.

Source: classification engine

Classification label: mal80.evad.winEXE@13/13@0/0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_b15445d604f64b66a25f8010e88b0dd0.lnk

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7616

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\Honda

Jump to behavior

Source: qBtDOzhQnS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: qBtDOzhQnS.exe

ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\qBtDOzhQnS.exe "C:\Users\user\Desktop\qBtDOzhQnS.exe"
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 224
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"	Jump to behavior

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: GoogleApp_b15445d604f64b66a25f8010e88b0dd0.lnk.2.dr

LNK file: ..\..\..\..\..\..\Local\Temp\Honda\Honda.exe

Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: qBtDOzhQnS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: qBtDOzhQnS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: qBtDOzhQnS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: qBtDOzhQnS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: qBtDOzhQnS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: qBtDOzhQnS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: qBtDOzhQnS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: qBtDOzhQnS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: qBtDOzhQnS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: qBtDOzhQnS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: qBtDOzhQnS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: qBtDOzhQnS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: qBtDOzhQnS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: qBtDOzhQnS.exe

Static PE information: section name: .bsp

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E8992C push ecx; ret		0_2_00E8993F
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E82F17 push eax; ret		0_2_00E82F76

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_b15445d604f64b66a25f8010e88b0dd0.lnk

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_b15445d604f64b66a25f8010e88b0dd0.lnk

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GoogleApp_a868971b3da640c9994a6c830e22261b			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GoogleApp_a868971b3da640c9994a6c830e22261b			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 2240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 23D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 43D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 1620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 3220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 3080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 13C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 2F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 2320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 4320000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Window / User API: threadDelayed 424

Jump to behavior

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-19961

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

API coverage: 3.8 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7748	Thread sleep count: 424 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7752	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe TID: 7904	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe TID: 8104	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe TID: 5808	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe TID: 892	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

Code function: 0_2_00E9D2FE FindFirstFileExW,

0_2_00E9D2FE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

Code function: 0_2_00E82F17 LdrInitializeThunk,

0_2_00E82F17

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

Code function: 0_2_00E8A085 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00E8A085

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E82F7C mov edi, dword ptr fs:[00000030h]	0_2_00E82F7C
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E93BBE mov ecx, dword ptr fs:[00000030h]	0_2_00E93BBE
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E9CC6F mov eax, dword ptr fs:[00000030h]	0_2_00E9CC6F

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

Code function: 0_2_00E9E177 GetProcessHeap,

0_2_00E9E177

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E8A085 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E8A085
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E8A212 SetUnhandledExceptionFilter,	0_2_00E8A212
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E90B69 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E90B69
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: 0_2_00E89E74 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00E89E74

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 412000	Jump to behavior
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: E57008	Jump to behavior

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"			Jump to behavior

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: EnumSystemLocalesW,	0_2_00EA007C
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: EnumSystemLocalesW,	0_2_00E97026
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: EnumSystemLocalesW,	0_2_00EA0031
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00EA01A2
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: EnumSystemLocalesW,	0_2_00EA0117
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: GetLocaleInfoW,	0_2_00EA03F5
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: GetLocaleInfoW,	0_2_00E974EF
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00E9FD8F
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00EA051E
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00EA06F3
Source: C:\Users\user\Desktop\qBtDOzhQnS.exe	Code function: GetLocaleInfoW,	0_2_00EA0624

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\qBtDOzhQnS.exe

Code function: 0_2_00E8A2C5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00E8A2C5

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
qBtDOzhQnS.exe	68%	ReversingLabs	Win32.Trojan.LummaC
qBtDOzhQnS.exe	100%	Avira	TR/Kryptik.kkdec
qBtDOzhQnS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	qBtDOzhQnS.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	qBtDOzhQnS.exe	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	qBtDOzhQnS.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	qBtDOzhQnS.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	qBtDOzhQnS.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	qBtDOzhQnS.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	qBtDOzhQnS.exe	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	qBtDOzhQnS.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	qBtDOzhQnS.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	qBtDOzhQnS.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540303
Start date and time:	2024-10-23 17:00:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	qBtDOzhQnS.exe renamed because original name is a hash value
Original Sample Name:	70fcbdde18d2955bde7dda2f561f66d4.exe
Detection:	MAL
Classification:	mal80.evad.winEXE@13/13@0/0
EGA Information:	Successful, ratio: 16.7%
HCA Information:	Successful, ratio: 95% Number of executed functions: 143 Number of non-executed functions: 56
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.0, 20.190.159.23, 20.190.159.4, 20.190.159.73, 40.126.31.71, 20.190.159.2, 20.190.159.71, 40.126.31.67, 20.189.173.21, 20.12.23.50, 20.242.39.171, 192.229.221.95, 13.85.23.206
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, onedsblobprdwus16.westus.cloudapp.azure.com, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target Honda.exe, PID 3420 because it is empty
Execution Graph export aborted for target Honda.exe, PID 7312 because it is empty
Execution Graph export aborted for target Honda.exe, PID 7848 because it is empty
Execution Graph export aborted for target Honda.exe, PID 8052 because it is empty
Execution Graph export aborted for target MSBuild.exe, PID 7672 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: qBtDOzhQnS.exe

Simulations

Behavior and APIs

Time	Type	Description
11:01:22	API Interceptor	1x Sleep call for process: MSBuild.exe modified
11:01:29	API Interceptor	1x Sleep call for process: WerFault.exe modified
16:01:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GoogleApp_a868971b3da640c9994a6c830e22261b "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
16:01:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GoogleApp_a868971b3da640c9994a6c830e22261b "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
16:01:41	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_b15445d604f64b66a25f8010e88b0dd0.lnk

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	KO8mPIAMHh.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	otq9AG1EIk.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://api-restauration.basiic.net/fWmcv/	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://1drv.ms/o/c/6c73e1f3356d6c81/EvfBo1LISVpEg8JGFA7u8GsBL0LmooIAfd5Q39ROhQ0Lhw?e=ZTugWV	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
	roquette October.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.45
	email3.zip	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	17296647868999e9ff16d1142358270a9bb6f9c24ecf80decc9807b9c07915c5b4d8998fe0763.dat-decoded.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	13.107.246.45
	172966479269a7051532d8beea04d9546bd0c0aa8d447d08a4733d3eae1e222b2fd27f6742927.dat-decoded.exe	Get hash	malicious	Remcos	Browse	13.107.246.45
	17296648031b2d9cb0c868aa5466ea06cd4229f96112d2489bd0e59c404f1c897eaa3e50ed622.dat-decoded.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
fp2e7a.wpc.phicdn.net	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NkQhxQlLbRIjo8QpKjRS5qi3QTD4TCmZYuyRNm1nr4w0PSyGwzmG3z_7xprlPWVcJHmI_fpJbjmguOnLn78cm0vTw-4fw8_dttdENzIEmoji9oYsWsAtST2VKmiVOSoJqdyVNYa9pUnKUIDOWiZA0hTgDZrUNoXnphIopaly3TORwyH9YC9Qxdp3XMSYXpJIxKjPXCTxpnFodmlNEyZusugzaDFYfiDUDxm0L7pZ9CeIVNtih33mdpIlF4hGzaGIM8ta2mV83UNlbFYlJCbQhsoM9WKPqbgA2EKsb_VACXX1jKtlM9hpQHcqiKvVsZXuvB16WTBIo6v2IflN7T_8Ly_7-p6G_bz4wbM8n1Sp6MYG7ePPU-Zzu186Pg0H4abuhj5HKZfrF4mPLvT5vndMpR0h183E0MpUvOW7q9xlXB85X820-3i3IC4xLGbBiS-Pf3v-o2eUuge_l-21bG_2vt-fvz8MwAA__9XraZ6	Get hash	malicious	Unknown	Browse	192.229.221.95
	ufp4rvU3SP.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	igCCUqSW2T.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	tfduJDS9iM.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	otq9AG1EIk.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	KO8mPIAMHh.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	otq9AG1EIk.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	KO8mPIAMHh.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://1drv.ms/o/c/6c73e1f3356d6c81/EvfBo1LISVpEg8JGFA7u8GsBL0LmooIAfd5Q39ROhQ0Lhw?e=ZTugWV	Get hash	malicious	HtmlDropper	Browse	192.229.221.95
	http://wxqlb.ecobusinessegypt.com/4Upeae17759oIun1207nsacmhsouq29959VLTMIPDLABHITRZ3224VGST20749x12	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

⊘No context

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	sample.pdf	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NkQhxQlLbRIjo8QpKjRS5qi3QTD4TCmZYuyRNm1nr4w0PSyGwzmG3z_7xprlPWVcJHmI_fpJbjmguOnLn78cm0vTw-4fw8_dttdENzIEmoji9oYsWsAtST2VKmiVOSoJqdyVNYa9pUnKUIDOWiZA0hTgDZrUNoXnphIopaly3TORwyH9YC9Qxdp3XMSYXpJIxKjPXCTxpnFodmlNEyZusugzaDFYfiDUDxm0L7pZ9CeIVNtih33mdpIlF4hGzaGIM8ta2mV83UNlbFYlJCbQhsoM9WKPqbgA2EKsb_VACXX1jKtlM9hpQHcqiKvVsZXuvB16WTBIo6v2IflN7T_8Ly_7-p6G_bz4wbM8n1Sp6MYG7ePPU-Zzu186Pg0H4abuhj5HKZfrF4mPLvT5vndMpR0h183E0MpUvOW7q9xlXB85X820-3i3IC4xLGbBiS-Pf3v-o2eUuge_l-21bG_2vt-fvz8MwAA__9XraZ6	Get hash	malicious	Unknown	Browse	13.107.246.45
	ufp4rvU3SP.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	igCCUqSW2T.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	otq9AG1EIk.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://docusign.net	Get hash	malicious	Unknown	Browse	13.107.246.45
	KO8mPIAMHh.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	tfduJDS9iM.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	otq9AG1EIk.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	KO8mPIAMHh.exe	Get hash	malicious	Unknown	Browse	13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	ufp4rvU3SP.exe	Get hash	malicious	Unknown	Browse
	igCCUqSW2T.exe	Get hash	malicious	Unknown	Browse
	tfduJDS9iM.exe	Get hash	malicious	Unknown	Browse
	otq9AG1EIk.exe	Get hash	malicious	Unknown	Browse
	KO8mPIAMHh.exe	Get hash	malicious	Unknown	Browse
	tfduJDS9iM.exe	Get hash	malicious	Unknown	Browse
	otq9AG1EIk.exe	Get hash	malicious	Unknown	Browse
	KO8mPIAMHh.exe	Get hash	malicious	Unknown	Browse
	76Kobq8opu.exe	Get hash	malicious	Unknown	Browse
	76Kobq8opu.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_qBtDOzhQnS.exe_61834c8bbb89331017ec34ae3ed187d76665b41_0168f847_0495cdc9-a3cb-4a91-88c9-dbd64baaf92c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6546441576282577
Encrypted:	false
SSDEEP:	96:cncFWMXAvZsXhXzxTMjh6tQXIDcQvc6QcEVcw3cE/jx1+HbHg/5hZAX/d5FMT2S8:SccTvZE80BU/HxSjhzuiFUZ24IO8AK
MD5:	8072DF7D99EA49B9DE3324D1EC7FCDA0
SHA1:	84E16C2C4AB35C7F84E0D18ABA9F4DCF36374E3B
SHA-256:	2A515744724502A315AA9AB768AC7A3A8CF6225C486B733594983480CEE12DE2
SHA-512:	4ACB81F62A5C0CEF8657F626275B05E7A9F672907BC9DE40D330EB9BE2C4331BF549C7BA91BC25452B271E618D00A9ED42A159D663DB8F00B27EE9032D66280C
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.1.6.9.2.8.2.9.3.7.6.9.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.1.6.9.2.8.4.5.7.8.3.1.7.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.4.9.5.c.d.c.9.-.a.3.c.b.-.4.a.9.1.-.8.8.c.9.-.d.b.d.6.4.b.a.a.f.9.2.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.0.8.0.f.1.c.8.-.4.5.0.9.-.4.d.a.3.-.b.d.3.4.-.4.a.c.8.b.2.3.4.5.c.6.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.q.B.t.D.O.z.h.Q.n.S...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.c.0.-.0.0.0.1.-.0.0.1.4.-.3.d.b.c.-.e.5.6.b.5.c.2.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.4.1.a.1.f.d.6.2.8.9.5.4.3.3.3.f.a.d.4.a.f.a.f.9.6.2.f.1.9.2.3.0.0.0.0.f.f.f.f.!.0.0.0.0.b.8.5.a.a.4.5.3.d.1.2.e.d.f.f.3.e.2.2.c.a.6.e.f.8.4.8.9.b.e.5.a.8.4.f.9.4.9.3.a.!.q.B.t.D.O.z.h.Q.n.S...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA14.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Oct 23 15:01:24 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42276
Entropy (8bit):	1.610227766207177
Encrypted:	false
SSDEEP:	192:38nxuOoj0RU/7ad9+HvBUsp5n/eyv8egcgPnB:UNn+Jmvegp
MD5:	49DFC602FB884FEF34869D995FB9F224
SHA1:	47334EBEE547579FE14E2A0E7CEB3E5AB96CDB19
SHA-256:	C0D291E87C8465C0E520596E91BE0C60D5848D5A13A6FBE2B5574C0CC5867407
SHA-512:	658BCEEB1E32F1B4EE9CCCEFA7C9BC9EA22E807C3B6163F2F6C496276FFAA068A2C13E2397B6FD32D216AACC77C7FE4A03ECDA49927A2015253F433CE82452E2
Malicious:	false
Preview:	MDMP..a..... ..........g........................d...........t...............T.......8...........T...............t...........0...........................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD80.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8378
Entropy (8bit):	3.6959243708851406
Encrypted:	false
SSDEEP:	192:R6l7wVeJ956yibZb6YcDcSU9cfZgmfx4QFpr389bNXsfNCvm:R6lXJj6yiNb6Y7SU9cfZgmfx4QANcfh
MD5:	8E400417F264A98B30BB3CABDF0B4960
SHA1:	E271CDAF8DE9F26B443FD7D01FD81347F57C1B8A
SHA-256:	E940A1099DDB84334B1428AAF89C3254C07062303B11037ACAE28549F59FC988
SHA-512:	E10D314454353BE57701E03BCB0AB94C5D0AE9210637E2C14CC03AB509660443AFF822695FBA73DE9766D382E5D4AD19B8B6542465853C33DDE94369A6D2351B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE1E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4696
Entropy (8bit):	4.482112283511502
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4Jg77aI9n8WpW8VYrYm8M4JENUFo+q8vjNYwawrSTd:uIjf+I7Z17VHJKKC5wuTd
MD5:	34985B744EC073A224AEE4B0697B424B
SHA1:	5571EAB6E6331CF7C1533057565660793FC741A0
SHA-256:	C8766A3D8813D01EDEA70E26259A810757FF9EDF2198DCCDD8976221A5708699
SHA-512:	DA39C778CDAB9F6993415B3F3B628B0C2D06BABED2CE3626E4FD8E4A980C8E944A14204C49EAC313A14176802BF93F565A3FCA56919C0B71154C0BD1EABEE3F9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="556204" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Honda.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\Honda\Honda.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	841
Entropy (8bit):	5.351831766340675
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoIvEE4xDqE4j:MxHKlYHKh3oPtHo6wvEHxDqHj
MD5:	98DCC730A3C77DCDCA7CD8717EB5D42A
SHA1:	639509210C17EB73F5DB581FA8CA46B1157D8806
SHA-256:	E3C80885BCC7FE4F349EFB0470D261E0DE273EE26D47AF09C79F1B4B2F891E49
SHA-512:	7D11C53167839D428DAE35BF759C73FC0C7C49F2DE35CC99E4F8B69CDD40DFBEEF6D355F15FAB1EED62A64AF94E7BA311C0F8E07C3DA6F3A63410CC3E9882B78
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..2,"Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	636
Entropy (8bit):	5.363873409814957
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhadDLI4MNsf6cv:ML9E4KlKDE4KhKiKhwE4Tye
MD5:	43484EA7D5BD7DE47119BC063D65D7AF
SHA1:	FCE0A3922FB3E421F8EF74E9A94E60F8DE7F97F5
SHA-256:	C00C48279B0CCFF866BB59D1DD5B77C65594B86BD4D16DE0F2EFAD2778F57A23
SHA-512:	A56C0609179C003044AFEC26019EAEC0ECC772108327EB01F817B88780981289A61E795F6E8745FDEAE99D8543B57344F80A9542BDA2933787C5C8331C869820
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..

C:\Users\user\AppData\Local\Temp\Honda\Honda.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	262432
Entropy (8bit):	6.179415524830389
Encrypted:	false
SSDEEP:	3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
MD5:	8FDF47E0FF70C40ED3A17014AEEA4232
SHA1:	E6256A0159688F0560B015DA4D967F41CBF8C9BD
SHA-256:	ED9884BAC608C06B7057037CC91D90E4AE5F74DD2DBCE2AF476699C6D4492D82
SHA-512:	BD69D092ED4F9C5E1F24EAF5EC79FB316469D53849DC798FAE0FCBA5E90869B77EE924C23CC6F692198FF25827AB60AD47BB46CADD6E0AADDE7731CBAFB013BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ufp4rvU3SP.exe, Detection: malicious, Browse Filename: igCCUqSW2T.exe, Detection: malicious, Browse Filename: tfduJDS9iM.exe, Detection: malicious, Browse Filename: otq9AG1EIk.exe, Detection: malicious, Browse Filename: KO8mPIAMHh.exe, Detection: malicious, Browse Filename: tfduJDS9iM.exe, Detection: malicious, Browse Filename: otq9AG1EIk.exe, Detection: malicious, Browse Filename: KO8mPIAMHh.exe, Detection: malicious, Browse Filename: 76Kobq8opu.exe, Detection: malicious, Browse Filename: 76Kobq8opu.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.].........."...0..\|...B......:.... ........@.. ...............................L....`....................................O........>.............. A........................................................... ............... ..H............text...Xz... ...\|.................. ..`.rsrc....>.......@...~..............@..@.reloc..............................@..B........................H........)...................\|...........................................{.......v.(=....r...p({...-..+..}........0..%........(....-......(z.....&..}..............................0..5........(....-...-.r+..ps>...z.....i(z.....&..}......................%......>....(?...(....N..(@....oA...(....:...(B...(....:...(C...(....*....(........0..G........(....,....(....-...}......r...p(x...&.(v.....}......&..}....................7.......0..f........-.r7..ps>...z .....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_b15445d604f64b66a25f8010e88b0dd0.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Oct 23 14:01:22 2024, mtime=Wed Oct 23 14:01:22 2024, atime=Sat Dec 7 08:10:48 2019, length=262432, window=hide
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	4.96705573707079
Encrypted:	false
SSDEEP:	24:8bHlIRueR8vgK/LCnE5rypLrE1APVwZMIK+E6E6FxQOqygm:8bHlGueROEw+pnrPVwZMIK+/1CLyg
MD5:	879E0B1D307446888A4C09AAA8659D00
SHA1:	D5E43416E5E5CFEF2BFC73C5D50A9FC47AAF3EFD
SHA-256:	E62FE0CC1B429C8C8DC3C70E8E5B10C5487A41986387A2F5606BED755C1EB9C9
SHA-512:	508CEA0448D37DC4FFB66D99AFCC4981FE7FC4FDF966F5E0D6174FEBFF96370D8F6B6A1038D1148546BB5AFFBAEF260853D148F9D30DD3639C406CEFB66CD7AA
Malicious:	false
Preview:	L..................F....".....Fl\%.."DMl\%..{.#7... .........................:..DG..Yr?.D..U..k0.&...&.......bBDj.....]g\%..B.il\%......t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsGWYx..........................=...A.p.p.D.a.t.a...B.P.1.....WY'x..Local.<......EWsGWY'x..........................P..L.o.c.a.l.....N.1.....WYx..Temp..:......EWsGWY*x.........................w2..T.e.m.p.....P.1.....WY,x..Honda.<......WY,xWY,x..........................(...H.o.n.d.a.....\.2. ....OYI".Honda.exe.D......WY,xWY,x................p.............H.o.n.d.a...e.x.e......._...............-.......^.............!......C:\Users\user\AppData\Local\Temp\Honda\Honda.exe..,.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.H.o.n.d.a.\.H.o.n.d.a...e.x.e.........\|....I.J.H..K..:...`.......X.......841675...........hT..CrF.f4... ...E._c...,...E...hT..CrF.f4... ...E._c...,...E..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.393826727140707
Encrypted:	false
SSDEEP:	6144:pl4fiJoH0ncNXiUjt10q0G/gaocYGBoaUMMhA2NX4WABlBuNAfOBSqa:/4vF0MYQUMM6VFYSfU
MD5:	3EB297770C1FFEDBC720C252BDD56870
SHA1:	998FAB55431ACFB1E9DCCC8904C18E0115B71FC6
SHA-256:	51B168EE4FF7C9BD790B9AE36C581D551ADBE6A3DE45CFC786AA49F6C8449F63
SHA-512:	97FEA5F9A08A44F8E1CF21A03127F7355E8B990D2834B619148169B0BA4FBDA17B3296AED3BA61ED8D9BD39DD0B3132BA8E2A81E5FF5744B730AD83E99BCC96D
Malicious:	false
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...l\%...............................................................................................................................................................................................................................................................................................................................................*.X........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\Honda\Honda.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.924206445966445
Encrypted:	false
SSDEEP:	6:zx3M1tFAbQtASR30qyMstwYVoRRZBXVN+J0fFdCsq2UTiMdH8stCal+n:zK13P30ZMt9BFN+QdCT2UftCM+
MD5:	932782CF70ED00D22C0B08B5027B4E31
SHA1:	78F460A2155D9E819B8452C281285D7E0A7AC14F
SHA-256:	F2C2477FB3FD0A30F3D3D8637EF9C774B43E940043635DF90CDD804799A2ECE7
SHA-512:	C83E72797C03CABCAB066B95BAEEBB13944143846794061CF9482EA3B283979E470930047FDAE72A6F06F51F3127FF39DAAEFAAD7557E3AD49F590B9E7B78D24
Malicious:	false
Preview:	Microsoft (R) Build Engine version 4.8.4084.0..[Microsoft .NET Framework, version 4.0.30319.42000]..Copyright (C) Microsoft Corporation. All rights reserved.....MSBUILD : error MSB1003: Specify a project or solution file. The current working directory does not contain a project or solution file...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.856255832941963
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	qBtDOzhQnS.exe
File size:	294'016 bytes
MD5:	70fcbdde18d2955bde7dda2f561f66d4
SHA1:	b85aa453d12edff3e22ca6ef8489be5a84f9493a
SHA256:	63322da9e2112712b4ef2c0b357a9ef93c38c6f9681938f19686ca055776a0ee
SHA512:	aef0d02d1a49c4f6c58dcd0a02c257570dea2205891886e215be8be8c23cd6c3d042c72196dfa2460d3a3b53fa53347ee72f5a7e7839e1f0e4aeba134d8b39a4
SSDEEP:	6144:Oukzez4QOcnvEGWctezYlu5kyoRYm0qAJcJalr7v:3Dz4QOcvEX5LoR1QJcQlr7v
TLSH:	6454AE217580C073D96325320AE4DBB56A7DFE704E655E8FA7A80F6E0F70281D731A6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........L..v...v...v...u...v...s.a.v...r...v...w...v...w.M.v...r...v...u...v...s...v.......v.......v...t...v.Rich..v................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x409922
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67165891 [Mon Oct 21 13:35:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	31770ac6e89309fe8c99522fb04f055c

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	31/08/2023 01:00:00 31/08/2026 00:59:59
Subject Chain	CN=Privacy Technologies OU, O=Privacy Technologies OU, S=Harjumaa, C=EE
Version:	3
Thumbprint MD5:	AD1BCBF19AE2F91BB114D33B85359E56
Thumbprint SHA-1:	141D90A1BA8F61863FBEDDF7DD1D66C1D1E0B128
Thumbprint SHA-256:	A08EA2A7A257AD690B988446951E9DEF2986A2F3F546B6F0902805330F3B6B48
Serial:	00D0461B529F67189D43744E9CEFE172AE

Entrypoint Preview

Instruction
call 00007F4A5CB9E710h
jmp 00007F4A5CB9DB9Fh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F4A5CB9D742h
jmp 00007F4A5CB9DD02h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00432180h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00432180h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00432180h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30bc0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x43000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x44e00	0x2e80
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x44000	0x2104	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2e088	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2e0c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2dfc8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x26000	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x247c5	0x24800	f7f28371252cdda3944b73e0bdd9e6bb	False	0.5836432470034246	data	6.666009514511532	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x26000	0xb3c6	0xb400	5fa71d87a495852454a60158be46cc77	False	0.42628038194444445	data	4.90018568771607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x32000	0x106bc	0xf800	a2020229e4ee92ef30d213ba58a74184	False	0.9151650705645161	data	7.836333269007288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x43000	0x1e0	0x200	9866eeb93e80b773405f3d7936b83641	False	0.52734375	data	4.7074344725994175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x44000	0x2104	0x2200	81049f21fcefbafebc1cfbe39de7a7ce	False	0.7339154411764706	data	6.4554658693314	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bsp	0x47000	0x3000	0x3000	dc461632d58ae88e73a03f75c5dd10d9	False	0.018229166666666668	data	0.16185686701183552	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x43060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

GlobalFindAtomA, RaiseException, GetCurrentThreadId, IsProcessorFeaturePresent, GetLastError, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, WakeAllConditionVariable, SleepConditionVariableSRW, InitOnceComplete, InitOnceBeginInitialize, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WideCharToMultiByte, CloseHandle, QueryPerformanceCounter, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, MultiByteToWideChar, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetStringTypeW, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsDebuggerPresent, GetStartupInfoW, GetCurrentProcessId, InitializeSListHead, CreateFileW, RtlUnwind, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleFileNameW, GetStdHandle, WriteFile, HeapAlloc, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, SetStdHandle, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 17:01:18.606283903 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 23, 2024 17:01:19.590713024 CEST	49676	443	192.168.2.9	23.206.229.209
Oct 23, 2024 17:01:19.590714931 CEST	49675	443	192.168.2.9	23.206.229.209
Oct 23, 2024 17:01:19.762541056 CEST	49674	443	192.168.2.9	23.206.229.209
Oct 23, 2024 17:01:19.796647072 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:19.796693087 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:19.796761036 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:19.797038078 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:19.797051907 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.534557104 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.534686089 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:20.540482998 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:20.540498018 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.540776968 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.550349951 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:20.595325947 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.768738985 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.768768072 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.768785954 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.768838882 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:20.768870115 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.768913984 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:20.798686028 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.798707962 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.798772097 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:20.798784971 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.798826933 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:20.913661957 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.913686037 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.913825035 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:20.913846016 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.913888931 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:20.914875984 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.914891005 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.914963961 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:20.914971113 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.915000916 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:20.916532040 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.916548967 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.916629076 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:20.916635036 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:20.916680098 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.002597094 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.002624035 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.002667904 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.002690077 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.002712011 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.002728939 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.003824949 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.003840923 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.003906965 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.003916025 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.003957033 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.031308889 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.031332970 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.031490088 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.031502008 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.031546116 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.032512903 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.032529116 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.032623053 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.032630920 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.032680035 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.033756018 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.033771992 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.033843040 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.033850908 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.033899069 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.034698963 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.034713984 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.034771919 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.034780979 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.034811974 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.034857035 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.035672903 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.035686970 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.035769939 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.035775900 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.035820007 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.036776066 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.036791086 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.036870003 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.036876917 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.036930084 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.120222092 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.120301008 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.120349884 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.120400906 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.120508909 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.120522976 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.120533943 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.120538950 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.211999893 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.212048054 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.212119102 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.212614059 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.212651014 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.212723017 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.213964939 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.213999987 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.214045048 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.214695930 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.214741945 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.214787006 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.215190887 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.215210915 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.215265036 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.215327978 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.215343952 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.215425014 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.215440035 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.215498924 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.215511084 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.216070890 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.216083050 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.216288090 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.216300964 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.973294973 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.973870039 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.974026918 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.974046946 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.974224091 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.974253893 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.974730968 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.974735022 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.974764109 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.974782944 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.975661039 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.975999117 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.976018906 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.976488113 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.976505041 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.997762918 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.998295069 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.998313904 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:21.998969078 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:21.998976946 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.105969906 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.105995893 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.106113911 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.106128931 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.106162071 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.106524944 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.106544971 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.106555939 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.106563091 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.111509085 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.111563921 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.111650944 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.111681938 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.111705065 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.111747980 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.121824980 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.121859074 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.125775099 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.125818968 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.125891924 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.135971069 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.136043072 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.136135101 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.140919924 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.140953064 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.141015053 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.141870022 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.141901970 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.142060995 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.142061949 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.142100096 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.142139912 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.154906988 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.154984951 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.155066013 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.155080080 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.155108929 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.155139923 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.155174971 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.155385017 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.155395985 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.155406952 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.155411005 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.176096916 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.185877085 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.185906887 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.186373949 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.186392069 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.193818092 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.193846941 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.206502914 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.206562042 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.206644058 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.206851006 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.206887007 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.209032059 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.209059954 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.209122896 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.210257053 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.210267067 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.312838078 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.312908888 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.312958002 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.313996077 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.314029932 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.314047098 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.314052105 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.317487955 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.317574978 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.317651033 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.318248034 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.318276882 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.940574884 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.941247940 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.941272020 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.941868067 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.941875935 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.941987038 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.942455053 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.942467928 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.942992926 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.943000078 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.957627058 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.958290100 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.958374023 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:22.958914042 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:22.958928108 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.054999113 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.068758965 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.068800926 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.069365978 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.069381952 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.070372105 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.070581913 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.070650101 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.070687056 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.070687056 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.070708036 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.070722103 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.077402115 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.077855110 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.077908993 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.094913960 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.095079899 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.095134020 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.103653908 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.103684902 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.103703022 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.103708982 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.107378960 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.107399940 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.107429028 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.107436895 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.115669966 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.115699053 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.115760088 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.117321968 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.117332935 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.134044886 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.134084940 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.134155989 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.134521961 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.134537935 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.195739985 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.195810080 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.195904970 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.241933107 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.241972923 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.241991997 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.242000103 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.261809111 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.261842966 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.261904955 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.389919996 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.389940977 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.393106937 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.393156052 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.393207073 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.394359112 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.394375086 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.418792963 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 23, 2024 17:01:23.866018057 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.873039961 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:23.932651997 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:23.932652950 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.075901031 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.075921059 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.076714993 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.076726913 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.077491999 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.077502966 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.078068018 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.078073025 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.202851057 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.205878973 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.205991983 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.206048965 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.206583977 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.206670046 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.206862926 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.210805893 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.257585049 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.257661104 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.483978033 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.483998060 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.484731913 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.484744072 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.484886885 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.484886885 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.484908104 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.484915972 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.485114098 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.485143900 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.485156059 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.485162020 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.487255096 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.487270117 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.487813950 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.487828016 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.519773960 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.519824982 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.519892931 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.521058083 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.521109104 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.521696091 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.534305096 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.534320116 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.535129070 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.535152912 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.610913038 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.611088037 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.611141920 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.614974976 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.615101099 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.615197897 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.621905088 CEST	49673	443	192.168.2.9	204.79.197.203
Oct 23, 2024 17:01:24.661165953 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.661190987 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.661207914 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.661216021 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.663173914 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.663197041 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.663218975 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.663227081 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.746594906 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.746629953 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.746696949 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.762392998 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.762442112 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.762546062 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.765450954 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.765463114 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:24.768182039 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:24.768203974 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.278275967 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.279284000 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.279300928 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.279468060 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.279863119 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.279869080 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.280637980 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.280653954 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.281177998 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.281188965 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.412391901 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.412467003 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.412606001 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.412666082 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.412723064 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.412736893 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.412754059 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.412763119 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.413691998 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.413713932 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.413738012 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.413744926 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.416680098 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.416707993 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.416796923 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.417346954 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.417361975 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.418162107 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.418184042 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.418242931 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.418387890 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.418397903 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.506494045 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.506975889 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.506994963 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.507534027 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.507541895 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.644711018 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.645395041 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.646920919 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.665265083 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.665265083 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.665286064 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.665296078 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.668127060 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.668171883 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.668247938 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.668386936 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.668396950 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.724896908 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.725389004 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.725402117 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.725869894 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.725873947 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.859704971 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.860352993 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.860424042 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.860474110 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.860483885 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.860493898 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.860498905 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.863478899 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.863523006 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:25.863617897 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.863842010 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:25.863863945 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.142894030 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.143606901 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.143630028 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.144226074 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.144246101 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.144742966 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.145272970 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.145304918 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.145762920 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.145768881 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.274286985 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.274415970 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.274449110 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.274497032 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.274529934 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.274570942 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.275327921 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.275367975 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.275382996 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.275392056 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.275630951 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.275650978 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.275667906 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.275674105 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.279961109 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.280002117 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.280159950 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.282375097 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.282380104 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.282385111 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.282423019 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.282526970 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.282769918 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.282782078 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.620237112 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.620915890 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.620938063 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:26.622642040 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:26.622647047 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.093348026 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.093548059 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.093621969 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.095005035 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.095573902 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.100114107 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.100131035 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.100162029 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.100167990 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.100490093 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.102168083 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.102176905 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.103168011 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.103173018 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.103809118 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.103820086 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.104717016 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.104722977 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.105297089 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.105305910 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.106903076 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.106908083 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.110892057 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.110943079 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.111011982 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.111218929 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.111232042 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.243782043 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.243850946 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.243894100 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.244848967 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.244961023 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.244998932 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.245043039 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.245058060 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.245100021 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.256134033 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.256140947 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.258733988 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.258740902 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.258755922 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.258760929 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.260950089 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.260953903 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.260963917 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.260967970 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.299421072 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.299449921 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.299525976 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.300770998 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.300822020 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.300893068 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.301481009 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.301502943 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.301836014 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.301868916 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.303555012 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.303575039 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:27.303705931 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.303833961 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:27.303855896 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.037009954 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.037575006 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.037590027 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.037699938 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.038041115 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.038044930 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.038105965 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.038117886 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.038598061 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.038603067 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.044991970 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.045672894 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.045682907 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.047000885 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.047007084 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.064099073 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.064783096 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.064790010 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.065371037 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.065381050 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.166892052 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.167901993 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.168028116 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.168065071 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.168065071 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.168081999 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.168102980 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.169064045 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.169457912 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.169528961 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.169661999 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.169667959 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.169678926 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.169683933 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.171215057 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.171260118 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.171331882 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.171499968 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.171519041 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.171823978 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.171858072 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.171912909 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.172049046 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.172059059 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.176321030 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.176541090 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.176626921 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.176662922 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.176662922 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.176681995 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.176702976 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.179219961 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.179255962 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.179339886 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.179460049 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.179471016 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.193805933 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.193969011 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.194195986 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.194242001 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.194242001 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.194248915 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.194256067 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.197869062 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.197880030 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.197959900 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.198139906 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.198148012 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.920649052 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.921346903 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.921384096 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.921408892 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.921622038 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.921631098 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.921766043 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.921771049 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.921840906 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.922065020 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.922069073 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.922141075 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.922175884 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.922518969 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.922533035 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.931689024 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.932142973 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.932149887 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:28.932528973 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:28.932532072 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.054013968 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.054109097 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.054300070 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.054317951 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.054353952 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.054419041 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.054419041 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.054438114 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.054450989 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.054454088 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.054466963 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.054467916 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.054472923 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.057024956 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.057080984 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.057115078 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.057148933 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.057168961 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.057205915 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.057344913 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.057356119 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.057357073 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.057384968 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.062932968 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.063201904 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.063329935 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.063329935 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.063329935 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.065354109 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.065378904 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.065476894 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.065632105 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.065659046 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.098309994 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.098398924 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.098453045 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.098617077 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.098623991 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.098634005 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.098639965 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.101249933 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.101278067 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.101342916 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.101526976 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.101537943 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.200050116 CEST	49676	443	192.168.2.9	23.206.229.209
Oct 23, 2024 17:01:29.200062990 CEST	49675	443	192.168.2.9	23.206.229.209
Oct 23, 2024 17:01:29.278250933 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.278321981 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.371942997 CEST	49674	443	192.168.2.9	23.206.229.209
Oct 23, 2024 17:01:29.789747000 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.798809052 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.798835039 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.802798033 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.802809000 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.803392887 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.809395075 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.832998037 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.833020926 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.839873075 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.839886904 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.846384048 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.846405029 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.850121021 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.850132942 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.861901999 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.871778965 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.871795893 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.872278929 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.872283936 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.969834089 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.969993114 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.970058918 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:29.975123882 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.975367069 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:29.975434065 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.002832890 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.003591061 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.003663063 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.010648012 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.010654926 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.010667086 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.010670900 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.011708021 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.011760950 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.011794090 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.011811018 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.012667894 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.012679100 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.030292988 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.030308008 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.030380964 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.035634041 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.035656929 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.035713911 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.036489010 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.036525965 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.036724091 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.036740065 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.038069963 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.038099051 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.038146973 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.038563967 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.038574934 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.066333055 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.066397905 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.066463947 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.082473993 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.082496881 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.082525969 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.082544088 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.144375086 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.144418001 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.144476891 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.145833969 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.145848036 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.780678988 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.781168938 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.781208992 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.781636953 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.781646013 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.783006907 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.783335924 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.783349991 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.783864021 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.783871889 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.788609028 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.789002895 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.789019108 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.789416075 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.789422989 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.892435074 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.893014908 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.893028975 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.893435955 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.893441916 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.915137053 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.915502071 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.915591955 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.915641069 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.915752888 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.915781021 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.915808916 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.915823936 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.915833950 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.915880919 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.915911913 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.915925980 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.915930033 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.915935040 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.918745995 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.918757915 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.918827057 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.918987989 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.919011116 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.919068098 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.919147015 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.919158936 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.919357061 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.919373035 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.927870989 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.928311110 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.928383112 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.928415060 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.928421021 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.928432941 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.928436995 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.931291103 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.931322098 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:30.931410074 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.931570053 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:30.931581020 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.028048992 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.028506994 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.028603077 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.028636932 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.028636932 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.028660059 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.028670073 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.031075001 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.031126976 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.031337976 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.031367064 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.031373024 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.199141026 CEST	443	49707	23.206.229.209	192.168.2.9
Oct 23, 2024 17:01:31.199233055 CEST	49707	443	192.168.2.9	23.206.229.209
Oct 23, 2024 17:01:31.654450893 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.654973984 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.654989004 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.655379057 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.655389071 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.668880939 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.670264006 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.670274973 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.670660973 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.670665979 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.674221992 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.674562931 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.674570084 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.674967051 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.674969912 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.776204109 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.776993036 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.777007103 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.777637959 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.777645111 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.785387039 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.785490036 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.785681009 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.785784960 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.785784960 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.785804033 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.785813093 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.788619995 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.788633108 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.788719893 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.788899899 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.788909912 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.802964926 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.803565025 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.803627014 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.803695917 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.803702116 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.803725958 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.803730011 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.805794001 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.805871964 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.805923939 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.806024075 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.806030035 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.806040049 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.806046009 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.806535006 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.806555033 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.806725025 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.806725025 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.806751013 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.808011055 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.808047056 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.808109045 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.808222055 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.808235884 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.909176111 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.909507990 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.909611940 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.909611940 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.909636021 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.909651995 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.912117958 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.912157059 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:31.912254095 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.912380934 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:31.912396908 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.547580957 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.548067093 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.548090935 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.548417091 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.548521042 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.548526049 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.548877954 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.548888922 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.549251080 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.549254894 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.558300972 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.560853004 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.560863018 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.568017006 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.568021059 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.656533003 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.668912888 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.668921947 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.675941944 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.675946951 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.684031010 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.684087992 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.684184074 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.687079906 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.687088966 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.687098026 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.687110901 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.695126057 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.697428942 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.698595047 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.698672056 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.698672056 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.698709011 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.698733091 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.699671030 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.699747086 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.700217009 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.707959890 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.707974911 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.708005905 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.708010912 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.766895056 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.766923904 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.766978979 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.768131018 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.768147945 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.768227100 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.768459082 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.768471003 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.768551111 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.768562078 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.769484997 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.769515991 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.769792080 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.769975901 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.769992113 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.804553032 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.804812908 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.804910898 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.805587053 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.805593967 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.805608034 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.805613041 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.808994055 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.809036016 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:32.809103012 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.809248924 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:32.809258938 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.028263092 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 23, 2024 17:01:33.502404928 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.502942085 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.502981901 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.503392935 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.503397942 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.504982948 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.505387068 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.505403042 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.505836964 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.505842924 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.546242952 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.546761036 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.546804905 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.547246933 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.547255039 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.635225058 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.635349035 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.635432005 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.635462046 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.635629892 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.635670900 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.635687113 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.635689974 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.635724068 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.635730028 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.635735035 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.635736942 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.635746956 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.635751963 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.639323950 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.639334917 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.639406919 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.640454054 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.640486956 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.640542984 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.640614033 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.640624046 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.640778065 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.640788078 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.677526951 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.678016901 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.678113937 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.678155899 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.678155899 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.678177118 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.678186893 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.680886030 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.680912971 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:33.680979013 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.681158066 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:33.681173086 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.387290955 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.388895988 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.418246031 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.418265104 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.418740988 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.418747902 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.422971964 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.422985077 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.423387051 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.423392057 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.428586960 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.429052114 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.429059029 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.429522991 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.429527044 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.540846109 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.546329975 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.546489000 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.546549082 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.551431894 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.551529884 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.551570892 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.552387953 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.552424908 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.552845955 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.552854061 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.553030968 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.553050995 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.553061008 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.553073883 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.556366920 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.556374073 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.556385040 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.556389093 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.562789917 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.562828064 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.562854052 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.562911987 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.562952995 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.562994957 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.563093901 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.563106060 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.564874887 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.564893007 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.564944983 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.565049887 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.565061092 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.565150976 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.565150976 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.565157890 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.565165043 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.569313049 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.569339037 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.569382906 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.569720984 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.569737911 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.678030014 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.678272009 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.678317070 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.678483009 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.678508997 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.678525925 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.678535938 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.681627989 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.681652069 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:34.681965113 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.681965113 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:34.682014942 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.293956995 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.299649000 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.299659967 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.300091982 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.300096035 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.311245918 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.313555002 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.313568115 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.313977003 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.313982010 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.421798944 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.432028055 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.433585882 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.433662891 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.444423914 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.444648027 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.444838047 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.465859890 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.672068119 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.672101021 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.672116041 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.672122955 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.673362970 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.673362970 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.673387051 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.673396111 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.673415899 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.673415899 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.673454046 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.673465014 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.682849884 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.682893038 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.683084965 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.683332920 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.683342934 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.686892986 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.686948061 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.687642097 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.687643051 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.687697887 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.807296038 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.807384014 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.807499886 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.822170019 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.822170019 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.822228909 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.822242022 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.839565992 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.839616060 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:35.839785099 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.839987040 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:35.839998960 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.430747986 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.431479931 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.431489944 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.432043076 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.432053089 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.495275021 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.495913982 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.495942116 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.496769905 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.496777058 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.563476086 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.564224958 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.564270020 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.564321041 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.564340115 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.564352036 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.564357996 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.568146944 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.568183899 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.568259001 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.568521023 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.568533897 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.573611975 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.574132919 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.574147940 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.574697971 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.574702024 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.628158092 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.628324986 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.628576994 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.632102966 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.632102966 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.632129908 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.632143021 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.635478020 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.635519981 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.635576010 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.635785103 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.635801077 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.898808002 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.898871899 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.898968935 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.899122000 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.899135113 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.899174929 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.899182081 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.901756048 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.901793957 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:36.901875019 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.902012110 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:36.902033091 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.298741102 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.299736977 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.306708097 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.306730986 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.306885958 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.306899071 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.307092905 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.307096958 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.307318926 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.307322979 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.385574102 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.386277914 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.386301994 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.386712074 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.386715889 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.433656931 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.433722019 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.433810949 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.433938026 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.433938026 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.433958054 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.433967113 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.437200069 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.437239885 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.437325954 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.437484026 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.437499046 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.446865082 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.447118998 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.447220087 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.447344065 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.447355986 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.447366953 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.447371960 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.452462912 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.452497959 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.452615976 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.452867985 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.452882051 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.517437935 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.517498970 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.517561913 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.517762899 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.517771006 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.517779112 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.517781973 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.520355940 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.520375967 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.520520926 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.520591974 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.520600080 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.639056921 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.649614096 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.649635077 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.650084019 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.650093079 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.776758909 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.776828051 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.776953936 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.777096987 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.777096987 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.777117968 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.777128935 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.779947996 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.779979944 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:37.780100107 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.781163931 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:37.781179905 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.170470953 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.172547102 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.172573090 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.173032999 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.173046112 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.174037933 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.174416065 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.174431086 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.175333977 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.175340891 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.253596067 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.259141922 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.259150982 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.263214111 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.263219118 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.301537037 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.301785946 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.301867962 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.305409908 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.305545092 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.305788994 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.308331013 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.308358908 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.308373928 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.308381081 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.319097996 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.319097996 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.319123030 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.319133043 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.391050100 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.391474009 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.391537905 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.410969973 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.410988092 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.411000013 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.411005020 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.416838884 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.416881084 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.416943073 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.419223070 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.419308901 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.419392109 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.419689894 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.419708967 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.420161009 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.420198917 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.423197985 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.423208952 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.423266888 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.423645973 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.423657894 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.522995949 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.524071932 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.524087906 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.525002003 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.525013924 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.656583071 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.656652927 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.656708002 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.662580013 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.662602901 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.662614107 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.662621021 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.667593002 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.667619944 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:38.667711973 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.668149948 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:38.668178082 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.149704933 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.150249958 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.150299072 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.150762081 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.150774956 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.158157110 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.158730030 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.158791065 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.159162045 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.159185886 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.159908056 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.160314083 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.160342932 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.160667896 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.160682917 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.287714958 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.287961960 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.288048983 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.288288116 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.288289070 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.288322926 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.288347960 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.290045977 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.290126085 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.290164948 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.290215969 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.290308952 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.290941954 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.291110039 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.291167021 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.291223049 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.291260004 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.291270018 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.291301012 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.291333914 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.293236017 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.293267965 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.293338060 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.293409109 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.293409109 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.293428898 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.293452024 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.294357061 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.294380903 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.294431925 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.294445038 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.295681000 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.295703888 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.295794010 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.295913935 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.295939922 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.539729118 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.540218115 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.540280104 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.540692091 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.540707111 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.732415915 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.732747078 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.732800961 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.733020067 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.733042002 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.733056068 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.733062983 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.735511065 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.735546112 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:39.735707998 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.735939980 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:39.735955000 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.030455112 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.031404018 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.031430960 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.031899929 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.031903982 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.034228086 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.034517050 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.034529924 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.034859896 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.034866095 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.047661066 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.048386097 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.048402071 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.048748016 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.048754930 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.163363934 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.164787054 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.164855003 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.164896011 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.164922953 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.164940119 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.164947987 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.167968988 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.168031931 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.168092012 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.168126106 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.168140888 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.168342113 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.168370962 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.168467045 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.168504000 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.168597937 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.168597937 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.168613911 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.168642044 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.170687914 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.170713902 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.170788050 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.170941114 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.170958996 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.196672916 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.197798967 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.197885036 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.197917938 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.197941065 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.197952032 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.197958946 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.200889111 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.200917006 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.201020002 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.201150894 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.201172113 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.507853031 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.508307934 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.508332968 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.508766890 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.508773088 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.641706944 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.642132044 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.642187119 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.642241955 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.642260075 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.642272949 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.642278910 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.645175934 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.645231962 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.645375967 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.645543098 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.645560980 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.912996054 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.913908958 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.913928986 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.914618015 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.914623976 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.916559935 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.917160988 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.917213917 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.917840004 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.917855978 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.938810110 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.939234018 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.939270973 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:40.939968109 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:40.939977884 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.045850992 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.045905113 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.045973063 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.046004057 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.046114922 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.046163082 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.050503016 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.050662994 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.050780058 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.052032948 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.052057981 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.052074909 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.052083969 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.074753046 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.074825048 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.074878931 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.074897051 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.079330921 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.079365969 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.079443932 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.079472065 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.079497099 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.079530001 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.079576969 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.250983953 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.251019955 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.251096010 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.273134947 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.273186922 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.273271084 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.274048090 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.274094105 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.274126053 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.274144888 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.282815933 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.282852888 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.282932997 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.282962084 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.286981106 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.287025928 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.287091017 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.287564039 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.287579060 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.379951954 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.399326086 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.399347067 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.400312901 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.400317907 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.526298046 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.526323080 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.526379108 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.526386023 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.526422024 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.526618004 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.526633978 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.526647091 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.526653051 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.530751944 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.530792952 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:41.530970097 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.532169104 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:41.532190084 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.017360926 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.018039942 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.018084049 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.018495083 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.018507004 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.021276951 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.021662951 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.021687031 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.022130013 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.022140026 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.026218891 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.026619911 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.026638985 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.027064085 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.027067900 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.148812056 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.148874044 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.149117947 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.149179935 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.149194956 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.149205923 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.149210930 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.152309895 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.152337074 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.152473927 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.152673960 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.152684927 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.153533936 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.153840065 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.153932095 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.153980970 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.153984070 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.154017925 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.154021025 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.158796072 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.158835888 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.158932924 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.159096003 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.159109116 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.169370890 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.170056105 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.170172930 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.170212030 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.170226097 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.170238972 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.170243979 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.172868013 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.172888994 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.173023939 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.173191071 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.173199892 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.264683962 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.265175104 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.265194893 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.265655041 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.265666962 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.394933939 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.395133972 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.395267010 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.395373106 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.395373106 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.395394087 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.395405054 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.398113966 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.398154020 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.398371935 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.398675919 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.398689985 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.890278101 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.890959024 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.890984058 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.891417027 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.891421080 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.908915997 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.909806967 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.910480976 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.910502911 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.911171913 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.911178112 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.911607027 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.911632061 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:42.911993980 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:42.912009001 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.022336960 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.022408962 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.022769928 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.022804022 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.022804022 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.022824049 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.022833109 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.025530100 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.025569916 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.025712013 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.025927067 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.025948048 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.039369106 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.039541960 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.039597034 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.039680004 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.039680004 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.039700985 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.039710045 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.040347099 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.040426970 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.040489912 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.040615082 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.040625095 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.040643930 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.040647984 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.042293072 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.042340994 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.042615891 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.042639017 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.042665958 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.042777061 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.042792082 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.042898893 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.042965889 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.042979002 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.127182007 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.127665997 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.127691031 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.128155947 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.128164053 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.258110046 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.258301973 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.258389950 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.258512020 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.258512020 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.258533955 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.258546114 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.261440992 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.261482954 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.261667013 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.261842012 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.261854887 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.771033049 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.771667004 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.771686077 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.772217989 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.772229910 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.782114983 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.791377068 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.792874098 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.825097084 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.839215994 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.839227915 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.839704990 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.839709044 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.840326071 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.840339899 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.841240883 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.841247082 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.844055891 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.844086885 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.844147921 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.844400883 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.844415903 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.906111002 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.906188965 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.906311035 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.936131001 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.936163902 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.936184883 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.936193943 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.968750954 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.968868971 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.968971968 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.969110012 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.969172001 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.969224930 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:43.969234943 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.969252110 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:43.969305992 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.020735025 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.083558083 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.152878046 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.152906895 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.152971983 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.152977943 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.154869080 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.154897928 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.154911995 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.154918909 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.156156063 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.156177044 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.156706095 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.156713009 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.248411894 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.248465061 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.248549938 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.273843050 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.273874044 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.277756929 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.277815104 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.277934074 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.281570911 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.281601906 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.297138929 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.297198057 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.298949957 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.341358900 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.341387033 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.346410036 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.346443892 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.346494913 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.350547075 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.350591898 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.350655079 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.350976944 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.350991011 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.352227926 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.352238894 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.577404976 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.577516079 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.579550028 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.579556942 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.579879999 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.580879927 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.627329111 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.707279921 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.707309961 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.707364082 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.707556963 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.707849026 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.707849026 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.707868099 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.707878113 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.711036921 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.711078882 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:44.711174965 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.711354017 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:44.711364985 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.023953915 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.024090052 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.024166107 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.024234056 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.025357962 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.025367975 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.025567055 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.026593924 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.029174089 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.029191017 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.029386997 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.030102015 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.071330070 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.075323105 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.082245111 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.082427025 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.084193945 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.084206104 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.084516048 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.085427046 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.087588072 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.087991953 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.089195013 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.089210987 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.089448929 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.090126038 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.127341032 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.135324955 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.153415918 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.153496027 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.153687000 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.153862953 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.153883934 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.153898001 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.153903961 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.157363892 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.157397032 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.157490015 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.157700062 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.157711029 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.158315897 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.158468008 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.158593893 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.158593893 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.158617973 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.158629894 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.160927057 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.161015034 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.161107063 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.161284924 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.161314964 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.218718052 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.218828917 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.218899965 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.218911886 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.218959093 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.219013929 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.219218969 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.219218969 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.219228983 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.219238043 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.219413996 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.219516039 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.219569921 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.219635010 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.219646931 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.219666004 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.219671965 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.222354889 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.222446918 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.222476006 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.222523928 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.222559929 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.222630978 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.222762108 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.222764015 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.222795963 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.222810984 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.452847958 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.453557968 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.453573942 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.454096079 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.454104900 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.585685968 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.585757017 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.585830927 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.586038113 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.586047888 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.586064100 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.586067915 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.589073896 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.589087009 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.589154005 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.589270115 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.589279890 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.891082048 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.891614914 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.891629934 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.894895077 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.894902945 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.895795107 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.896236897 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.896266937 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.896631002 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.896637917 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.971507072 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.972209930 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.972248077 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.972692013 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.972701073 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.985351086 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.985821009 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.985882044 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:45.986160040 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:45.986176014 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.022027016 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.022253036 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.022337914 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.022533894 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.022547960 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.022664070 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.022670031 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.026025057 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.026057005 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.026117086 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.026139021 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.026365995 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.026376963 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.026566029 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.026634932 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.026688099 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.026720047 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.026742935 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.026751041 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.029407024 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.029489994 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.029591084 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.029691935 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.029727936 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.101586103 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.102730036 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.102803946 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.102878094 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.102909088 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.102925062 CEST	49818	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.102932930 CEST	443	49818	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.106031895 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.106070042 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.106164932 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.106353998 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.106367111 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.121021032 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.121078014 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.121115923 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.121124983 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.121157885 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.121433973 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.121454000 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.121468067 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.121474981 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.124356985 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.124409914 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.124480009 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.124629021 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.124641895 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.320647955 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.321392059 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.321419001 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.321861029 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.321875095 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.453493118 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.453517914 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.453563929 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.453567982 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.453619957 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.456130028 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.456156015 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.456171989 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.456180096 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.464474916 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.464513063 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.464570999 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.465748072 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.465764999 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.768011093 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.769648075 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.795334101 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.795361996 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.799381018 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.799386978 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.809580088 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.848151922 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.849980116 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.860209942 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.860234022 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.861304045 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.861315012 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.862754107 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.862766027 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.863131046 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.863138914 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.863341093 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.863370895 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.863648891 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.863653898 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.928997040 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.929163933 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.929231882 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.929378033 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.929399967 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.929406881 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.929411888 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.936384916 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.936423063 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.936534882 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.936748028 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.936769962 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.989518881 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.990031004 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.990127087 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.990209103 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.990209103 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.990257978 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.990288019 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.990417957 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.990504980 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.991153955 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.991189957 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.991239071 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.991245985 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.991292000 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.991373062 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.991394997 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.991409063 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.991422892 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.992254972 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.992283106 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.992297888 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.992304087 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.999375105 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.999416113 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:46.999492884 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.999949932 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:46.999990940 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.000065088 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.000324011 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.000355959 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.000407934 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.000447035 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.000462055 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.000606060 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.000616074 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.000636101 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.000652075 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.200361013 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.201194048 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.201215029 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.201694012 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.201699018 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.331984043 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.332062960 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.332174063 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.332485914 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.332509995 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.332516909 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.332524061 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.336343050 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.336395025 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.336510897 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.336724997 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.336735010 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.686726093 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.687979937 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.687979937 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.687998056 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.688007116 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.736217976 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.737210989 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.737247944 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.737493038 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.737498999 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.745462894 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.745955944 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.745982885 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.746438026 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.746443033 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.748023033 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.748359919 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.748374939 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.748768091 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.748771906 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.821240902 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.821352959 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.821753025 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.821753025 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.821753025 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.824424028 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.824472904 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.824557066 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.824706078 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.824719906 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.881571054 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.881644011 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.881835938 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.881946087 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.881963015 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.881977081 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.881982088 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.882652998 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.882848978 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.882894039 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.882961035 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.882968903 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.884910107 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.884953022 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.885148048 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.885148048 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.885179996 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.885183096 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.885232925 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:47.885286093 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.885406971 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:47.885422945 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.066982985 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.067540884 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.067558050 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.068150043 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.068157911 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.121965885 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.121994019 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.197594881 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.197690010 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.197763920 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.198015928 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.198015928 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.198029041 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.198039055 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.201271057 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.201313019 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.201395035 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.201579094 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.201594114 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.560508966 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.561007023 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.561050892 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.561598063 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.561606884 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.623094082 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.623641014 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.623657942 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.624119997 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.624128103 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.643455982 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.643956900 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.643991947 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.644412994 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.644419909 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.884835958 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.884917974 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.885027885 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.885174036 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.885201931 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.885211945 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.885235071 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.885238886 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.885279894 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.885324001 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.885360956 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.885380983 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.885394096 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.885401964 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.888468027 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.888520002 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.888539076 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.888575077 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.888598919 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.888629913 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.888782978 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.888783932 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:48.888799906 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:48.888801098 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.007545948 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.008044004 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.008121967 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.008171082 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.008198023 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.008213997 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.008222103 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.011199951 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.011241913 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.011347055 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.011538029 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.011548996 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.014369965 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.014919043 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.014941931 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.015295982 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.015304089 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.146998882 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.147068024 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.147180080 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.155374050 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.155385017 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.155462027 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.155468941 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.166743040 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.166795969 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.166886091 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.167097092 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.167115927 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.414123058 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.414160013 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.414213896 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.414269924 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.414365053 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.414629936 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.414629936 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.414654016 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.414665937 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.417375088 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.417411089 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.417494059 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.417665005 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.417675972 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.623482943 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.668996096 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.674876928 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.674911976 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.681905985 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.681922913 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.683830976 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.685710907 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.685735941 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.693048000 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.693067074 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.749320984 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.759736061 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.759758949 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.760797024 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.760801077 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.809176922 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.809257984 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.809326887 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.831222057 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.831300020 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.831386089 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.831451893 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.831492901 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.831649065 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.835196018 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.835196018 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.835238934 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.835254908 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.856688976 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.856722116 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.856750965 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.856758118 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.864806890 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.864871979 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.864959955 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.865292072 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.865312099 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.865962982 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.866027117 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.866082907 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.866308928 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.866332054 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.888169050 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.888334990 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.888389111 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.897165060 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.897188902 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.897200108 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.897206068 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.900923967 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.900962114 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:49.901019096 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.901181936 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:49.901195049 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.002446890 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.009212971 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:50.009246111 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.009695053 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:50.009704113 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.136852026 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.137072086 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.137134075 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.137226105 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:50.137226105 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:50.137320042 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:50.137361050 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.137391090 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:50.137408972 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.141424894 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:50.141539097 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.141664028 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:50.141872883 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:50.141907930 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.155106068 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.156060934 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:50.156099081 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:50.157511950 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:50.157520056 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.274676085 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.274744987 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.274884939 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.275185108 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.275207996 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.275223970 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.275230885 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.279757023 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.279819965 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.279917955 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.280129910 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.280162096 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.406270981 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.406936884 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.406974077 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.407460928 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.407470942 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.412403107 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.412853956 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.412945986 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.413305044 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.413326025 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.414108038 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.414426088 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.414458990 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.414805889 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.414815903 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.417633057 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.417963028 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.417982101 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.418339968 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.418346882 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.535648108 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.535832882 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.535892963 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.536197901 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.536223888 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.536242008 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.536251068 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.542911053 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.542963982 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.543029070 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.546272993 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.546312094 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.546365976 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.546382904 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.546426058 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.546840906 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.546947956 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.547000885 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.548288107 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.548317909 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.549938917 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.550015926 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.550064087 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.550090075 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.550137997 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.550184965 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.555427074 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.555473089 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.555497885 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.555505991 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.555879116 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.555879116 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.555907011 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.555919886 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.556687117 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.556701899 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.556714058 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.556720018 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.560092926 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.560131073 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.560205936 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.560605049 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.560620070 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.561570883 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.561621904 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.561675072 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.561698914 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.561713934 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.561764002 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.561878920 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.561889887 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:51.561922073 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:51.561935902 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.021564007 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.022317886 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.022346973 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.022907019 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.022917032 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.153064013 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.153090954 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.153140068 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.154144049 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.154200077 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.154952049 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.154977083 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.154992104 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.154997110 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.158323050 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.158370018 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.158869982 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.159265995 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.159281015 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.275834084 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.277647018 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.277725935 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.278166056 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.278182983 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.289473057 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.297410965 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.308909893 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.317749977 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.317768097 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.318331003 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.318336964 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.322052956 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.322072029 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.322493076 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.322498083 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.322782040 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.322788954 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.323273897 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.323277950 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.404541969 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.404608965 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.404661894 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.419404030 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.419429064 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.419445992 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.419454098 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.442413092 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.442557096 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.442953110 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.451071978 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.451092005 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.451108932 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.451117992 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.451998949 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.452043056 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.452090025 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.452100039 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.452114105 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.452152014 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.455925941 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.455986977 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.456053972 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.466829062 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.466851950 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.467016935 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.471097946 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.471101999 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.471117020 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.471121073 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.479600906 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.479629040 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.479763031 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.479768991 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.479779959 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.479783058 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.514206886 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.514236927 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.518990040 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.540396929 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.540426970 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.540548086 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.540601015 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.540678024 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.551714897 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.551753044 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.553391933 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.553427935 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.553579092 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.553704977 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.553715944 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.915482998 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.917226076 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.917270899 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:52.917969942 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:52.917977095 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.047152996 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.047234058 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.047347069 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.047682047 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.047682047 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.047700882 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.047710896 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.051131010 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.051196098 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.051275969 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.051460981 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.051477909 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.218274117 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.219227076 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.219257116 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.220665932 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.220676899 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.269449949 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.270127058 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.270145893 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.270652056 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.270662069 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.290564060 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.291963100 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.292021990 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.296783924 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.301098108 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.301124096 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.301191092 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.301212072 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.301534891 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.301538944 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.350544930 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.350575924 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.350620031 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.350887060 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.350887060 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.351157904 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.351171970 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.351186991 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.351192951 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.356909990 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.356950998 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.357023001 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.357217073 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.357228041 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.414511919 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.414594889 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.414649963 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.414859056 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.414875031 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.414886951 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.414891958 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.418317080 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.418340921 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.418406963 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.418587923 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.418598890 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.428066969 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.428245068 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.428303957 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.428345919 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.428370953 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.428383112 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.428389072 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.431083918 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.431098938 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.431164980 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.431323051 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.431333065 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.435522079 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.435724974 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.435775042 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.435839891 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.435862064 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.435863972 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.435874939 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.438554049 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.438582897 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.438649893 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.438779116 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.438791990 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.795809031 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.796446085 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.796462059 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.797002077 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.797007084 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.928073883 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.928158998 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.928291082 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.928347111 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.928563118 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.928563118 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.928585052 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.928601027 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.932185888 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.932221889 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:53.932311058 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.932483912 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:53.932495117 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.086287975 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.087259054 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.087280989 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.087869883 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.087884903 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.156850100 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.157742023 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.157764912 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.158343077 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.158348083 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.170089006 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.170594931 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.170619965 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.170939922 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.170944929 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.184880018 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.185425043 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.185439110 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.185945034 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.185950041 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.217899084 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.218008995 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.218111992 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.218497038 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.218497038 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.218517065 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.218530893 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.222703934 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.222733021 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.222851992 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.223081112 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.223093987 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.293853998 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.293924093 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.294040918 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.294090033 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.294114113 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.294538021 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.294553995 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.294575930 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.294580936 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.298481941 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.298497915 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.298583031 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.298763990 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.298773050 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.301271915 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.301884890 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.301966906 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.302001953 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.302020073 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.302031994 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.302037954 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.304704905 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.304732084 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.304827929 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.304961920 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.304966927 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.317632914 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.317701101 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.317785025 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.322722912 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.322722912 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.322748899 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.322761059 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.326932907 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.326956034 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.327035904 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.327194929 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.327205896 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.684792042 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.685676098 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.685699940 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.686177015 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.686182976 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.818895102 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.818978071 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.819128036 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.819449902 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.819449902 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.819468021 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.819483042 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.822689056 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.822729111 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.822890043 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.822993040 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.823009014 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.963010073 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.963639975 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.963660955 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:54.964303970 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:54.964310884 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.043009996 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.044079065 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.044094086 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.044723988 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.044739008 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.049804926 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.050309896 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.050338984 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.050676107 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.050681114 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.056411982 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.056832075 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.056862116 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.057179928 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.057193041 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.093276024 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.093548059 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.093760014 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.093806028 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.093806028 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.093822002 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.093832016 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.097604990 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.097670078 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.097776890 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.097996950 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.098027945 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.176783085 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.176867962 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.177337885 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.177337885 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.177423954 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.177440882 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.184376955 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.184540987 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.184612989 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.185883045 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.186194897 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.186252117 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.187527895 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.187577009 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.187645912 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.187793016 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.187798023 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.187819958 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.187824011 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.191365004 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.191401005 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.191456079 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.194854975 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.194861889 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.194869995 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.194873095 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.196731091 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.196768045 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.197141886 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.197158098 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.203145981 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.203190088 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.203246117 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.203516960 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.203526020 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.555280924 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.556687117 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.556687117 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.556710958 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.556729078 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.685286999 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.685424089 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.685503006 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.685554981 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.685592890 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.686923027 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.686923027 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.686948061 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.686958075 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.690721035 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.690776110 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.690880060 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.691104889 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.691119909 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.938410044 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.939232111 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.939276934 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.939666986 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.939675093 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.941051960 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.941334963 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.941346884 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.941622972 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.941631079 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.942658901 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.942925930 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.942959070 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:55.943198919 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:55.943205118 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.068532944 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.068595886 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.068761110 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.068794012 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.068841934 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.068902016 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.069128036 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.069171906 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.069214106 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.069236040 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.072318077 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.072392941 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.072469950 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.072628021 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.072639942 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.072650909 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.072657108 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.073091030 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.073137045 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.073220015 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.073400974 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.073419094 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.075877905 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.075896978 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.075968027 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.076109886 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.076124907 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.076273918 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.076354027 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.076400042 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.076569080 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.076582909 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.076596975 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.076602936 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.078753948 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.078768015 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.078839064 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.078979969 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.078996897 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.652475119 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.653395891 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.653420925 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.653904915 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.653909922 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.787754059 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.787806034 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.787864923 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.787952900 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.788023949 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.788403034 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.788451910 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.788481951 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.788499117 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.792579889 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.792643070 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.792778015 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.793021917 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.793059111 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.795968056 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.796461105 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.796478987 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.797118902 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.797123909 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.821175098 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.822004080 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.822037935 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.822470903 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.822478056 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.826448917 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.826798916 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.826836109 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.827146053 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.827152014 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.828805923 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.829132080 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.829145908 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.829461098 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.829464912 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.926896095 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.927216053 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.927299976 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.927556038 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.927571058 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.927592039 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.927597046 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.932600021 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.932637930 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.932729006 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.932965040 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.932976961 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.955512047 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.955543995 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.955599070 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.955638885 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.955674887 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.956033945 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.956060886 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.956075907 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.956084013 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.956998110 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.957134008 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.957211018 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.957365990 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.957381964 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.957392931 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.957398891 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.959935904 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.960000992 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.960016012 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.960047960 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.960094929 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.960123062 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.960270882 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.960284948 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.960303068 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.960335970 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.962241888 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.962313890 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.962366104 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.962377071 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.962424994 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.962471962 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.962519884 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.962527037 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.964773893 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.964795113 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:56.964881897 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.965054035 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:56.965073109 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.535200119 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.535816908 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.535862923 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.536317110 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.536325932 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.667535067 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.668216944 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.668561935 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.668561935 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.668561935 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.671636105 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.671690941 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.671782970 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.671956062 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.671972990 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.679991007 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.680207968 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.680491924 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.680561066 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.680573940 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.680597067 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.680973053 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.680989027 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.681011915 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.681018114 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.690988064 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.692965031 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.692965031 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.692996025 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.693018913 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.694411039 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.694727898 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.694740057 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.695113897 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.695118904 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.813908100 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.813941956 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.814011097 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.814089060 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.814089060 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.814423084 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.814423084 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.814471006 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.814498901 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.815829992 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.815857887 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.815922976 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.815923929 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.815965891 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.816222906 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.816235065 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.816246033 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.816251993 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.818834066 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.818928957 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.819019079 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.819283962 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.819330931 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.820322037 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.820367098 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.820444107 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.820568085 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.820595980 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.820687056 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.821583033 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.821651936 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.821698904 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.821698904 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.821724892 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.821748018 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.823720932 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.823753119 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.823816061 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.823950052 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.823962927 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.830518961 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.830646038 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.830687046 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.830708027 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.830730915 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.830872059 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.830878973 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.830893040 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.830897093 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.833198071 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.833234072 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.833300114 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.833411932 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.833424091 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:57.981547117 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:57.981584072 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.393733978 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.394448996 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.394479036 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.394972086 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.394979000 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.523245096 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.523789883 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.523868084 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.523951054 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.523972034 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.523983955 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.523989916 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.526949883 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.526989937 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.527080059 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.527265072 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.527281046 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.553057909 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.553564072 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.553601980 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.553915024 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.554119110 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.554131031 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.554261923 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.554276943 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.554660082 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.554666996 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.567213058 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.567626953 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.567641973 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.568078995 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.568087101 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.571671009 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.571995020 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.572001934 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.572518110 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.572521925 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.684544086 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.684628963 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.684856892 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.685204029 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.685204029 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.685224056 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.685233116 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.688735962 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.688772917 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.688858032 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.689047098 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.689060926 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.689882040 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.689914942 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.689961910 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.689965010 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.690016031 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.690119028 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.690133095 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.690152884 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.690157890 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.692257881 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.692301035 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.692374945 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.692502022 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.692522049 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.700031042 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.700217962 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.700274944 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.700696945 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.700709105 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.700721979 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.700728893 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.703211069 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.703241110 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.703318119 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.703442097 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.703455925 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.704895973 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.704921007 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.704961061 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.704967976 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.704982042 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.705024958 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.705179930 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.705180883 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.705192089 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.705199957 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.707087040 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.707118034 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:58.707191944 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.707334042 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:58.707346916 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.271284103 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.281590939 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.281600952 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.288383007 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.288397074 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.416480064 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.416666031 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.416724920 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.423379898 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.439723015 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.440210104 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.447864056 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.447901011 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.448204994 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.448216915 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.451270103 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.464728117 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.464749098 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.465835094 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.481527090 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.481532097 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.523353100 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.523367882 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.540354013 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.540380001 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.543286085 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.543292046 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.543406963 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.543411970 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.543755054 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.543761969 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.545161963 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.545175076 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.545542955 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.545555115 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.550239086 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.550277948 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.550354958 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.550465107 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.550474882 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.652174950 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.652427912 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.652488947 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.653930902 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.653930902 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.653954983 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.653966904 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.664860964 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.664912939 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.664988041 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.665514946 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.665535927 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.669929981 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.670047998 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.670092106 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.670300961 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.670319080 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.670330048 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.670336008 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.670581102 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.671165943 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.671219110 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.671228886 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.671283007 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.671329975 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.671329975 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.671343088 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.671356916 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.671360970 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.678353071 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.678426981 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.678495884 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.688716888 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.688812017 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.688895941 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.691807032 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.691838980 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.691854954 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.691864967 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.694116116 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.694153070 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.697307110 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.697343111 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.697411060 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.701935053 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.701948881 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.704076052 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.704119921 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 23, 2024 17:01:59.704190016 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.704289913 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:01:59.704303980 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.297844887 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.298702955 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.298727989 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.299134970 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.299139977 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.387054920 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.388035059 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.388102055 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.388755083 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.388771057 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.429979086 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.430047989 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.430162907 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.430438042 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.430461884 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.430480003 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.430485010 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.434151888 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.434204102 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.434303999 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.434607029 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.434637070 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.439322948 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.439769983 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.439785004 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.440232038 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.440237045 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.440790892 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.441051960 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.441157103 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.441253901 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.441334963 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.441351891 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.441474915 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.441488981 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.441796064 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.441801071 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.520338058 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.520410061 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.520473957 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.526367903 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.526428938 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.526470900 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.526487112 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.531188965 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.531235933 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.531301022 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.531513929 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.531526089 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.571674109 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.571722031 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.571768045 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.571774006 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.571820021 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.572277069 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.572292089 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.572304964 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.572310925 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.572432995 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.572587967 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.572680950 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.573441029 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.574033022 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.574079037 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.574079990 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.574126005 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.575185061 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.575187922 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.575193882 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.575203896 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.575207949 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.575227022 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.579603910 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.579653025 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.579710007 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.580240011 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.580281019 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.580332041 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.580449104 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.580467939 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.580550909 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.580565929 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.581245899 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.581278086 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:00.581337929 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.581607103 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:00.581623077 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.165060997 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.165649891 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.165693998 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.166137934 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.166146040 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.262854099 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.263550997 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.263597012 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.264065981 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.264070988 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.295099974 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.295300961 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.295394897 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.295521975 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.295550108 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.295566082 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.295573950 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.298757076 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.298796892 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.298892021 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.299053907 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.299067974 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.302936077 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.303339005 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.303354025 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.303822994 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.303831100 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.315198898 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.315690041 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.315711975 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.316152096 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.316157103 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.321769953 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.322145939 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.322180033 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.322590113 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.322599888 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.615715981 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.615756989 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.615799904 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.615835905 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.615860939 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.615890980 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.615919113 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.615978003 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.615981102 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.616018057 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.616158009 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.616183043 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.616190910 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.616199017 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.616252899 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.616252899 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.616272926 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.616282940 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.616305113 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.616379976 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.616425991 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.616605043 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.616674900 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.616744041 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.617966890 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.617966890 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.617985964 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.617995977 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.618944883 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.618951082 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.618962049 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.618966103 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.622100115 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.622129917 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.622134924 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.622160912 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.622215033 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.622338057 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.622864008 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.622878075 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.623013973 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.623030901 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.623039007 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.623044014 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.623219013 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.623332977 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.623343945 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.624003887 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.624042988 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:01.624106884 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.624241114 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:01.624255896 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.027354002 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.028162003 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.028182983 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.028981924 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.028986931 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.159548044 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.159574032 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.159638882 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.159740925 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.194710970 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.194751024 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.194792986 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.194799900 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.198009014 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.198048115 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.198137045 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.198298931 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.198312044 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.381045103 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.381830931 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.382680893 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.383279085 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.409715891 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.409745932 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.410346031 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.410356998 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.410878897 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.410902023 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.411237001 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.411242962 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.411444902 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.411473989 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.411772966 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.411777973 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.411993980 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.412008047 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.412328959 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.412333965 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.537359953 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.537442923 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.537553072 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.537585020 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.537750959 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.537877083 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.537897110 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.537916899 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.537921906 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.538036108 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.538280964 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.538326025 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.539346933 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.539370060 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.539386988 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.539392948 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.540343046 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.540371895 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.540419102 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.540420055 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.540466070 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.542938948 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.542958021 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.543028116 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.543076038 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.543076038 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.549289942 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.549309015 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.549320936 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.549325943 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.551752090 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.551752090 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.551765919 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.551774025 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.553977013 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.554003954 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.554069996 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.556879997 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.556922913 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.556993008 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.557595015 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.557610989 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.557754993 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.557774067 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.558676004 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.558706999 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.559010029 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.559256077 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.559266090 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.596857071 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.596900940 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.596976042 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.601200104 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.601212025 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.921282053 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.921960115 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.921972990 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:02.922760010 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:02.922765970 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.060157061 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.060235977 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.060338974 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.060554028 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.060580015 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.060590982 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.060596943 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.064172029 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.064209938 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.064305067 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.064496040 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.064511061 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.278846979 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.279670000 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.279700041 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.280277014 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.280282974 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.285707951 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.286315918 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.286329031 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.286788940 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.286793947 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.297367096 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.297859907 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.297892094 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.298300982 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.298326969 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.332240105 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.332818985 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.332832098 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.333394051 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.333400011 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.407272100 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.407565117 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.407636881 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.407680988 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.407696962 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.407763004 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.407839060 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.407856941 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.407866955 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.407871008 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.411113024 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.411153078 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.411227942 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.411365032 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.411375046 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.414563894 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.414740086 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.414800882 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.414834023 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.414834023 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.414849043 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.414858103 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.417368889 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.417397022 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.417939901 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.417939901 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.417965889 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.429727077 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.429821968 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.429923058 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.430053949 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.430053949 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.430073977 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.430082083 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.432538033 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.432581902 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.432656050 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.432811022 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.432826042 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.462946892 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.463330984 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.463378906 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.463413000 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.463462114 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.463555098 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.463567019 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.463579893 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.463584900 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.466934919 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.466968060 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.467210054 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.467211008 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.467248917 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.812211990 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.813086987 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.813097000 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.813740969 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.813745975 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.945295095 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.945663929 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.945719957 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.945791960 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.945791960 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.945873022 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.945873022 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.945894957 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.945904970 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.949146032 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.949213982 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:03.949300051 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.949480057 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:03.949496984 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.155440092 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.156842947 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.156857014 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.157504082 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.157510042 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.158214092 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.158761978 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.158776999 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.159174919 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.159182072 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.170334101 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.170789957 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.170797110 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.171325922 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.171329975 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.213360071 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.214029074 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.214042902 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.214422941 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.214430094 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.289236069 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.289309025 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.289495945 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.292414904 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.292491913 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.292620897 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.294620037 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.294651985 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.294667959 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.294677019 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.296499014 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.296499014 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.296530962 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.296544075 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.298161983 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.298213959 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.298297882 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.298309088 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.298350096 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.298511028 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.298528910 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.298530102 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.298682928 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.298700094 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.303165913 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.303186893 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.303224087 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.303236961 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.303263903 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.303447008 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.303447962 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.303457022 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.303467989 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.305856943 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.305870056 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.305946112 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.306058884 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.306071043 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.347852945 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.347980976 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.348227024 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.348248959 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.348262072 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.348325014 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.348331928 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.351464033 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.351505995 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.351584911 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.351725101 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.351738930 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.678205967 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.679332018 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.679358959 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.680506945 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.680512905 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.807845116 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.807929039 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.808006048 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.808301926 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.808321953 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.808331013 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.808336020 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.812203884 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.812247992 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:04.812329054 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.812463999 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:04.812475920 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.036473989 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.037254095 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.037286997 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.037858963 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.037864923 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.053204060 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.053626060 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.053637028 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.054104090 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.054111004 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.092595100 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.093206882 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.093234062 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.093755007 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.093760967 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.168868065 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.168898106 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.168943882 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.169023037 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.169509888 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.169511080 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.169548988 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.169573069 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.172975063 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.173011065 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.173100948 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.173459053 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.173472881 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.184982061 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.185396910 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.185519934 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.185558081 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.185591936 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.185646057 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.185666084 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.185688972 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.185702085 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.188765049 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.188844919 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.188957930 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.189140081 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.189177990 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.226620913 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.227302074 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.227370977 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.227526903 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.227526903 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.227540970 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.227550983 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.230362892 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.230401993 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.230480909 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.230654955 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.230670929 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.553577900 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.554339886 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.554372072 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.554943085 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.554958105 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.919955969 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.920048952 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.920108080 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.920330048 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.920350075 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.920361042 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.920366049 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.923856020 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.923896074 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:05.923983097 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.924166918 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:05.924179077 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.051009893 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.051328897 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.051974058 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.051978111 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.052006960 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.052007914 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.052655935 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.052661896 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.052686930 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.052691936 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.053936005 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.054297924 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.054323912 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.054799080 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.054805994 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.182312012 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.182317019 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.182398081 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.182403088 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.182491064 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.182492018 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.182790041 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.182801962 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.182805061 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.182815075 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.182815075 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.182820082 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.182847977 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.182853937 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.186289072 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.186314106 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.186341047 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.186376095 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.186392069 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.186480045 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.186577082 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.186588049 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.186604023 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.186615944 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.187760115 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.187784910 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.187829018 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.187830925 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.187871933 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.187994957 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.188013077 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.188028097 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.188035011 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.190212965 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.190248013 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.190361023 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.190479040 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.190495968 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.216046095 CEST	49705	80	192.168.2.9	104.18.38.233
Oct 23, 2024 17:02:06.216156960 CEST	49704	80	192.168.2.9	104.18.38.233
Oct 23, 2024 17:02:06.216202974 CEST	49706	80	192.168.2.9	172.64.149.23
Oct 23, 2024 17:02:06.221915960 CEST	80	49705	104.18.38.233	192.168.2.9
Oct 23, 2024 17:02:06.222012997 CEST	49705	80	192.168.2.9	104.18.38.233
Oct 23, 2024 17:02:06.222608089 CEST	80	49704	104.18.38.233	192.168.2.9
Oct 23, 2024 17:02:06.222676992 CEST	49704	80	192.168.2.9	104.18.38.233
Oct 23, 2024 17:02:06.222700119 CEST	80	49706	172.64.149.23	192.168.2.9
Oct 23, 2024 17:02:06.222759962 CEST	49706	80	192.168.2.9	172.64.149.23
Oct 23, 2024 17:02:06.668953896 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.670181990 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.670208931 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.671365023 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.671375036 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.802268982 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.802309990 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.802373886 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.802433014 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.802433014 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.802745104 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.802745104 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.802767992 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.802779913 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.806845903 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.806881905 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.807333946 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.807333946 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.807365894 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.925484896 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.926167011 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.926184893 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.926702023 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.926707029 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.929886103 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.930308104 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.930325031 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.930835962 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.930845976 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.948921919 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.949306965 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.949321985 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:06.949809074 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:06.949814081 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.056730986 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.056984901 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.057049990 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.062890053 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.062922955 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.062941074 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.062947989 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.066293001 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.066656113 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.066786051 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.066848993 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.066879988 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.066888094 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.066905975 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.066934109 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.067035913 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.067044973 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.067347050 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.067362070 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.069196939 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.069221973 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.069313049 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.069411039 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.069417953 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.080334902 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.080401897 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.080447912 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.080460072 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.080507994 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.080564976 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.080744028 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.080756903 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.080765963 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.080770016 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.083419085 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.083462954 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.083530903 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.083703995 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.083719969 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.546216965 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.547010899 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.547049999 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.547744036 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.547750950 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.681097031 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.681179047 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.681226015 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.681546926 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.681561947 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.681576014 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.681581974 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.685883999 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.685941935 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.686000109 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.686619997 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.686635017 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.810934067 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.811660051 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.811691046 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.812339067 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.812345982 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.817524910 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.817817926 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.817850113 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.818301916 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.818314075 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.945072889 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.945137024 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.945246935 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.945555925 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.945569038 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.945580959 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.945585966 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.949542046 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.949579000 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.949678898 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.949863911 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.949879885 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.949945927 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.950031042 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.950095892 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.950215101 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.950221062 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.950236082 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.950239897 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.952815056 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.952853918 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:07.952928066 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.953058958 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:07.953068972 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.418554068 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.420387030 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.420428038 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.421483040 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.421489954 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.461433887 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.462337971 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.462352037 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.462995052 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.463001966 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.546544075 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.546678066 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.546751022 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.546751022 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.546804905 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.547086954 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.547106028 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.547116041 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.547122002 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.550976038 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.551026106 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.551117897 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.551302910 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.551322937 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.597892046 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.597928047 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.597986937 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.598001003 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.598017931 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.598068953 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.598357916 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.598370075 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.598381996 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.598390102 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.602291107 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.602355957 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.602468014 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.602657080 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.602673054 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.693413973 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.694058895 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.694077015 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.694713116 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.694716930 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.715419054 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.716504097 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.716526985 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.716955900 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.716959953 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.824172974 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.824260950 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.824318886 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.824551105 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.824596882 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.824630976 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.824647903 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.829317093 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.829360962 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.829442978 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.829688072 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.829703093 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.851330996 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.851376057 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.851432085 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.851481915 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.851532936 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.851865053 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.851877928 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.851897955 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.851903915 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.855334044 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.855386019 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:08.855478048 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.855690002 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:08.855705976 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.279383898 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.279966116 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.280004025 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.280504942 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.280514002 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.329027891 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.329531908 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.329576015 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.330030918 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.330043077 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.410192966 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.410259962 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.410319090 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.410526037 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.410547018 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.410561085 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.410567999 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.413188934 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.413234949 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.413327932 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.413453102 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.413460016 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.459198952 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.459271908 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.459363937 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.459666014 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.459707975 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.459738016 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.459753036 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.462595940 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.462661028 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.462755919 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.462927103 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.462940931 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.563829899 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.564524889 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.564555883 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.565022945 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.565032005 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.613001108 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.613677025 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.613738060 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.614156008 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.614171028 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.704889059 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.704953909 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.704999924 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.705235958 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.705260992 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.705275059 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.705280066 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.708008051 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.708022118 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.708085060 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.708277941 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.708287954 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.749380112 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.749468088 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.749531984 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.749564886 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.749589920 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.749660969 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.749881983 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.749897957 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.749908924 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.749914885 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.752614975 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.752700090 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:09.752791882 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.752919912 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:09.752950907 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.148336887 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.149303913 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.149332047 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.149724960 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.149730921 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.194853067 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.195933104 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.195960045 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.196173906 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.196181059 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.280862093 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.281718016 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.281785965 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.281830072 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.281847954 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.281857967 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.281863928 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.284524918 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.284616947 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.284702063 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.284845114 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.284867048 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.329724073 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.331079960 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.331285954 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.331377029 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.331413984 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.331450939 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.331465960 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.333936930 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.333975077 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.334042072 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.334178925 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.334193945 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.431885004 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.432756901 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.432781935 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.433171988 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.433176994 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.507574081 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.508038998 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.508058071 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.508466005 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.508476019 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.573452950 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.573502064 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.573643923 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.574002981 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.574002981 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.574021101 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.574035883 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.577291012 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.577372074 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.577455044 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.577617884 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.577655077 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.639349937 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.639595985 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.639760017 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.639914036 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.639926910 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.639959097 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.639970064 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.643143892 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.643176079 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:10.643269062 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.643472910 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:10.643487930 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.068742990 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.069194078 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.069246054 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.069637060 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.069658995 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.202016115 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.202102900 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.202179909 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.202454090 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.202474117 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.202497959 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.202503920 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.205984116 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.206021070 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.206120014 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.206269979 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.206290007 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.301228046 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.301948071 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.302016020 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.302356005 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.302371979 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.380702019 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.381361961 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.381422997 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.381834984 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.381848097 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.432511091 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.432574987 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.432648897 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.432876110 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.432876110 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.432898998 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.432923079 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.436121941 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.436161041 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.436245918 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.436399937 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.436407089 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.510396957 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.510426044 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.510474920 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.510493040 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.510552883 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.510799885 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.510848999 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.510879040 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.510895014 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.513979912 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.514018059 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.514260054 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.514347076 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.514363050 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.569802999 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.570538044 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.570601940 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.570867062 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.570882082 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.943665028 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.944448948 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.944468021 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:11.945075035 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:11.945082903 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.077850103 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.077944994 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.078118086 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.078511953 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.078511953 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.078541994 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.078555107 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.083023071 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.083070993 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.083158016 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.083369970 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.083375931 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.175601959 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.175843954 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.175918102 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.176114082 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.176114082 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.176165104 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.176197052 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.182492971 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.183303118 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.183356047 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.183427095 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.183888912 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.183921099 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.184369087 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.184374094 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.188616037 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.188647985 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.259545088 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.260160923 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.260189056 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.260675907 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.260684013 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.316087008 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.316123962 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.316173077 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.316236973 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.316260099 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.316468000 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.316485882 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.316498995 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.316504955 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.319546938 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.319561005 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.319645882 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.319799900 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.319811106 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.394268036 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.394332886 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.394512892 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.394663095 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.394685984 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.394778967 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.394785881 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.397602081 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.397639990 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.397720098 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.397866011 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.397877932 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.829585075 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.830296040 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.830317974 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.830914974 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.830923080 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.928567886 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.929125071 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.929150105 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.929625988 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.929630995 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.963675976 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.963948011 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.964005947 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.964016914 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.964045048 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.964099884 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.964169979 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.964190960 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.964204073 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.964211941 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.967901945 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.967951059 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:12.968029976 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.968189955 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:12.968197107 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.061481953 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.061564922 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.061628103 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.061888933 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.061906099 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.061914921 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.061919928 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.062716961 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.063535929 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.063558102 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.063997030 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.064002991 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.065733910 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.065774918 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.065865040 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.065979958 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.065994978 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.137239933 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.148188114 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.148221016 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.150307894 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.150326967 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.196821928 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.196890116 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.197000980 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.197253942 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.197268009 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.197283983 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.197289944 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.200447083 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.200473070 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.200556993 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.200773954 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.200788021 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.278667927 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.278866053 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.278956890 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.314769030 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.314801931 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.358819008 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.358860016 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.358932018 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.359107018 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.359112978 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.641959906 CEST	49708	80	192.168.2.9	93.184.221.240
Oct 23, 2024 17:02:13.783245087 CEST	80	49708	93.184.221.240	192.168.2.9
Oct 23, 2024 17:02:13.783294916 CEST	49708	80	192.168.2.9	93.184.221.240
Oct 23, 2024 17:02:13.909955978 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.915851116 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.931782961 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.931808949 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.932295084 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.932300091 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.932610035 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.932626963 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.933002949 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.933007956 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.933144093 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.933423996 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.933451891 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:13.933804989 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:13.933810949 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.059843063 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.059881926 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.059926033 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.059930086 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.059976101 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.060210943 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.060233116 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.060250044 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.060255051 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.060491085 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.060594082 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.060652018 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.061709881 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.061729908 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.061744928 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.061749935 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.064917088 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.064960957 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.064965010 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.064996958 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.065032959 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.065053940 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.065203905 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.065217018 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.065241098 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.065253973 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.065740108 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.065896988 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.065993071 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.066050053 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.066061020 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.066073895 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.066078901 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.068156958 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.068190098 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.068254948 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.068376064 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.068387985 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.109069109 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.109770060 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.109777927 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.110295057 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.110299110 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.373572111 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.373591900 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.373641014 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.373677015 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.373734951 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.374053955 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.374064922 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.374079943 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.374085903 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.377800941 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.377841949 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:14.377938986 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.378113031 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:14.378128052 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.845928907 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.848392010 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.850295067 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.850610018 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.850636959 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.851449966 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.851468086 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.851824045 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.851850986 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.852488041 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.852493048 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.852989912 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.853034973 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.853622913 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.853638887 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.979104996 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.979129076 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.979201078 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.979238987 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.979273081 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.979330063 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.979372025 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.979392052 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.983135939 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.983196020 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.983269930 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.983354092 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.983397961 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.983455896 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.990468979 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.990468979 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.990539074 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.990571022 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.992100000 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.992100000 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.992167950 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.992201090 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.992835999 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.992836952 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.992871046 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.992896080 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.995898008 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.995958090 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.996054888 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.996942043 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.996987104 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.997061014 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.997339964 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.997365952 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.997523069 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.997541904 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.998353958 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.998388052 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:15.998553991 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.998553991 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:15.998584986 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.449156046 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.462197065 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.462224007 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.462682962 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.462693930 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.594449997 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.594506025 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.594566107 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.594625950 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.594667912 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.594726086 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.594813108 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.594851971 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.594880104 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.594893932 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.597496986 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.597539902 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.597626925 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.597791910 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.597812891 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.745517969 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.746037006 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.746058941 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.746536970 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.746607065 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.746629000 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.747189045 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.747211933 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.747459888 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.747467041 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.749476910 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.749885082 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.749898911 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.750376940 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.750386000 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.878351927 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.878470898 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.878484011 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.878551006 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.878568888 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.878607035 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.878731966 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.878731966 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.878752947 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.878763914 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.878923893 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.878942013 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.878957033 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.878974915 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.882128000 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.882163048 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.882225037 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.882275105 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.882320881 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.882373095 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.882503033 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.882515907 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.882872105 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.882889032 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.883972883 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.883996010 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.884124994 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.884186029 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.884186029 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.884251118 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.884251118 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.884260893 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.884269953 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.886646032 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.886668921 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:16.886724949 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.886840105 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:16.886850119 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.329772949 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.330769062 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.330810070 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.331197023 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.331209898 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.459744930 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.459909916 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.459975004 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.460071087 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.460103035 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.460120916 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.460129976 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.463126898 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.463167906 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.463277102 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.463454008 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.463468075 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.616667986 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.617166042 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.617208958 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.617640018 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.617645025 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.634346008 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.634998083 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.635030031 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.635445118 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.635449886 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.647800922 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.648277998 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.648303032 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.649182081 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.649189949 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.748789072 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.748825073 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.748891115 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.748919964 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.749109983 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.749130964 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.749141932 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.749309063 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.749345064 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.749391079 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.752171040 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.752224922 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.752285004 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.752420902 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.752438068 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.767066956 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.767127991 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.767196894 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.767219067 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.767261982 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.767266035 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.767308950 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.767338991 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.767338991 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.767352104 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.767359972 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.769932985 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.769968987 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.770039082 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.770396948 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.770410061 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.782690048 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.782788038 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.782835007 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.783189058 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.783216000 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.783231974 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.783236980 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.787708044 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.787744999 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:17.787802935 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.788203001 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:17.788225889 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.195897102 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.198504925 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.198535919 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.199022055 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.199032068 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.445697069 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.445725918 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.445744038 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.445878983 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.445910931 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.445972919 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.446620941 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.446688890 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.446717024 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.446729898 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.447961092 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.447979927 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.447989941 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.447994947 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.452359915 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.452410936 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.452481031 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.452622890 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.452632904 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.514821053 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.515321016 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.515340090 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.515796900 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.515803099 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.525198936 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.526391029 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.526885033 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.526896000 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.527107954 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.527118921 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.527307987 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.527318001 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.527656078 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.527662992 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.648302078 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.648358107 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.648472071 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.648494005 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.648518085 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.648690939 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.648718119 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.648745060 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.648745060 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.648755074 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.648765087 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.651328087 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.651376963 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.651459932 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.651566982 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.651576042 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.660170078 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.660202026 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.660284996 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.660310984 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.660362959 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.660546064 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.660556078 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.660593987 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.660599947 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.663024902 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.663074017 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.663153887 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.663273096 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.663286924 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.782550097 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.782577038 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.782604933 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.782736063 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.782746077 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.782814980 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.782814980 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.901736975 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.901772976 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.901823044 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.901838064 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.901853085 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.901869059 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.901912928 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.901912928 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.904563904 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.904563904 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:18.904584885 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:18.904596090 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.059437990 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.059475899 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.059566975 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.066874027 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.066900969 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.200026035 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.201194048 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.201211929 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.201529980 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.201550961 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.336878061 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.336946964 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.337143898 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.337162971 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.337188005 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.337404966 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.337457895 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.337457895 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.337475061 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.337482929 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.341413021 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.341449022 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.341526985 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.341716051 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.341731071 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.389087915 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.389522076 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.389895916 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.389895916 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.389914989 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.389934063 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.390451908 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.390470982 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.390595913 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.390607119 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.518745899 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.518819094 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.518898964 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.519241095 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.519253969 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.519268990 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.519274950 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.523364067 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.523463964 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.523582935 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.523844957 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.523881912 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.524830103 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.524904966 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.524955988 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.525142908 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.525165081 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.525177002 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.525188923 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.528537035 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.528573990 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.528645039 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.528908968 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.528922081 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.813210011 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.814941883 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.814969063 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.815607071 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.815625906 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.946235895 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.946294069 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.946476936 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.946794033 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.946809053 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.946820974 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.946825981 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.950819969 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.950851917 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:19.950948000 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.951123953 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:19.951134920 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.086747885 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.087541103 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.087578058 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.088224888 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.088231087 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.219963074 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.220452070 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.220518112 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.220552921 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.220573902 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.220592976 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.220599890 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.223922968 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.224016905 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.224101067 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.224257946 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.224287987 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.271747112 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.272396088 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.272471905 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.273068905 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.273085117 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.407922983 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.408037901 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.408106089 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.408332109 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.408354044 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.408365011 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.408371925 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.411974907 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.412031889 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.412237883 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.412468910 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.412483931 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.688879967 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.689491987 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.689522028 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.690058947 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.690073013 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.823297977 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.823388100 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.823498011 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.824507952 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.824541092 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.824558973 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.824567080 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.914107084 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.914947987 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.914987087 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.915416956 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.915426016 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.998769045 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.999454021 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.999480009 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:20.999891043 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:20.999898911 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.046816111 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.046849012 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.046897888 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.047017097 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:21.047043085 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:21.047370911 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:21.047391891 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.047404051 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:21.047410011 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.131479979 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.131720066 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.131863117 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:21.132023096 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:21.132050037 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.132065058 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:21.132071018 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.145144939 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.145762920 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:21.145787001 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.146384954 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:21.146389961 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.276712894 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.277241945 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.277429104 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:21.277498960 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:21.277514935 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:21.277546883 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 23, 2024 17:02:21.277553082 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 23, 2024 17:02:23.794352055 CEST	49914	443	192.168.2.9	13.107.246.45

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 23, 2024 17:01:19.796058893 CEST	1.1.1.1	192.168.2.9	0xa182	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:01:19.796058893 CEST	1.1.1.1	192.168.2.9	0xa182	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:01:40.263909101 CEST	1.1.1.1	192.168.2.9	0x6ebf	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:01:40.263909101 CEST	1.1.1.1	192.168.2.9	0x6ebf	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:01:21
Start date:	23/10/2024
Path:	C:\Users\user\Desktop\qBtDOzhQnS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\qBtDOzhQnS.exe"
Imagebase:	0xe80000
File size:	294'016 bytes
MD5 hash:	70FCBDDE18D2955BDE7DDA2F561F66D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:01:21
Start date:	23/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xc00000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:01:22
Start date:	23/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 224
Imagebase:	0x460000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:01:23
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Honda\Honda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Imagebase:	0x110000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:01:24
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:01:33
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Honda\Honda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Imagebase:	0xd70000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:01:33
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:01:41
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Honda\Honda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Imagebase:	0xb00000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:01:41
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:01:50
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Honda\Honda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Imagebase:	0x10000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:01:50
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	1392
Total number of Limit Nodes:	7

Executed Functions

Function 00E82F7C Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00EC0260,000004E4,00000040,?), ref: 00E82FD1

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8ea986bcc30be7a42b0e32f63cd3ea6614c8e6d5cf22796df61af4a96291a158
Instruction ID: 8329439e154f62b771e310243814a7dc0e74d5072be66b4bfd6b0ba405549399
Opcode Fuzzy Hash: 8ea986bcc30be7a42b0e32f63cd3ea6614c8e6d5cf22796df61af4a96291a158
Instruction Fuzzy Hash: 9F11A0722043059FE319FB24D805F5AB3D0EB88B24F10595DFA5CAB2D2DB71E905CB95

Function 00E9C9D4 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00E9CA5B
__alloca_probe_16.LIBCMT ref: 00E9CB1C
__freea.LIBCMT ref: 00E9CB83

Part of subcall function 00E97A23: HeapAlloc.KERNEL32(00000000,00E9DBAE,?,?,00E9DBAE,00000220,?,?,?), ref: 00E97A55

__freea.LIBCMT ref: 00E9CB98
__freea.LIBCMT ref: 00E9CBA8

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 148543654c13a0846429003f1f67cd16c185e73d588ba7170497e36e98b7a4be
Instruction ID: a49f6de8d3b09c12d22b38dbaf543d4bfaf79c20944e513e432e1d2d2847c1f9
Opcode Fuzzy Hash: 148543654c13a0846429003f1f67cd16c185e73d588ba7170497e36e98b7a4be
Instruction Fuzzy Hash: D651C372A0021A6FEF21AE64DC82EBB7AE9EF44758F252528FD09F7151F670CD108760

Function 00E9DDAA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E9D8DA: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00E9D905

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00E9DBF1,?,00000000,?,?,?), ref: 00E9DE0B
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00E9DBF1,?,00000000,?,?,?), ref: 00E9DE4D

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 7c0782d2713d8496c36e6287be54c01da605a728f46cb423778ce9f10dfcea4b
Instruction ID: 6027f272276eb88784ec1c249750b4c93f3eb368dea607647aefb2ea1241548f
Opcode Fuzzy Hash: 7c0782d2713d8496c36e6287be54c01da605a728f46cb423778ce9f10dfcea4b
Instruction Fuzzy Hash: 0B514370E083259EDF21DF75CC816BABBF4EF91308F18606ED087AB242E6749946CB50

Function 00E9762C Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00E9CAC2,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00E97660
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00E9CAC2,?,?,00000000,?,00000000), ref: 00E9767E

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: c750b3bb63348addb2e0bacc67955bbd77a59968773149b4d9a15e8f46a0cdd0
Instruction ID: cef85f2b2ca0a6607955d828cc4ca5f4a0d563895d04128698ca23f4e8daa4bc
Opcode Fuzzy Hash: c750b3bb63348addb2e0bacc67955bbd77a59968773149b4d9a15e8f46a0cdd0
Instruction Fuzzy Hash: D5F0983200462ABBCF126F95DC05DDE3F66EF5A3A4F098110FA1965121CB32D976EB94

Function 00E9D9AE Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00E9DBFD,00E9DBF1,00000000), ref: 00E9D9E0

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 04cc9151cf5f0b01a3f150c78233ff490a99a0a5454cdb5e390746159625a6ea
Instruction ID: 52a17a0d9ab6277739340fa211eb42be45e3fe1d865de4da344aef58a287cca5
Opcode Fuzzy Hash: 04cc9151cf5f0b01a3f150c78233ff490a99a0a5454cdb5e390746159625a6ea
Instruction Fuzzy Hash: D5512A7150C2689EDF218F28CC84AEA7BBCEB56304F2415EDE59AE7142D2749D45DF20

Function 00E857E2 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 00E857EF

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cb293d30937fab243e60cc47b85a1b2dc4c5f856d114bb8c2a27977143a21284
Instruction ID: 4057a38ac78a5bec94f25efa6e999bbf17701cf66e41aebe12f149d54c8cb568
Opcode Fuzzy Hash: cb293d30937fab243e60cc47b85a1b2dc4c5f856d114bb8c2a27977143a21284
Instruction Fuzzy Hash: B4D05E74901208ABCB18FBB4C849C9E73E8AE04345B6460A8B81DAB4A6DB30E909C741

Non-executed Functions

Function 00EA10A3 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00EA1287

Strings

1#INF, xrefs: 00EA11D9
1#IND, xrefs: 00EA11A8
1#SNAN, xrefs: 00EA11AF
1#QNAN, xrefs: 00EA11B6

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: ed4c833fb83853c9069c3a31d56e0e51128611d9966b2c3e0ff98859d3e85090
Instruction ID: b177614f3b9581995fc2d3c55309ab0c75fa060a258622222c55ed15d6fcb6cc
Opcode Fuzzy Hash: ed4c833fb83853c9069c3a31d56e0e51128611d9966b2c3e0ff98859d3e85090
Instruction Fuzzy Hash: 5CD23A71E082298FDB65CE28CD407EAB7B5EB4A305F1451EAD50DFB240E778AE858F41

Function 00EA051E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00EA083C,00000002,00000000,?,?,?,00EA083C,?,00000000), ref: 00EA05B7
GetLocaleInfoW.KERNEL32(?,20001004,00EA083C,00000002,00000000,?,?,?,00EA083C,?,00000000), ref: 00EA05E0
GetACP.KERNEL32(?,?,00EA083C,?,00000000), ref: 00EA05F5

Strings

OCP, xrefs: 00EA0572
ACP, xrefs: 00EA053C

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 4ea1e7ed25e4d172f58160af8cd833f37ebb26b569b5b97b861cabff2c316d06
Instruction ID: a496349585a410f87e5825c6e367752a8db5e5b766188d50995df25c1538a6ec
Opcode Fuzzy Hash: 4ea1e7ed25e4d172f58160af8cd833f37ebb26b569b5b97b861cabff2c316d06
Instruction Fuzzy Hash: 4521B622E01101EBDB348F65C901A9777A6AB5EB68B5A9464E94AFF100E732FE40CB50

Function 00EA06F3 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E98DB3: GetLastError.KERNEL32(?,00000008,00E969CC), ref: 00E98DB7
Part of subcall function 00E98DB3: SetLastError.KERNEL32(00000000,00EB0710,00000024,00E8DDA3), ref: 00E98E59

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00EA07FF
IsValidCodePage.KERNEL32(00000000), ref: 00EA0848
IsValidLocale.KERNEL32(?,00000001), ref: 00EA0857
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00EA089F
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00EA08BE

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 97ded5c8dbba7caf218bb963ba2f974330094333496081486ded6e14d6e57d13
Instruction ID: c89b35bd25a35c7abe53656e15f36b052069b11e5142fc9da2c627e46bf6ef1f
Opcode Fuzzy Hash: 97ded5c8dbba7caf218bb963ba2f974330094333496081486ded6e14d6e57d13
Instruction Fuzzy Hash: 89517F71900209AFDB24EFA5CC81AAA77F8AF0E704F08546AF511FB190E774BA44CB61

Function 00E92D90 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

O#, xrefs: 00E92DAB, 00E92F2E, 00E93157, 00E930F0, 00E92F7D
O#, xrefs: 00E930D3, 00E930B1

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID:
String ID: O#$O#
API String ID: 0-2710315764
Opcode ID: 5d6c2b0c2b7731d556a830f47680bcf32448849bf7266fb62c648a6abdd5fe24
Instruction ID: ceb51e14127c4941411fb2649f518b898e1862dbdce8ef64aa8181ed43773f81
Opcode Fuzzy Hash: 5d6c2b0c2b7731d556a830f47680bcf32448849bf7266fb62c648a6abdd5fe24
Instruction Fuzzy Hash: 89F13D71E012199FDF14CFA9C880AADBBB1FF88314F15926DE919B7390D731AE458B90

Function 00E9FD8F Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E98DB3: GetLastError.KERNEL32(?,00000008,00E969CC), ref: 00E98DB7
Part of subcall function 00E98DB3: SetLastError.KERNEL32(00000000,00EB0710,00000024,00E8DDA3), ref: 00E98E59

GetACP.KERNEL32(?,?,?,?,?,?,00E94F88,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00E9FE50
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00E94F88,?,?,?,00000055,?,-00000050,?,?), ref: 00E9FE7B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00E9FFDE

Strings

utf8, xrefs: 00E9FF4D

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: faaa02cc6ffcd4841c095b7583b9e02aec1422f58655e2a060c4e8b1a298a848
Instruction ID: 02fbebea25b9d12f8744eb91a7ec16fa372d466a6d9522334eb37b0441b9fd0a
Opcode Fuzzy Hash: faaa02cc6ffcd4841c095b7583b9e02aec1422f58655e2a060c4e8b1a298a848
Instruction Fuzzy Hash: E371E771B00306AADF24AB74CC46BAA73E8EF4A754F146439F505FB192EB74E9448760

Function 00E97C32 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E97CBF

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 345b19b73ae581e04342a76ae529d1a1f04ad07f21d6b651d60a02739456ec14
Instruction ID: 25fdeb6be7c6a1d6e9074a4723907091fc31a3e04b695d4f610937edc153ea5d
Opcode Fuzzy Hash: 345b19b73ae581e04342a76ae529d1a1f04ad07f21d6b651d60a02739456ec14
Instruction Fuzzy Hash: 83B18C72A282459FDF15CF28C881BFEBBE5EF59314F1451AAE895BB341D2349C09C7A0

Function 00E8A085 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00E8A091
IsDebuggerPresent.KERNEL32 ref: 00E8A15D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00E8A176
UnhandledExceptionFilter.KERNEL32(?), ref: 00E8A180

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 70e132855998dfa271f4efc7949bed1d69ec308d3b1b588132bb47edd2eedf1b
Instruction ID: cc6dbb06eea0c3a3e57ae7dfbc413abd7dd4ffa3899bf70b8159568edea2c99b
Opcode Fuzzy Hash: 70e132855998dfa271f4efc7949bed1d69ec308d3b1b588132bb47edd2eedf1b
Instruction Fuzzy Hash: F83118B5D012189BEF21EFA5D9897CDBBF8AF08300F1441AAE40CAB250E7759B84CF45

Function 00EA01A2 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00E98DB3: GetLastError.KERNEL32(?,00000008,00E969CC), ref: 00E98DB7
Part of subcall function 00E98DB3: SetLastError.KERNEL32(00000000,00EB0710,00000024,00E8DDA3), ref: 00E98E59

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EA01F6
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EA0240
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EA0306

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 3724532907a88f874319bc5b73303c89d2db713ab7616108bddbf08a9e7571df
Instruction ID: 1d58f702cebad27cdc59240acf16d029c472b3f970ac1f38a6d6ee8add76981e
Opcode Fuzzy Hash: 3724532907a88f874319bc5b73303c89d2db713ab7616108bddbf08a9e7571df
Instruction Fuzzy Hash: 7161B1719002079FDF289F24CC86BBA77E8EF0A304F1450A9E905EA585F774ED98DB50

Function 00E90B69 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00E90C61
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00E90C6B
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00E90C78

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6d28c19c4688690aacd57894b1bf0aee0ef193417ca9d593779427173e6a6560
Instruction ID: 8b6383b30848c659fb3d9c6d9fcd5b1177375ee0ac1ea0a9db003c040b58f4ea
Opcode Fuzzy Hash: 6d28c19c4688690aacd57894b1bf0aee0ef193417ca9d593779427173e6a6560
Instruction Fuzzy Hash: 4B31D47490121C9BCB21DF68D98878DBBB8BF08310F5452EAE41DA62A0E7749B858F45

Function 00E82805 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 477COMMON

Download Yara Rule

Strings

ios base: %i, xrefs: 00E8297D

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: H_prolog3_catch
String ID: ios base: %i
API String ID: 3886170330-1055636949
Opcode ID: a2f1b03779ba8ceb2c59468cdd9bdc7dda094bacc77f1e635d2bf81bb1511c03
Instruction ID: caffe8696b72e7f528843d31cbcc85c74ddad609c1a6d81a25aeb614c907bb05
Opcode Fuzzy Hash: a2f1b03779ba8ceb2c59468cdd9bdc7dda094bacc77f1e635d2bf81bb1511c03
Instruction Fuzzy Hash: 7EE177729087168FC718EF38C9812AAFBE1EF89324F54663EEA5DB72D1D33589018741

Function 00E82A0F Relevance: 1.9, APIs: 1, Instructions: 384COMMON

Download Yara Rule

APIs

Part of subcall function 00E8301A: __EH_prolog3_catch.LIBCMT ref: 00E83021

_Deallocate.LIBCONCRT ref: 00E82E06

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: DeallocateH_prolog3_catch
String ID:
API String ID: 20358830-0
Opcode ID: b205591d52042a80474cd02ee0ade2311398e6ed513a44da6cb67509e3884182
Instruction ID: 776c1308bd8aeaf8209239613ccf9db517866c7e835b71490bd8f77faa77fe13
Opcode Fuzzy Hash: b205591d52042a80474cd02ee0ade2311398e6ed513a44da6cb67509e3884182
Instruction Fuzzy Hash: 52B18072D10A1A4BD708F97989411EEFA95EF9A320F55633FEA2DFB2D0D33589028744

Function 00E9943C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00E99437,?,?,00000008,?,?,00EA4915,00000000), ref: 00E99669

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ec98ebb1bbc9479294d8a1551d5cff228482acf08b088249659184751b734f82
Instruction ID: 4be47b1addc55bae22baee45c7a7fd2f2f71c5d677abdbf0c205a8bbb6f0d71a
Opcode Fuzzy Hash: ec98ebb1bbc9479294d8a1551d5cff228482acf08b088249659184751b734f82
Instruction Fuzzy Hash: 7CB14D31210608CFDB15CF2CC486AA57BE0FF45369F25965CE89ADF2A2C735E992CB40

Function 00E89B05 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00E89B1B

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 4da5794cf904f4b96f324ba11e54778289224ca32c35f25cc5bd4b8b2f209d8d
Instruction ID: 24a0dea2002747772bd862687455fe70a8a6ac476261b3e5de9673eb1d7804ce
Opcode Fuzzy Hash: 4da5794cf904f4b96f324ba11e54778289224ca32c35f25cc5bd4b8b2f209d8d
Instruction Fuzzy Hash: 8AA18C71D01604CFDB18DF5AE8816AABBF0FB49354F18962EDA09FB291D3349984CF50

Function 00E9D2FE Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b885537d62dc49c46d78b33281805c434082ed421d4141b5cd263f401d06d287
Instruction ID: 3c0f64a6fd630f7b4121cf5eec434312753e9a6647b524b4ddf97efa0323019a
Opcode Fuzzy Hash: b885537d62dc49c46d78b33281805c434082ed421d4141b5cd263f401d06d287
Instruction Fuzzy Hash: F841A2B580522DAFDF20DF69CC89AAEBBB9EF45304F5452D9E418E3201DA359E858F10

Function 00E8FD34 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00E8FEC2

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 041c9bb2f4460f2b9ae7ceffaf6291bd06bb65d37afce8359897729a8007b369
Instruction ID: 769971eb7ba74990dbba84ac4cc867d288d400557546436fd73e6a25f003d129
Opcode Fuzzy Hash: 041c9bb2f4460f2b9ae7ceffaf6291bd06bb65d37afce8359897729a8007b369
Instruction Fuzzy Hash: 47C1E1306006468FCB24EF68C4907BEB7E1BF45318F646A29D59EBB3A2C731AD45CB51

Function 00EA03F5 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00E98DB3: GetLastError.KERNEL32(?,00000008,00E969CC), ref: 00E98DB7
Part of subcall function 00E98DB3: SetLastError.KERNEL32(00000000,00EB0710,00000024,00E8DDA3), ref: 00E98E59

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EA0449

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 96af722f77bbe2612906a944ada8de7f98e9a6d701d7fbdda47eac283c908e0d
Instruction ID: 698def696df0783fa7cfc93802fb35c41e4edddfc40716c40f26465619d50bc8
Opcode Fuzzy Hash: 96af722f77bbe2612906a944ada8de7f98e9a6d701d7fbdda47eac283c908e0d
Instruction Fuzzy Hash: A521B371601216AFDF289B15DC41ABA33ECFF4E314F10607EFA15EA141EA34ED549750

Function 00EA007C Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E98DB3: GetLastError.KERNEL32(?,00000008,00E969CC), ref: 00E98DB7
Part of subcall function 00E98DB3: SetLastError.KERNEL32(00000000,00EB0710,00000024,00E8DDA3), ref: 00E98E59

EnumSystemLocalesW.KERNEL32(00EA01A2,00000001,00000000,?,-00000050,?,00EA07D3,00000000,?,?,?,00000055,?), ref: 00EA00EE

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 5e32038e19dd469f7f1df742859f1da31ca66a0189072551ed52be26fd69f883
Instruction ID: 53f19360d38be4ab4eba33b378233842e48bb31c1899bcdd232cbe5b702ee8e4
Opcode Fuzzy Hash: 5e32038e19dd469f7f1df742859f1da31ca66a0189072551ed52be26fd69f883
Instruction Fuzzy Hash: C3110C376007055FDB189F39C8D16BAB7D2FF85358B14482DE9869BB40D7757942CB40

Function 00EA0624 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00E98DB3: GetLastError.KERNEL32(?,00000008,00E969CC), ref: 00E98DB7
Part of subcall function 00E98DB3: SetLastError.KERNEL32(00000000,00EB0710,00000024,00E8DDA3), ref: 00E98E59

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00EA03BE,00000000,00000000,?), ref: 00EA0650

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 64b3634ac5bd9a92b66e6ae73e0bcebeaf28a10e202e0339f1c035bea333b50d
Instruction ID: 7036e5d43296b752446018d24ddb3e2daa9984527dd32d47528f0324a1da67e0
Opcode Fuzzy Hash: 64b3634ac5bd9a92b66e6ae73e0bcebeaf28a10e202e0339f1c035bea333b50d
Instruction Fuzzy Hash: DCF0F932A00111ABDF289B608C45BFA77A8DBC535CF155429EC06B7580DA70FE55C9D0

Function 00EA0117 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E98DB3: GetLastError.KERNEL32(?,00000008,00E969CC), ref: 00E98DB7
Part of subcall function 00E98DB3: SetLastError.KERNEL32(00000000,00EB0710,00000024,00E8DDA3), ref: 00E98E59

EnumSystemLocalesW.KERNEL32(00EA03F5,00000001,?,?,-00000050,?,00EA0797,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00EA0161

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 2e0f10312d7ed4baba8011332ff2d4edc54729d2b9d903e6c27c1bd51e595485
Instruction ID: 72c3eed3648211f3b1be115e4c9c61711d06a339032d103c4c03445f01c02340
Opcode Fuzzy Hash: 2e0f10312d7ed4baba8011332ff2d4edc54729d2b9d903e6c27c1bd51e595485
Instruction Fuzzy Hash: 07F046363043045FCB245F399C81ABA7BD0EF86368F04802CFA015F690D6B1BC01CA40

Function 00E97026 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E90E12: EnterCriticalSection.KERNEL32(?,?,00E98A8B,?,00EB07B0,00000008,00E98C4F,?,f,?), ref: 00E90E21

EnumSystemLocalesW.KERNEL32(00E97019,00000001,00EB0750,0000000C,00E973EB,00000000), ref: 00E9705E

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: b2090d0dfd72812db1ec18934e7209a37feee9be08021cf8e28abc0e4e73f3c9
Instruction ID: 21b437367296046a35653b530a9fb6d87fa378dc158b84007c5c86427227ee05
Opcode Fuzzy Hash: b2090d0dfd72812db1ec18934e7209a37feee9be08021cf8e28abc0e4e73f3c9
Instruction Fuzzy Hash: CBF04F32A14305DFDB00EF98E882B9D77F0EB44720F10852AF500FB2A1D7B999458F41

Function 00EA0031 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E98DB3: GetLastError.KERNEL32(?,00000008,00E969CC), ref: 00E98DB7
Part of subcall function 00E98DB3: SetLastError.KERNEL32(00000000,00EB0710,00000024,00E8DDA3), ref: 00E98E59

EnumSystemLocalesW.KERNEL32(00E9FF8A,00000001,?,?,?,00EA07F5,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00EA0068

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f1e988dcdecf8c3d2f5a08ae34cc7062a0979866a88b340a53ffac47b9fba50d
Instruction ID: f79e40b7e1112d6598b6ab9973ed3f2811ade8dfe954529fc0faf657d35594e7
Opcode Fuzzy Hash: f1e988dcdecf8c3d2f5a08ae34cc7062a0979866a88b340a53ffac47b9fba50d
Instruction Fuzzy Hash: E8F0E53A30020557CF189F35D9957AA7FD4EFC7764B0A406DEA099B291C676A842CB90

Function 00E974EF Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00E95AEE,?,20001004,00000000,00000002,?,?,00E950F0), ref: 00E97523

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: dc350b65572958b88a6beea3fb454c9b2f05ecc5f80882e86c081da99bd8a870
Instruction ID: 0759270930ea776dd8895f8c63cc8febafe93fe72a8591ec38967e6980418d0d
Opcode Fuzzy Hash: dc350b65572958b88a6beea3fb454c9b2f05ecc5f80882e86c081da99bd8a870
Instruction Fuzzy Hash: E8E02635004228BBCF122F61DC04EDE7F16EF09721F054010FC4571221CB31DD24AAD4

Function 00E8A212 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A21E,00E89799), ref: 00E8A217

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 71a8bfa21becf38f86b1abcb3ae193f73d12eebbb95b94abec23a6b9fd9fc686
Instruction ID: 0b67eebdd0cbdbf7ce5e8386d45743c46eb98eac6211650b82dfb86cda9793d9
Opcode Fuzzy Hash: 71a8bfa21becf38f86b1abcb3ae193f73d12eebbb95b94abec23a6b9fd9fc686
Instruction Fuzzy Hash:

Function 00E9E177 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00E9E177

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9409c33a1131e6162ee58f6f8c1deaacbcd595501b1306fbaf048be9ade8a00f
Instruction ID: 4c6806bea6fef07caf5d4fb8ca7d805aedbde0b3ade82c1608bb360fa7a9db09
Opcode Fuzzy Hash: 9409c33a1131e6162ee58f6f8c1deaacbcd595501b1306fbaf048be9ade8a00f
Instruction Fuzzy Hash: 73A011B03022008F83008F32AA082083AA8AB0E2803080038A00AE20A0EB20800A8A00

Function 00E9F840 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: c34c6484bde4b33f0209155ca11309706e1d2674778d96d057b5470b162ea5e3
Instruction ID: 735df16b8724610b07bcc9b03a95fc5d90eabd0a0ea2f1d2d11280d0d07b98a0
Opcode Fuzzy Hash: c34c6484bde4b33f0209155ca11309706e1d2674778d96d057b5470b162ea5e3
Instruction Fuzzy Hash: 1DB1F4756007419BCF38AF64CC92BB7B3E9EF44308F14557DEA87E6680EAB4A985C710

Function 00E8F9EC Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3845b5e48c23dca5052b27de71d37509a82d37227e56bac203461c015d24476
Instruction ID: dfbe17350d0f2b498ea53806110a84c077422b9e3dc0b338c07356ba66c8ccd0
Opcode Fuzzy Hash: c3845b5e48c23dca5052b27de71d37509a82d37227e56bac203461c015d24476
Instruction Fuzzy Hash: 57B1E27090060A8FCF28EF68C5A16BEB7F1AF44318F14266ED85EF7291D730AA41CB55

Function 00E82F17 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad1db06c3cb6ca16accc3a332614773ee15a9ca5a15ec2ad21a6cdcb22dec12
Instruction ID: f43823b3afdc873170f83db71bf74e714cd162e55ae3f6060602e6e5ebe51666
Opcode Fuzzy Hash: cad1db06c3cb6ca16accc3a332614773ee15a9ca5a15ec2ad21a6cdcb22dec12
Instruction Fuzzy Hash: 40E0657160930497E3189A54D556B9B7AD5EBC5300F10907DE24DBB3D0CFB558059B91

Function 00E9CC6F Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9be6b6f35371869e062396f73cb3a676a20dd67872fdeac340a7b63f963c531
Instruction ID: 4093b00effc0887621ada23d8c829545592ad2c4c6a8a3f1f85b7963f7bc8040
Opcode Fuzzy Hash: c9be6b6f35371869e062396f73cb3a676a20dd67872fdeac340a7b63f963c531
Instruction Fuzzy Hash: 6BE08C72921228EBCB24EB88C90498AF7ECEB44F00F210496B905E3100C270DE00CBD0

Function 00E93BBE Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5235bc6f45b747b251e4dee57095da2f280f55043986cdd14d68c6e044f9f23d
Instruction ID: ad7ceb44b377ca0300ad952008a6a368f7211760a73f51f7f7d69c1c330687c5
Opcode Fuzzy Hash: 5235bc6f45b747b251e4dee57095da2f280f55043986cdd14d68c6e044f9f23d
Instruction Fuzzy Hash: D8C08C74200B484ACE29992083B13E43394AB91B87F90248CC4661B742D92E9D82D600

Function 00E892CD Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00E892D3
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00E892E1
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00E892F2
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00E89303

Strings

kernel32.dll, xrefs: 00E892CE
GetTempPath2W, xrefs: 00E892F8
GetCurrentPackageId, xrefs: 00E892DB
GetSystemTimePreciseAsFileTime, xrefs: 00E892E7

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: bfc37e94c8c71d7b648420c147cb59ace0d099ff5ad400ed361e8970575c23f8
Instruction ID: 54f8add72698fa4c8d630cd45f91d78eab0f6c2b5e01e78b341df26675b88e9d
Opcode Fuzzy Hash: bfc37e94c8c71d7b648420c147cb59ace0d099ff5ad400ed361e8970575c23f8
Instruction Fuzzy Hash: D8E0EC7169BB10AF9710DFB6BC4DC863AF8EB2F75230412B1F455FA260D6B164898B90

Function 00E8CE02 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 00E8CF21
___TypeMatch.LIBVCRUNTIME ref: 00E8D02F
CallUnexpected.LIBVCRUNTIME ref: 00E8D19C

Strings

csm, xrefs: 00E8CF58
csm, xrefs: 00E8CEAC
csm, xrefs: 00E8CE3F
hr, xrefs: 00E8CF18

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm$hr
API String ID: 1206542248-604993306
Opcode ID: 9d1b06bddd0db1ace516fc1186883569b587709398122ef46fb9ac1d28d512e8
Instruction ID: 637ce574e5c22a05535b8f7b05f192a87d321a41803cb8bcd58dd5f6462b4c73
Opcode Fuzzy Hash: 9d1b06bddd0db1ace516fc1186883569b587709398122ef46fb9ac1d28d512e8
Instruction Fuzzy Hash: 74B18B318052099FDF29FFA4C9809AEB7B6FF05314F24615AE81D7B292D730DA51CBA1

Function 00E9B85E Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00E9BAD7

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: df3a62f45f27ba6f4c14d419b3930a82224dbd995fbd000878a755de581a5c28
Instruction ID: cc06c4a986a126a5243c4ca314b0c9a1e6a1fa082f411a3b419788c272b4cbf4
Opcode Fuzzy Hash: df3a62f45f27ba6f4c14d419b3930a82224dbd995fbd000878a755de581a5c28
Instruction Fuzzy Hash: 29B11270E00249AFDF15DF99E980BADBBF1BF89314F145058E900BB2A6DB759D42CB60

Function 00E971EF Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,8E2155F5,f,00E972FC,f,?,F8250000,00000000), ref: 00E972B0

Strings

api-ms-, xrefs: 00E97246
ext-ms-, xrefs: 00E9725A
f, xrefs: 00E971F1

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-$f
API String ID: 3664257935-704918547
Opcode ID: c6cbf490728f456bdf1dfaf72610515b6ed1870a6ae4315186afd0cc7946606c
Instruction ID: c75e3b44366b47553c584cf127eb5bcd79bbf1908a32e90a5cf6786209d0abe4
Opcode Fuzzy Hash: c6cbf490728f456bdf1dfaf72610515b6ed1870a6ae4315186afd0cc7946606c
Instruction Fuzzy Hash: 0A215EB2924210ABCF319B619C80A9A3B68AB46364F141524F951B71E1DA30FD0CC6E0

Function 00E890E3 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00E8912C
__alloca_probe_16.LIBCMT ref: 00E89158
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00E89197
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00E891B4
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00E891F3
__alloca_probe_16.LIBCMT ref: 00E89210
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00E89252
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00E89275

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 7a94f6f8c59ba21e0199b4db0fc05ae63ced3eba448650eaf1fc4c01a8f6979e
Instruction ID: d1134869fd62de1ec03f5d04e75ba1f9dad882ab71ed5201b52ef51ad48b4c47
Opcode Fuzzy Hash: 7a94f6f8c59ba21e0199b4db0fc05ae63ced3eba448650eaf1fc4c01a8f6979e
Instruction Fuzzy Hash: 2551D072E0020ABFDF20AFA1DC45FBB7BA9EB45744F194525F90CB6162D7349C109B60

Function 00E8C8D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00E8C907
___except_validate_context_record.LIBVCRUNTIME ref: 00E8C90F
_ValidateLocalCookies.LIBCMT ref: 00E8C998
__IsNonwritableInCurrentImage.LIBCMT ref: 00E8C9C3
_ValidateLocalCookies.LIBCMT ref: 00E8CA18

Strings

csm, xrefs: 00E8C9AD

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 44abbb4d17affb40bcd16aa1dc241297f1278416099ed2d40310aa9ef27fbd00
Instruction ID: 8e1fd8f3e07375dfaa18bb4e24184ad1e62f2f0219cd6bb3b7c7432128d7b5b8
Opcode Fuzzy Hash: 44abbb4d17affb40bcd16aa1dc241297f1278416099ed2d40310aa9ef27fbd00
Instruction Fuzzy Hash: CA41BA34A002099FCF14EF68CC85A9E7BF5AF46314F2491D5E81DBB392D731A905CBA1

Function 00E873C5 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00E873CC
std::_Lockit::_Lockit.LIBCPMT ref: 00E873D6
int.LIBCPMT ref: 00E873ED

Part of subcall function 00E81830: std::_Lockit::_Lockit.LIBCPMT ref: 00E81841
Part of subcall function 00E81830: std::_Lockit::~_Lockit.LIBCPMT ref: 00E8185B

codecvt.LIBCPMT ref: 00E87410
std::_Facet_Register.LIBCPMT ref: 00E87427
std::_Lockit::~_Lockit.LIBCPMT ref: 00E87447
Concurrency::cancel_current_task.LIBCPMT ref: 00E87454

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 3bcc0b9e433e17dc6de6344829c704c299da9c74507297936f0d1efb870efa4c
Instruction ID: 819f46b70daec1a3c0f48f69d9608bf7b9d11e9f0a5e8bc33d667ad2c9fb992e
Opcode Fuzzy Hash: 3bcc0b9e433e17dc6de6344829c704c299da9c74507297936f0d1efb870efa4c
Instruction Fuzzy Hash: 6C01C435D101159FCB05FBA4D9066BD7BB5AF84324F282449E81CBB292DF31DD068B81

Function 00E84A2F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E84A3B
int.LIBCPMT ref: 00E84A4E

Part of subcall function 00E81830: std::_Lockit::_Lockit.LIBCPMT ref: 00E81841
Part of subcall function 00E81830: std::_Lockit::~_Lockit.LIBCPMT ref: 00E8185B

std::_Facet_Register.LIBCPMT ref: 00E84A81
std::_Lockit::~_Lockit.LIBCPMT ref: 00E84A97
Concurrency::cancel_current_task.LIBCPMT ref: 00E84AA2

Strings

|d, xrefs: 00E84A35

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: |d
API String ID: 2081738530-980906076
Opcode ID: f42620c65688b4217cb2c20f5e33d726f5468b01c124f3e0f94e20d81fb29288
Instruction ID: 10826d230635e4e603134afa219c2403148628b9047517e4d83296e32621fadb
Opcode Fuzzy Hash: f42620c65688b4217cb2c20f5e33d726f5468b01c124f3e0f94e20d81fb29288
Instruction Fuzzy Hash: 7601F272910215ABCB18FB54D906C9E7BE8DF80760B201198F90DBB290EF31DE028790

Function 00E8CA94 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E8CA8B,00E8AD89,00E869F4,8E2155F5,?,?,?,?,00EA52D0,000000FF), ref: 00E8CAA2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E8CAB0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E8CAC9
SetLastError.KERNEL32(00000000,?,00E8CA8B,00E8AD89,00E869F4,8E2155F5,?,?,?,?,00EA52D0,000000FF), ref: 00E8CB1B

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: fe0f474e90ea3a335030642bc4839db8dbe692f5fe2532439efaca4f875583fc
Instruction ID: 4065384d98c42ab46a2ebbdbbb0bd5e092259d344d7623ca578f8ac7a745885f
Opcode Fuzzy Hash: fe0f474e90ea3a335030642bc4839db8dbe692f5fe2532439efaca4f875583fc
Instruction Fuzzy Hash: FD01B5322087126EE6293A766C8695B2794EB03779730132EF23DB50F1EF614D049360

Function 00E93BE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8E2155F5,?,?,00000000,00EA54C3,000000FF,?,00E93B70,00E93CA0,?,00E93B44,00000000), ref: 00E93C15
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E93C27
FreeLibrary.KERNEL32(00000000,?,?,00000000,00EA54C3,000000FF,?,00E93B70,00E93CA0,?,00E93B44,00000000), ref: 00E93C49

Strings

CorExitProcess, xrefs: 00E93C1F
mscoree.dll, xrefs: 00E93C0E

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f14f720933eb142961794113104c5f27a346449d71a27ab91e6baf36389ed70b
Instruction ID: 7d1a7e2e9e826fa5d39a5ce1deb655a7dc2b5da99e792fa63392e417901fabe9
Opcode Fuzzy Hash: f14f720933eb142961794113104c5f27a346449d71a27ab91e6baf36389ed70b
Instruction Fuzzy Hash: 3301A731940625AFDF158B55DC09FAEBBB8FB09B15F040525E911B62D0D774A948CA50

Function 00E88BAA Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00E88BBE
AcquireSRWLockExclusive.KERNEL32(00000003,?,00000002,?,00E834CC,?,?), ref: 00E88BDD
AcquireSRWLockExclusive.KERNEL32(00000003,00000000,00000000,?,00000002,?,00E834CC,?,?), ref: 00E88C0B
TryAcquireSRWLockExclusive.KERNEL32(00000003,00000000,00000000,?,00000002,?,00E834CC,?,?), ref: 00E88C66
TryAcquireSRWLockExclusive.KERNEL32(00000003,00000000,00000000,?,00000002,?,00E834CC,?,?), ref: 00E88C7D

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: d2ccac92a6a10e4ee20ce3f74d1e32d673504e9d00fd6d939bac2b33c3762ba8
Instruction ID: 117be1dc3d6befacbfb1b531d2a474234cfcb4d66405fd43cd3af0bf30559427
Opcode Fuzzy Hash: d2ccac92a6a10e4ee20ce3f74d1e32d673504e9d00fd6d939bac2b33c3762ba8
Instruction Fuzzy Hash: 2C411770902606DFCB20EF65C6809AAF3F5FF49314B94591AD85EB7644DB30F984CB62

Function 00E848F7 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E84903
int.LIBCPMT ref: 00E84916

Part of subcall function 00E81830: std::_Lockit::_Lockit.LIBCPMT ref: 00E81841
Part of subcall function 00E81830: std::_Lockit::~_Lockit.LIBCPMT ref: 00E8185B

std::_Facet_Register.LIBCPMT ref: 00E84949
std::_Lockit::~_Lockit.LIBCPMT ref: 00E8495F
Concurrency::cancel_current_task.LIBCPMT ref: 00E8496A

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 6ae3901a64b60c2642d547b3c278637e27ba1e872bf5192af65ebf4c9845dcbf
Instruction ID: 1f4a94be75ae7cba8058483d81b14859d6e1aa6d9b048b87e3cd1e3eed477433
Opcode Fuzzy Hash: 6ae3901a64b60c2642d547b3c278637e27ba1e872bf5192af65ebf4c9845dcbf
Instruction Fuzzy Hash: 1401F272900116ABCB29BB94D816C9E7BACDF80760B211198F90DB7291EF309E028790

Function 00E84F6E Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E84F7A
int.LIBCPMT ref: 00E84F8D

Part of subcall function 00E81830: std::_Lockit::_Lockit.LIBCPMT ref: 00E81841
Part of subcall function 00E81830: std::_Lockit::~_Lockit.LIBCPMT ref: 00E8185B

std::_Facet_Register.LIBCPMT ref: 00E84FC0
std::_Lockit::~_Lockit.LIBCPMT ref: 00E84FD6
Concurrency::cancel_current_task.LIBCPMT ref: 00E84FE1

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: e9ce6f9b92878fcfd58f1ff065bf388bc38292257e218135083e0b7081718ff1
Instruction ID: ae3dfe4a29d6ab2097e87e9a080364a3955c1d3359b53c1de19a06d27aba870c
Opcode Fuzzy Hash: e9ce6f9b92878fcfd58f1ff065bf388bc38292257e218135083e0b7081718ff1
Instruction Fuzzy Hash: B601A272A10215ABCB15BB95D806D9E77BCDF80364B24255DFA0DBB290EF31DE02C790

Function 00E887C2 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00E887C9
std::_Lockit::_Lockit.LIBCPMT ref: 00E887D4
std::_Lockit::~_Lockit.LIBCPMT ref: 00E88842

Part of subcall function 00E88925: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00E8893D

std::locale::_Setgloballocale.LIBCPMT ref: 00E887EF
_Yarn.LIBCPMT ref: 00E88805

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 0c921842d6f5b3017134d11a4566aa9381a5883b2cdd9a6f39a679cb17146144
Instruction ID: 0c8fc40f33b34145f56b733764b3f038df7a55e495ca82c44988153ba617ebea
Opcode Fuzzy Hash: 0c921842d6f5b3017134d11a4566aa9381a5883b2cdd9a6f39a679cb17146144
Instruction Fuzzy Hash: 49019E75A015609FC709FB20994597C7BA1FFC6350B982059E80D77382CF34AA0ACB81

Function 00E8DB97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00E8DB48,?,?,00000000,?,?,?,00E8DC72,00000002,FlsGetValue,00EA7CF0,FlsGetValue), ref: 00E8DBA4
GetLastError.KERNEL32(?,00E8DB48,?,?,00000000,?,?,?,00E8DC72,00000002,FlsGetValue,00EA7CF0,FlsGetValue,?,?,00E8CAB5), ref: 00E8DBAE
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00E8DBD6

Strings

api-ms-, xrefs: 00E8DBBB

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6d4f91bb59876bc39c61fd337fa0253328a786623cfe0d034947b334b315158c
Instruction ID: cfb4495d312d75d6016f85189e51a1583b1e112316c7d281e47c7dcd871362ef
Opcode Fuzzy Hash: 6d4f91bb59876bc39c61fd337fa0253328a786623cfe0d034947b334b315158c
Instruction Fuzzy Hash: DDE04F31288208BBEF312B62EC46F593F69AB06B54F141420F94DF94E1EB61E8989684

Function 00E99DB0 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8E2155F5,00000000,00000000,76F8F550), ref: 00E99E13

Part of subcall function 00E9CDFB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00E9CB79,?,00000000,-00000008), ref: 00E9CEA7

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00E9A06E
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00E9A0B6
GetLastError.KERNEL32 ref: 00E9A159

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 57f6911855074404816524aad0ffc705ab2206aba5fd3d9b19083a6cf0618e0a
Instruction ID: 8d6bc22ab1d5a14bd14fc85b2b637cd91450470ab940a52e87ac5b6819609e1e
Opcode Fuzzy Hash: 57f6911855074404816524aad0ffc705ab2206aba5fd3d9b19083a6cf0618e0a
Instruction Fuzzy Hash: 4BD156B5E002589FCF15CFA9D8809EEBBB5FF09304F28516AE856FB352D630A845CB51

Function 00E8CBAB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00E8CC72
___AdjustPointer.LIBCMT ref: 00E8CC95
___AdjustPointer.LIBCMT ref: 00E8CD31

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3e93537a695c3579994a99105ad6d0af56b5c79a71a25356da91eb559273d125
Instruction ID: c115b266557d562e2f89a206702ae29627ececc4a49aeed7142fbcfe766ba7db
Opcode Fuzzy Hash: 3e93537a695c3579994a99105ad6d0af56b5c79a71a25356da91eb559273d125
Instruction Fuzzy Hash: 2151C571604A069FDB29BF54D441BAAB7A4FF02318F38552EE90DB7591E731EC80C7A0

Function 00E9D0BB Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00E9CDFB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00E9CB79,?,00000000,-00000008), ref: 00E9CEA7

GetLastError.KERNEL32 ref: 00E9D11F
__dosmaperr.LIBCMT ref: 00E9D126
GetLastError.KERNEL32(?,?,?,?), ref: 00E9D160
__dosmaperr.LIBCMT ref: 00E9D167

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 82542b2dcfd21e760fc7e98b8a81ff36a77afab8936b36af628298905faf77ac
Instruction ID: d0e471956e555c37771dbddb23fa61fe10595d3db696fc8f47c34c9b2e831d9c
Opcode Fuzzy Hash: 82542b2dcfd21e760fc7e98b8a81ff36a77afab8936b36af628298905faf77ac
Instruction Fuzzy Hash: 0F21B372609225AFDF20AF66CC8096BB7A9FF053787109419F925F7151DB30EC40CB50

Function 00E932F6 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14cf503e65045fae6944e9398dd50ab03213a4f4831a564b91ec612649e34337
Instruction ID: 00efc6e7940af0071f07dbd761c3695ccd2b4bbab86fe3e9fb37c83fab993e9d
Opcode Fuzzy Hash: 14cf503e65045fae6944e9398dd50ab03213a4f4831a564b91ec612649e34337
Instruction Fuzzy Hash: BB219A31640205BFDF20EF75DC809AAB7A9AF00368724A529F976F7141DF30EE408BA0

Function 00E9E06A Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00E9E072

Part of subcall function 00E9CDFB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00E9CB79,?,00000000,-00000008), ref: 00E9CEA7

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E9E0AA
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00E9E0CA

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 07ba939a07fb056b00e92a5dd00c1b647b83e2dc8eb2b36c07dad9110864e346
Instruction ID: 1be98bb5f3b693b9ba9d6d0e3dffbe1d76ee433854f8bb9e231fa2a2fcde04e8
Opcode Fuzzy Hash: 07ba939a07fb056b00e92a5dd00c1b647b83e2dc8eb2b36c07dad9110864e346
Instruction Fuzzy Hash: E411C4F15062157FAF21AB726C8DCBF6DACEE4A3997142425FA05B2201FEB4DD0042B1

Function 00EA3966 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,00000000,00000000,00000000,?,00EA2877,00000000,00000001,00000000,76F8F550,?,00E9A1AD,76F8F550,00000000,00000000), ref: 00EA397D
GetLastError.KERNEL32(?,00EA2877,00000000,00000001,00000000,76F8F550,?,00E9A1AD,76F8F550,00000000,00000000,76F8F550,76F8F550,?,00E9A734,00000000), ref: 00EA3989

Part of subcall function 00EA394F: CloseHandle.KERNEL32(FFFFFFFE,00EA3999,?,00EA2877,00000000,00000001,00000000,76F8F550,?,00E9A1AD,76F8F550,00000000,00000000,76F8F550,76F8F550), ref: 00EA395F

___initconout.LIBCMT ref: 00EA3999

Part of subcall function 00EA3911: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00EA3940,00EA2864,76F8F550,?,00E9A1AD,76F8F550,00000000,00000000,76F8F550), ref: 00EA3924

WriteConsoleW.KERNEL32(00000000,0000000C,00000000,00000000,?,00EA2877,00000000,00000001,00000000,76F8F550,?,00E9A1AD,76F8F550,00000000,00000000,76F8F550), ref: 00EA39AE

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: a1ebb487c5554f986bb940b3c2ee002cac80a10cb8b771c3dbe2dd457f0df980
Instruction ID: e141abb6749c286a8338ce57c2867ddaee2287df23b1a5141cc5c733c5c24dae
Opcode Fuzzy Hash: a1ebb487c5554f986bb940b3c2ee002cac80a10cb8b771c3dbe2dd457f0df980
Instruction Fuzzy Hash: CEF01236000114BFCF622FE6DC08A8A7F65FF5E361B044410FA19A5135CA71A924DB90

Function 00E8D1A7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00E8D1CC

Strings

RCC, xrefs: 00E8D1E6
MOC, xrefs: 00E8D1DE

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 9a4fe7d9dc8561d615df56bcc19bc1cfd358f37fdaf2f12513c64767d80155d0
Instruction ID: 078ccaf75d9266cfc4712827469109e6fadfd57665f16bf7fb984f01f8b5520d
Opcode Fuzzy Hash: 9a4fe7d9dc8561d615df56bcc19bc1cfd358f37fdaf2f12513c64767d80155d0
Instruction Fuzzy Hash: 4C414731900209AFDF16EF94CC81AEEBBB5BF48308F189199F91DB62A1D335E950DB51

Function 00E86AB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00E86B3D
RaiseException.KERNEL32(?,?,?,?,?), ref: 00E86B62

Part of subcall function 00E8AD9B: RaiseException.KERNEL32(E06D7363,00000001,00000003,00E81365,?,?,?,?,00E81365,?,00EB0B30), ref: 00E8ADFB

Part of subcall function 00E8DD93: IsProcessorFeaturePresent.KERNEL32(00000017,00E8F12B,?,?,?,?,00000000,00E908D9,?,?,?), ref: 00E8DDAF

Strings

csm, xrefs: 00E86AF1

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: ab0b424e36d98ffb684039c79c65157681ddd1cc0f3fcaea3499cadf1e6cac74
Instruction ID: 48ae84e4f5226e0c803ba4bac0ff5a9d3360ebfff63c13138738aeb973875116
Opcode Fuzzy Hash: ab0b424e36d98ffb684039c79c65157681ddd1cc0f3fcaea3499cadf1e6cac74
Instruction Fuzzy Hash: B4216A31E00218ABCF25FFA5D945AAEB7B9AF04718F18141EE50EBB251C730AD45CB81

Function 00E8301A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00E83021

Part of subcall function 00E84A2F: std::_Lockit::_Lockit.LIBCPMT ref: 00E84A3B
Part of subcall function 00E84A2F: int.LIBCPMT ref: 00E84A4E
Part of subcall function 00E84A2F: std::_Lockit::~_Lockit.LIBCPMT ref: 00E84A97

Strings

|d, xrefs: 00E8302B, 00E83030, 00E83043, 00E83073, 00E830FE
xd, xrefs: 00E830A0

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3_catchLockit::_Lockit::~_
String ID: xd$|d
API String ID: 1693569656-1023001184
Opcode ID: 5cab148d27357836ecc210b708d98cf6f6aa03fc9b1707aa6ade7b98d6706e5d
Instruction ID: e6d9a56f31e8523e21d7dbf9c0ee5c85e273614888359e0c3e7218521f79d71a
Opcode Fuzzy Hash: 5cab148d27357836ecc210b708d98cf6f6aa03fc9b1707aa6ade7b98d6706e5d
Instruction Fuzzy Hash: F7219475E00245DFDB04EBB4C995EADBBF0AF89310F289199E10DBB292D7319D46CB90

Function 00E81C1C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(00EC2678,00000000,?,00000000), ref: 00E81C30
InitOnceComplete.KERNEL32(00EC2678,00000000,00000000), ref: 00E81C47

Strings

p&, xrefs: 00E81C51

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: InitOnce$BeginCompleteInitialize
String ID: p&
API String ID: 51270584-3466202603
Opcode ID: d98691b2e28c029e0eee36ae804e9f0b7282c7505c8a83847065bca713df0de9
Instruction ID: 6f3a3561e4d7253b0ae59703ef17db17e1d7b42c37894fde83732e13fd6ab207
Opcode Fuzzy Hash: d98691b2e28c029e0eee36ae804e9f0b7282c7505c8a83847065bca713df0de9
Instruction Fuzzy Hash: 1BF0E231202111BF8F247BA29D49EEF7BACEF86B9570410A8F50DF2041CA60D902D3B1

Function 00E8175B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E81762
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00E8179A

Part of subcall function 00E888C0: _Yarn.LIBCPMT ref: 00E888DF
Part of subcall function 00E888C0: _Yarn.LIBCPMT ref: 00E88903

Strings

bad locale name, xrefs: 00E817A8

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 4409df2db12d7f7bd45a008ca6fee3eebf3f0849b6fd6b0d23a98b16c881fa1c
Instruction ID: 5dfd6ca5dc51a04f5150a7222d4f7928d61ee30a6c516e90b1c4ebeb91feb3ca
Opcode Fuzzy Hash: 4409df2db12d7f7bd45a008ca6fee3eebf3f0849b6fd6b0d23a98b16c881fa1c
Instruction Fuzzy Hash: 3FF03A71549B409E8330EF7A9481443FBE4BE293213909E6FE1DED3A11D730E404CB6A

Function 00E81000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00E81007

Strings

\b, xrefs: 00E81011
,b, xrefs: 00E8100C, 00E8101F

Memory Dump Source

Source File: 00000000.00000002.1430759845.0000000000E81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000000.00000002.1430745568.0000000000E80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430784116.0000000000EA6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430800663.0000000000EB2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430817252.0000000000EC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430830413.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430844468.0000000000EC3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1430859656.0000000000EC7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e80000_qBtDOzhQnS.jbxd

Similarity

API ID: H_prolog3
String ID: ,b$\b
API String ID: 431132790-489319513
Opcode ID: 5684cc475fca838bc24f42788d45924623cd5f319a484976094658f995ba968e
Instruction ID: 869b5a16fda070ec0b5b257a9df220c3e8c8d0a717c34b4aef463a6eb9927e10
Opcode Fuzzy Hash: 5684cc475fca838bc24f42788d45924623cd5f319a484976094658f995ba968e
Instruction Fuzzy Hash: D0E0EDB1941305DADB00BBA449077AE75A0BB81714F54754CE2187A2D2D7B50608D721

Analysis Process: MSBuild.exePID: 7672, Parent PID: 7616COMMON

Executed Functions

Function 01450848 Relevance: 10.0, Strings: 6, Instructions: 2511COMMON

Download Yara Rule

Strings

tmB, xrefs: 01452F70
>%kl, xrefs: 0145192D
b6K, xrefs: 014508C4
K(:, xrefs: 0145099F
;(:, xrefs: 01450959
K$S , xrefs: 01450A78

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID: ;(:$>%kl$K$S $K(:$b6K$tmB
API String ID: 0-3814818819
Opcode ID: 26591664386b8d757ea64bcdb951319f9aa5e37984b84d76fe067a6518fef5ef
Instruction ID: 0fb59094f3147519fa86c2ca94061b0348c77b2d4e585f5a7c5914bac2270383
Opcode Fuzzy Hash: 26591664386b8d757ea64bcdb951319f9aa5e37984b84d76fe067a6518fef5ef
Instruction Fuzzy Hash: D9538178E002199FDBA5CF68C994A9DBBF5BB48304F1481EAD819E7365D730AE85CF40

Function 014542E8 Relevance: 9.4, Strings: 5, Instructions: 3152COMMON

Download Yara Rule

Strings

6I(k, xrefs: 01454484
H, xrefs: 01455716
qul}, xrefs: 014544D1
7qs, xrefs: 01454D3C
uZD, xrefs: 014553E5

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID: 6I(k$7qs$qul}$uZD$H
API String ID: 0-2913260691
Opcode ID: 39a52edf0c40e648ffc9f5006297424ddfbe9c9fdfc7785a8258c9e880c0a56a
Instruction ID: ae12c0f176891275e10195fc149a5a98c997060a29f4f5f2c7dc4e36153d0863
Opcode Fuzzy Hash: 39a52edf0c40e648ffc9f5006297424ddfbe9c9fdfc7785a8258c9e880c0a56a
Instruction Fuzzy Hash: BD739378E002198FCBA4CF68C994A9DBBF5BB49305F5481EAD819E7355E730AE85CF40

Function 014542C8 Relevance: 5.7, Strings: 3, Instructions: 1916COMMON

Download Yara Rule

Strings

6I(k, xrefs: 014545A4
qul}, xrefs: 014544D1
uZD, xrefs: 014553E5

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID: 6I(k$qul}$uZD
API String ID: 0-2795441010
Opcode ID: fb65683c6dfbfc6bc9b320086b363508bf8aa5c3f0a6a65bed328e8303d52583
Instruction ID: adaf6801aa1713a4202e6159c6a094abd45e26cc7de380144ad57e9d4fe6fdcc
Opcode Fuzzy Hash: fb65683c6dfbfc6bc9b320086b363508bf8aa5c3f0a6a65bed328e8303d52583
Instruction Fuzzy Hash: 4723A278E002199FCB94CF69C994A9DBBF5BB48305F14C1AAD819E7365E730AE85CF40

Function 01450702 Relevance: 5.4, Strings: 4, Instructions: 399COMMON

Download Yara Rule

Strings

b6K, xrefs: 014508C4
K(:, xrefs: 0145099F
;(:, xrefs: 01450959
K$S , xrefs: 01450A78

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID: ;(:$K$S $K(:$b6K
API String ID: 0-896138553
Opcode ID: 6356579895caf6e3cd65de56b36b5f0e97beb559e09c89031d54f1ace811016b
Instruction ID: 81d1078f089ca1cebbc015169b127b44d6100b25c41142d27ea6cebf6115e0de
Opcode Fuzzy Hash: 6356579895caf6e3cd65de56b36b5f0e97beb559e09c89031d54f1ace811016b
Instruction Fuzzy Hash: E8020538E002498FDB45DFA8C49499DBBF1EF89304B1581AAD815EB366EB35ED46CF40

Function 014507E5 Relevance: 5.4, Strings: 4, Instructions: 369COMMON

Download Yara Rule

Strings

b6K, xrefs: 014508C4
K(:, xrefs: 0145099F
;(:, xrefs: 01450959
K$S , xrefs: 01450A78

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID: ;(:$K$S $K(:$b6K
API String ID: 0-896138553
Opcode ID: 431336319c3ccf884e8ba8855278c6ad14bd7f972127d46dfd0a767651fe739c
Instruction ID: 1035de3c1ac8cfcd3e020cebc46a8aa68bb13d346a82de555034f5d9aeee39e3
Opcode Fuzzy Hash: 431336319c3ccf884e8ba8855278c6ad14bd7f972127d46dfd0a767651fe739c
Instruction Fuzzy Hash: 99F1F738E002498FDB45DFA8C49499EBBF1EF49304B1581AAD815AB366EB35ED46CF40

Function 014507D7 Relevance: 5.3, Strings: 4, Instructions: 348COMMON

Download Yara Rule

Strings

b6K, xrefs: 014508C4
K(:, xrefs: 0145099F
;(:, xrefs: 01450959
K$S , xrefs: 01450A78

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID: ;(:$K$S $K(:$b6K
API String ID: 0-896138553
Opcode ID: e5438e8cf221b358d355588a50da4c9006bf8f5461181614b67b5607e9d9da22
Instruction ID: 962c3655efb8301b02154e77cafc917a8c0ec619cc6caac24c34d0ac698bb03d
Opcode Fuzzy Hash: e5438e8cf221b358d355588a50da4c9006bf8f5461181614b67b5607e9d9da22
Instruction Fuzzy Hash: 82F1D778E002099FDB44DFA9C49499EBBF1FF89304B1581AAD815AB366E731ED46CF40

Function 01459A30 Relevance: 4.6, Strings: 3, Instructions: 885COMMON

Download Yara Rule

Strings

E"W, xrefs: 0145A327
(jgA, xrefs: 01459C51
g2%, xrefs: 01459FA7

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID: (jgA$E"W$g2%
API String ID: 0-2601187164
Opcode ID: ccb23e98a5b8dcb14eb0dd632abf5926b5503e395d629252b3164be7308795cf
Instruction ID: 27f33f7d622cef4882650cc896ab6b83beee5f9083c365e53329598b5ae34025
Opcode Fuzzy Hash: ccb23e98a5b8dcb14eb0dd632abf5926b5503e395d629252b3164be7308795cf
Instruction Fuzzy Hash: 3592D674E00219CFDB54CFA9C984B9EBBF1BB49304F1486AAD819E7365E7309A85CF50

Function 01457850 Relevance: 2.4, Strings: 1, Instructions: 1104COMMON

Download Yara Rule

Strings

Fx^., xrefs: 01457B3F

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID: Fx^.
API String ID: 0-1027054592
Opcode ID: 3ada6f90e4426af4a989d11fbb059b8fd97d14cd3b48ad178662065e534cbbee
Instruction ID: 3b216d5ae4321b3afc8c4361c6227e28a0f2d59471c13e48a3ecf0a7b65d09fc
Opcode Fuzzy Hash: 3ada6f90e4426af4a989d11fbb059b8fd97d14cd3b48ad178662065e534cbbee
Instruction Fuzzy Hash: 4BB23974E04259CFDB50CFA9C880A9DBBF1BF49310F1485AAD819EB362E7349A85CF51

Function 01453108 Relevance: 1.6, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

-x, xrefs: 014531A5

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID: -x
API String ID: 0-1059959070
Opcode ID: f0cd122046a5dcb99d077ce6dbcda042311212d86bbf79815303e144baef8b5a
Instruction ID: a65cdc5d5d4ef2accedf36677fb33570ca34ec01d5db0546a2ce643079c269d0
Opcode Fuzzy Hash: f0cd122046a5dcb99d077ce6dbcda042311212d86bbf79815303e144baef8b5a
Instruction Fuzzy Hash: D6D1E178A002098FCB55DFA8D994A9DBBF2FB88340F14C566E819EB356DB34E951CF40

Function 01453A49 Relevance: .6, Instructions: 565COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7105ac09e543db9aa9df5f53547b29120c1637eeedf4c0c518c143b79ae0ec7
Instruction ID: 2519b81bd52ab017a7385b281bae92db450899692ea7c750f228a8fedf38def2
Opcode Fuzzy Hash: a7105ac09e543db9aa9df5f53547b29120c1637eeedf4c0c518c143b79ae0ec7
Instruction Fuzzy Hash: 1D420634A0020A8FCB45DFACD9909ADB7B1BF88354B19C645E415EB3A6DB30EC96CF44

Function 01458488 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039f5432c811781f688aca43dad16f7ec5e2858126dea65680ffb43d01b7b1f2
Instruction ID: a2a71f088fd5593bea467e28d265bf88abb15bb524417311d1a7336e37d87612
Opcode Fuzzy Hash: 039f5432c811781f688aca43dad16f7ec5e2858126dea65680ffb43d01b7b1f2
Instruction Fuzzy Hash: 3D718B30A006068FCB11DF6DD88099AFBB1FF84324B19865AE515DB3A6DB31ED91CB94

Function 01458A3C Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37fa3349655950fa14328c9727d0da7cc80fb97565bfde02138a16682918b174
Instruction ID: e4b94db0763be15bb0e3c2c8f43dc8818107512266849a6f73c576cdbb41e8f1
Opcode Fuzzy Hash: 37fa3349655950fa14328c9727d0da7cc80fb97565bfde02138a16682918b174
Instruction Fuzzy Hash: 4421AF72D05648AFDF16DBA9D8806DEBFF2EF9A300F148167E401A7252DB305D06CB61

Function 01459078 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b758484c6f327d5f8329ffffff473c6b32897abb8e3b6bdfcf74f4a0ccd1359
Instruction ID: 9016881717664b992367bc30887db25bc227a1084230b4e11c13ccb8144d865c
Opcode Fuzzy Hash: 2b758484c6f327d5f8329ffffff473c6b32897abb8e3b6bdfcf74f4a0ccd1359
Instruction Fuzzy Hash: 27E19075A00209CFDB14CF98D894A9ABBF5BB89304F15C56AD819EB3A6CB34DD42CF44

Function 014595B9 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4a492fc7c91c21ab953480a1ae1618320b66e427f48be4b099376e8db2eb82
Instruction ID: ee5644f12921cc74d296c0a76a0e86091540017d09ff5a0cc665fde5fe04400a
Opcode Fuzzy Hash: dc4a492fc7c91c21ab953480a1ae1618320b66e427f48be4b099376e8db2eb82
Instruction Fuzzy Hash: AEA1AF70A00606CFCB55DFACD99095DB7B2BF84314B18C62AE519DB3A6DB31EC91CB44

Function 01453680 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2b58767edefb6919ecc33da7c855f2fca596607b26d76b7d7efebd7e51a319
Instruction ID: 4d6af8485d3e33a32a6c608be2f49d3ddcb9e54dd05b69f616c2a3deec902707
Opcode Fuzzy Hash: 4d2b58767edefb6919ecc33da7c855f2fca596607b26d76b7d7efebd7e51a319
Instruction Fuzzy Hash: 0281D174A00606CFDB26DF68D95099DBBF2FF88300714865AD452EB3A6D730ED96CB90

Function 01458348 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7affdd5a8cf6d4fbdd8c2fe6bdce885d1ba6b537d7099be11437968249023c3a
Instruction ID: c8647724234585eeff606c7b9fb8ce829a31755657e5a27c3a0c0f1246371671
Opcode Fuzzy Hash: 7affdd5a8cf6d4fbdd8c2fe6bdce885d1ba6b537d7099be11437968249023c3a
Instruction Fuzzy Hash: 6E515C70D00318DFDB54CFAAC98479EBBF5BF88304F24812AE849AB261DB749846CF51

Function 014583E0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e475979b9f9ddc0510acf659a2e0143651032bc5df921a594b5cc32b6c8a792
Instruction ID: aeb07121580d5256bbe5bb62dae0d5fce06a8ef8f3f33fbb676e4f59437a1c8b
Opcode Fuzzy Hash: 9e475979b9f9ddc0510acf659a2e0143651032bc5df921a594b5cc32b6c8a792
Instruction Fuzzy Hash: 12415A70D00319DFDB54CFA9D98479EBBF5BF48700F24852AE805E7251DB749846CB81

Function 0145A764 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad89380248025a0402e42c47e904111aa1918789f13883c3f2ae18a1d49e776a
Instruction ID: e55b2bf15acec16f110f2e6873cc6ce20048f2364564816c24c5e5148d34d04f
Opcode Fuzzy Hash: ad89380248025a0402e42c47e904111aa1918789f13883c3f2ae18a1d49e776a
Instruction Fuzzy Hash: B34159B0D003499FDB54CFA9D9947AEBBF1BF48700F24822AE805EB251DB749846CB81

Function 0145A424 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9298392654180956cf92c7d23e7936bb332a3f4a629888a9cf42304f4471b8d2
Instruction ID: 83267a8a99f5a439e770a922f33133d10345a0ab96e725baaf11a0a5a9a6f052
Opcode Fuzzy Hash: 9298392654180956cf92c7d23e7936bb332a3f4a629888a9cf42304f4471b8d2
Instruction Fuzzy Hash: C631D635A006068FC715DF68D894AAAB7B6FFC4344F25C766D409873A6EB34E942CB81

Function 014530F8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2e5ae033ad98a478739cec1624a6f65fa1da73d84d21cabd5ac483c74658e4
Instruction ID: fd5986279f88d03f66d0f051dfe76776b6f7133f3211648f19304b87c730cec9
Opcode Fuzzy Hash: 1e2e5ae033ad98a478739cec1624a6f65fa1da73d84d21cabd5ac483c74658e4
Instruction Fuzzy Hash: 72316F78A042098FDB45CFA8D994AAABBF6FB88340F04C067E815E7356DB34DA11CF50

Function 01453938 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5f39daf0f4f34b2c4e5096175a69713bf56f3b907751b8d05419db5283313f
Instruction ID: bc9f2546c7a7db25154f15568c8798a59de5d3ae2ef27f02fe98b97470788db1
Opcode Fuzzy Hash: 2b5f39daf0f4f34b2c4e5096175a69713bf56f3b907751b8d05419db5283313f
Instruction Fuzzy Hash: 6C212631E00209CFDB05DFA9D8949EEBBB5FF44310F15C56AE411A7291DF70A90ACB91

Function 01452FD3 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541ce933cb2f70638bc6587ad5b4ac627517042bf4b07b38d740b0b122c04d62
Instruction ID: 179efbc38de7294be3eda2d6be1774ca4473cbc53de112ea78881b32b37d8095
Opcode Fuzzy Hash: 541ce933cb2f70638bc6587ad5b4ac627517042bf4b07b38d740b0b122c04d62
Instruction Fuzzy Hash: DA11593550021ACFCB06CF68C8444ECBBB1FF81324F1542AAC515AB1E3DB35595BCB80

Function 014583F0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea4b9f02df958a9c6f61cc87f5cff5de2cb5a3294781404f422dcab9b1b8699
Instruction ID: 7355d48d63ab197887ff6f67756689312ba13737fc97de2834bf0864ff379508
Opcode Fuzzy Hash: dea4b9f02df958a9c6f61cc87f5cff5de2cb5a3294781404f422dcab9b1b8699
Instruction Fuzzy Hash: C82124B4D00258DFDB54CFAAC894B9EBFF8BF48300F24852AE845B7251CB749885CB50

Function 01458D38 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1ab66051899c3a85dadcf3879efd5a00ea929addc4bce98ef1abda86cfa04d
Instruction ID: a264e33ee871add5d70663eabbd8cfe0087e76e471ea4afd26bc8a13bce119d6
Opcode Fuzzy Hash: 6f1ab66051899c3a85dadcf3879efd5a00ea929addc4bce98ef1abda86cfa04d
Instruction Fuzzy Hash: 5C216D71E02208AFDF05EBA9D9406DEBBF6EF89700F108066E402A7251DB305D058B61

Function 0145A915 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b90122cae7749edefd2533f3af5d86d81d1ec5821b7cb6aab5eb030e3fc9c7b
Instruction ID: 4e5067c961678db8df48acad8a76067ff61f9a9a681265adc9598a53a81f486a
Opcode Fuzzy Hash: 1b90122cae7749edefd2533f3af5d86d81d1ec5821b7cb6aab5eb030e3fc9c7b
Instruction Fuzzy Hash: 3F2122B4D002599FDB54CFAAC894BEEBFF4AF48300F20852AE845B7251CB749885CB50

Function 0145949A Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19121445bbff8b18a2eb13fc67ddb9a19bedda96f1a0d3e5965ff753a9da9625
Instruction ID: 30b5ad1b52421689924d7d622e5fb3273629565192a30b11e697f0ecc1076b52
Opcode Fuzzy Hash: 19121445bbff8b18a2eb13fc67ddb9a19bedda96f1a0d3e5965ff753a9da9625
Instruction Fuzzy Hash: 9011C631E04249CFCB05DF68D8949DDBBB0EF85324F1986A6D110E71E2CB74A81ACB54

Function 0145392A Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f91755ec2566969eebf60524a4ffb21e86416f97410d5613c57d428c6cd21b
Instruction ID: 1a2ebf69e2f41188094af9d6ce39af0e753e691b42d182ac1829225717f1c2ea
Opcode Fuzzy Hash: c7f91755ec2566969eebf60524a4ffb21e86416f97410d5613c57d428c6cd21b
Instruction Fuzzy Hash: B0117031D002098FCB05CF99D8949EDB7B0FB48320F15C26AD521A7291DB74A959CF94

Function 013FD035 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375594127.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13fd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50182d2424ad0610b6fc5b440f1f7a1142b0b465707e90529316e908cf9ef19
Instruction ID: 1b160f5a3cf63754590085370edd9b7a7e97fc46dcbe0a045e5009ac92d91313
Opcode Fuzzy Hash: d50182d2424ad0610b6fc5b440f1f7a1142b0b465707e90529316e908cf9ef19
Instruction Fuzzy Hash: 1201A7710083459BE7255AA5C988767BB9CDF41368F14C42EEF090A282C6799845CA72

Function 014594B8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049600c5deec22a7e1c0cd345a2df4ffe7a1c12a612ba13d1656dc47da186c11
Instruction ID: f40a82c70496655116442e4906dff74b4dd22d4ede3e2db40307a587cd57ff59
Opcode Fuzzy Hash: 049600c5deec22a7e1c0cd345a2df4ffe7a1c12a612ba13d1656dc47da186c11
Instruction Fuzzy Hash: F301BC31D00209CFCF04CF98E8808DDB7B4EB84328B158666E524AB2A1DB35A91ACB94

Function 013FD034 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375594127.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13fd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 551b3bc3c2a2a85d22221ce99686b06f9ea33fda859a28af9e4dd72ecf719de0
Instruction ID: 31b210e39a0058060f4674e0c3639b7bc71d63c95c9d7027f11d6f6def2ab4f1
Opcode Fuzzy Hash: 551b3bc3c2a2a85d22221ce99686b06f9ea33fda859a28af9e4dd72ecf719de0
Instruction Fuzzy Hash: 61F0C2714043409EE7108E5AC888B62FF98EB41368F18C45AEE080F283C2799844CA71

Function 01458E18 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390cb8683dc5179679ce1406c38a99d8f38440a238c9260f509793241a1b80e5
Instruction ID: 332d45c690aca7aff48042ce7fa8cb24d3db57e3befa49b0e902f400676b0f5f
Opcode Fuzzy Hash: 390cb8683dc5179679ce1406c38a99d8f38440a238c9260f509793241a1b80e5
Instruction Fuzzy Hash: A3F0ECB28043656FD7126764DC4059AFB64AB52221F17445FE8D583192C7219C818B85

Function 01459468 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1375875426.0000000001450000.00000040.00000800.00020000.00000000.sdmp, Offset: 01450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1450000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d408cf6c738998ecfa870277eb32cabcf652b20a13f7b548b4d845df186c04ae
Instruction ID: d7940a4d814e06a1fd540d9009839e29adfc769313b48e456556e5030c600785
Opcode Fuzzy Hash: d408cf6c738998ecfa870277eb32cabcf652b20a13f7b548b4d845df186c04ae
Instruction Fuzzy Hash: FEC04C70484154CFF7385B64F928B997A31BB44206F148499D195E2270CF304DC0DF35

Analysis Process: Honda.exePID: 7848, Parent PID: 7672COMMON

Executed Functions

Function 02242788 Relevance: 2.0, Instructions: 2013COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0471e316e7a3dba53ccdf8b1c5f091526085a588d6b98be8500f46e90af9434e
Instruction ID: 576d63ecb995748625054df396b528cee4a93cfacfdb141d49a8faebbce13560
Opcode Fuzzy Hash: 0471e316e7a3dba53ccdf8b1c5f091526085a588d6b98be8500f46e90af9434e
Instruction Fuzzy Hash: 4203AB30A01719DBEB15DFA0DC44BEAB3B6FF89700F1186A5E5096B294DFB16E91CB40

Function 02245A41 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa59b717671a4bc1415f68a4a9af88e1b1b005a8bde82849139c4ec233e90c2
Instruction ID: be3ab44cbcdbc6507d48cfc2143c6241ec642565494421072f4c4aa3e17fe85f
Opcode Fuzzy Hash: afa59b717671a4bc1415f68a4a9af88e1b1b005a8bde82849139c4ec233e90c2
Instruction Fuzzy Hash: C0F1BD30A11306DFEB18DFA4D984BAEB7B2BF84701F548429E4469B298DF75E851CB50

Function 022417C8 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

D@u, xrefs: 0224182E

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID: D@u
API String ID: 0-1489254072
Opcode ID: f4661b6bd4d0dde6b59eccf1f966d6800ac05625e1fef53317f2a3ec0fab13f8
Instruction ID: f3ae51398e7754608cc445a3ce91f7bb9fcde3bf3237b8ad6ae5762c576406ca
Opcode Fuzzy Hash: f4661b6bd4d0dde6b59eccf1f966d6800ac05625e1fef53317f2a3ec0fab13f8
Instruction Fuzzy Hash: AF51DF31E003099FDB19DBB9A8146EEBBB2EF85310F04C07AD11DE7255EB384A56CB91

Function 02241993 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

D@u, xrefs: 02241AE4

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID: D@u
API String ID: 0-1489254072
Opcode ID: 1ecba4f9432a85fe4cf6cc6e87e2b6633b8b949742e9a4cab4f277b3a22a07a5
Instruction ID: 5d5168c2f95fb53c0cce2b578f0593fac03b570108f7617d3e9d620998ee523f
Opcode Fuzzy Hash: 1ecba4f9432a85fe4cf6cc6e87e2b6633b8b949742e9a4cab4f277b3a22a07a5
Instruction Fuzzy Hash: A5413531A10215CFEB2CDFA4C059BEEBBF1AF04704F14446AC009AB295DFB88895CBA1

Function 02244F43 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

hN|, xrefs: 02244F5C

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID: hN|
API String ID: 0-2395741206
Opcode ID: 45e08d1d17a3f57b2ab8fbfef2632a5d9895638063b5538877b689d2af91963f
Instruction ID: c4e6c9a1b4ff7bb45955e9ed80a8eae217b7a92a5b19a1979fb567243375f373
Opcode Fuzzy Hash: 45e08d1d17a3f57b2ab8fbfef2632a5d9895638063b5538877b689d2af91963f
Instruction Fuzzy Hash: D8119030A15245DFEB18EBE5D9547EE7BF2AF88300F144129D402B7388DF759915CBA1

Function 02244F48 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

hN|, xrefs: 02244F5C

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID: hN|
API String ID: 0-2395741206
Opcode ID: 4ca1b7c19db7d196c1a84629628a85aa76c813ea2cc13de71227645e9aa6c711
Instruction ID: 2b3ebe91fd56b400eb9d89df0a1cf9dbc4de3b05a9303359714eef3037374048
Opcode Fuzzy Hash: 4ca1b7c19db7d196c1a84629628a85aa76c813ea2cc13de71227645e9aa6c711
Instruction Fuzzy Hash: 6611C130A15209CBEB18EBF6D9547EE7BF6AF88300F544129D402B7388DF799910CBA1

Function 02240F07 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

x!$q, xrefs: 02240F14

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID: x!$q
API String ID: 0-1621810100
Opcode ID: ba2af99ff289fc29b9b2e34b0c7ed2ea612008eb5eedcc3bedc6b9f709acb430
Instruction ID: c0a8a48920954135f8e9c1d45ead277ac9196cd684d7cb9e556e044cbc292859
Opcode Fuzzy Hash: ba2af99ff289fc29b9b2e34b0c7ed2ea612008eb5eedcc3bedc6b9f709acb430
Instruction Fuzzy Hash: 79F0E562A3E3840FD72E56B45C102513FA8C743110F0705FBDA85CB26BEE409D9983E5

Function 02241063 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c6f706ac1b207eab7847ea05a6bd88f477585242d653b4adcabb6708820aba
Instruction ID: 56ca48a7c6d403f0b410b8d130ec43f3160883bd2dfda607130450b3f31ad1c4
Opcode Fuzzy Hash: 81c6f706ac1b207eab7847ea05a6bd88f477585242d653b4adcabb6708820aba
Instruction Fuzzy Hash: E1A17E71A00218DFCB09DFE5E854AEEBBBAEF48300F14812AE509E7254DB75A956CF50

Function 02244868 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b8e920ef19629378924d8a8e9e370e1112154c5912ad7035249c0db5f8ca58
Instruction ID: 9311a0d5768540532953934b723cd13bb208a5c960cf1dff6325112e71a65357
Opcode Fuzzy Hash: b3b8e920ef19629378924d8a8e9e370e1112154c5912ad7035249c0db5f8ca58
Instruction Fuzzy Hash: 77A12730600605CFC729EFA8C494B69B7E6BF44350F46C9AAE0499B666DB34FD94CB84

Function 02245E28 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01550479dc350f96b09d3154c0119723a78b1076f5be18df82e3e340f828d708
Instruction ID: 09760e192cbf3ae06d023531ae690b501ccff4776fad67c80ba462e0cf9150d5
Opcode Fuzzy Hash: 01550479dc350f96b09d3154c0119723a78b1076f5be18df82e3e340f828d708
Instruction Fuzzy Hash: DC619C31B202159FDB08DFA4D884BAEBBF6FF89711F558165E845AB294CF74AC01CB50

Function 02241CC0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d262dfcc1a6912aafe2c4068ef93771396a4c9f6624de3e499a14bfdf9ddc459
Instruction ID: 2b4c998534043c35c47411d910edcbc3e8d260aba255e664b64429ede775c954
Opcode Fuzzy Hash: d262dfcc1a6912aafe2c4068ef93771396a4c9f6624de3e499a14bfdf9ddc459
Instruction Fuzzy Hash: 89412370A10205DFD709DF64E844AAE77B6FF84311B00C279E409CB269EF749D55CB92

Function 02240848 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfd4948f871c7c50411eacb32bf912d3d8840afc580d7cf7139a0b5ecc28f6a
Instruction ID: b155b6299bf307bdb9cc42e249fee35e1b7c9509510dfad69bdb4f338123b3ce
Opcode Fuzzy Hash: 8dfd4948f871c7c50411eacb32bf912d3d8840afc580d7cf7139a0b5ecc28f6a
Instruction Fuzzy Hash: 7841C370A10208DFDB09EBF8E89479DBBB6FF84304F108169E105AB255DF749D95CB91

Function 02241B68 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed278e159126d21658c8ca303d2fa2a3339a3232080f9406ef0f0dcfc125c0f
Instruction ID: 7028d6c383145701b7dfc09fc9536373097501d66b6929f5dd6b10d5324580ff
Opcode Fuzzy Hash: 9ed278e159126d21658c8ca303d2fa2a3339a3232080f9406ef0f0dcfc125c0f
Instruction Fuzzy Hash: 7641BF70A00205CFD71CEFB8C889A6DB7B2BF04B05B1144A9D50A9B376EF35E852DB91

Function 02241B78 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71926bf552ac71b2afc52063e2795cd91893f3cc5099d20b0648a5bbf7212db2
Instruction ID: 774096878a07ebdee776c2f3423dd674d136b4946ac9ee6fc12af71cea4162a9
Opcode Fuzzy Hash: 71926bf552ac71b2afc52063e2795cd91893f3cc5099d20b0648a5bbf7212db2
Instruction Fuzzy Hash: F7214C70B40215CFDB58EFB8C49896D77B2AF48B01B2044A9D90ADB371DB35ED42CB91

Function 02246060 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953c20ca8cf2832724ffcab9617377153b090a5fe5dbedbd64f0b788af6de235
Instruction ID: 8292bd48d02b5b8b5fa3e129233f0340e3b4468e29a32a4d32654a0275653402
Opcode Fuzzy Hash: 953c20ca8cf2832724ffcab9617377153b090a5fe5dbedbd64f0b788af6de235
Instruction Fuzzy Hash: 531148B1D043099FC729DBB9A8487AE7FBAEBC6214F10417DD0099B242DF7569068791

Function 02241C73 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db48f72a2cf3ba347bb999844392c04a7e706c42d72e51a29fa6b1ba68470353
Instruction ID: 99a475f3ed01f7f8748fb3c656e5eb2c1c583e5f9784065ea84a956ea6d043b4
Opcode Fuzzy Hash: db48f72a2cf3ba347bb999844392c04a7e706c42d72e51a29fa6b1ba68470353
Instruction Fuzzy Hash: 6311AC74700101CFC709EBA8E898AAD77B2BF48B05B114198E40ACF3B6DB35ED12CB91

Function 02245218 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99b8d3e0c92c01d59ad51db9f3018a36eefb474c37e91b253c08099575afbbf
Instruction ID: 57f05b872d7804fb6ddcd42dc537a5abbc65d58a39a493c71c3773dc1ab3fab4
Opcode Fuzzy Hash: b99b8d3e0c92c01d59ad51db9f3018a36eefb474c37e91b253c08099575afbbf
Instruction Fuzzy Hash: 1401F7767041308FD7199B39F88895E37AA9F9975131540BAE805DB371CB70DC138B90

Function 022452ED Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fb3bcbda76442f954119f52c57fc695ed7c2e123095ec43413cd23ab54f02c
Instruction ID: e16d6152f5033ac9b744a1553eb6142cd62f2420a2a210eb06b179881672c48c
Opcode Fuzzy Hash: 65fb3bcbda76442f954119f52c57fc695ed7c2e123095ec43413cd23ab54f02c
Instruction Fuzzy Hash: 5F0149727101218FC309ABBCF4589A937E99F9862131141B6EC04CB339DBA0CC22CBE0

Function 02245228 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6323afa215ed80372a040c26aef5c5279e005d33e11db447c6d02d5e4ea010
Instruction ID: 8b1ed58c2b2e2f7677f5912ff38b75af412833154bfc746e9d965520a7d25fac
Opcode Fuzzy Hash: 8e6323afa215ed80372a040c26aef5c5279e005d33e11db447c6d02d5e4ea010
Instruction Fuzzy Hash: 0DF04F767112308FD718AB7DF88891A77EAAF89B6131541B9E905DB334CF71EC118BA0

Function 02245139 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8edf8a2acba8d0344bbdbe48a2310eacaba6cbf17a8104781efb4093b055d316
Instruction ID: caafdc270eaa3c616b6ef00324d046d2ea68ee5434dce7386c6ac9bbb2d1064d
Opcode Fuzzy Hash: 8edf8a2acba8d0344bbdbe48a2310eacaba6cbf17a8104781efb4093b055d316
Instruction Fuzzy Hash: 98F05232302204AFC7009B35EC9888EBBBAEBDA312714C13AE009C3322DA344C038760

Function 02240AA8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c53712a3944d6e76edf344a7f242eda5743ed0b5bed86e2dc2e101bfe2c50ae9
Instruction ID: b36f1fbbd4b56442642cffa03320a56a1ccfe3a82c3e201b0c25ab09fa47418b
Opcode Fuzzy Hash: c53712a3944d6e76edf344a7f242eda5743ed0b5bed86e2dc2e101bfe2c50ae9
Instruction Fuzzy Hash: 26F0F03070036187C70C6BB4F86836B366AAB40789F08446AEB07C3398DFBAD8C0C390

Function 02244B34 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3daece823a7b3864ea65f6307b0759145331b66cb1a6a996a809bee67fe2081
Instruction ID: 4651f035b95de91f672f6feb859503bab0927ea9320c432b82bf50d5fc627a80
Opcode Fuzzy Hash: d3daece823a7b3864ea65f6307b0759145331b66cb1a6a996a809bee67fe2081
Instruction Fuzzy Hash: 9AF0F061D09284EFCB01DBF1A8545ECBF71EF81304B0480EAD05687625EAB88605CB51

Function 02240ED7 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9e10b91ef3c34bf51b49e5ba1d210cc61d9321d56550241722c4943ddf7cf52
Instruction ID: 1a2cb93ac30c1cf7bfff6bfacba8f5bc593064bee11f33db2b7c3cc5cefb18a7
Opcode Fuzzy Hash: b9e10b91ef3c34bf51b49e5ba1d210cc61d9321d56550241722c4943ddf7cf52
Instruction Fuzzy Hash: 0AF020B2E2A246DFD700CBB0A88A2C87FA1DB1625071000AAC40C97205FBB44F16C702

Function 022413B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e446d50f24669498b56767e0cfa7fc106442713ac8e1a7fa37109aab5d010fc5
Instruction ID: 445a3e0c2f095902ed084382f294d02760505d93e0b0dfbb028b6a8f0253bb57
Opcode Fuzzy Hash: e446d50f24669498b56767e0cfa7fc106442713ac8e1a7fa37109aab5d010fc5
Instruction Fuzzy Hash: D7F0F4B4600205CFDB19EFA4E198A68B7B2AB88315F1044A8E5068B3A5CF79DC51CF01

Function 02245148 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f01ec0f6e3abcb96157a7558f63a644e295b00748658aa8049d8e5066b16706
Instruction ID: 1dde18f8a147f5873f39b44063e54332e900523855e242b89b1bf4b058ba4fe2
Opcode Fuzzy Hash: 2f01ec0f6e3abcb96157a7558f63a644e295b00748658aa8049d8e5066b16706
Instruction Fuzzy Hash: 8DE09B35301204ABC704DB25EC9499AB7BAEBCD3527548539E50AC3325DE755C018760

Function 02240F28 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99b67f03761e00fec41db6e97384da593e55ae0c4252111b17ae8d8db9bcf98
Instruction ID: efa948c7b6c88be26c7f4c8769fe811c7af35785cba35d2ba8cb077b5dba9e0e
Opcode Fuzzy Hash: e99b67f03761e00fec41db6e97384da593e55ae0c4252111b17ae8d8db9bcf98
Instruction Fuzzy Hash: 13E0DF71A4924CEFCB44DFF4E95219CBBB9EB16201B2082AAD80CD7212EF785F068741

Function 02240F38 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1381199347.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2240000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed7daf3882b8cfdc55126c06d657b7501ec1a2369a52a61b43e3b52f1f462b4
Instruction ID: 14efd52892fa90d8873eeb2ea07eefb877d892493c959c965bb7a82229c58f22
Opcode Fuzzy Hash: 0ed7daf3882b8cfdc55126c06d657b7501ec1a2369a52a61b43e3b52f1f462b4
Instruction Fuzzy Hash: 5ED01771A01208EF8B00EFB4E94659DB7FAEB44201B1081A9990CD3210FB71AF109B81

Analysis Process: Honda.exePID: 8052, Parent PID: 3504COMMON

Executed Functions

Function 01662788 Relevance: 2.0, Instructions: 2016COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a7f5eba42b02d7a99e1f05c1ed9277578c02a4a204a95d49005e913bf6d0633
Instruction ID: 09c63c9eabe4ed205764e92e8b69050b269324623ca93391125da4b303a24e6f
Opcode Fuzzy Hash: 8a7f5eba42b02d7a99e1f05c1ed9277578c02a4a204a95d49005e913bf6d0633
Instruction Fuzzy Hash: B6039D30A00719DBEB21DF64DC44BAAB3B6FF89700F5181A5E5086B294DF76AE81CF51

Function 01665A41 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6110da1165615ecc0ab7f981d255a3c7cd5f75877e7a047350cbb176a944edfa
Instruction ID: 7730decce256856cdcdf0fbe5b16243b3484faeceba732bf04a3b00cfd9a9ce0
Opcode Fuzzy Hash: 6110da1165615ecc0ab7f981d255a3c7cd5f75877e7a047350cbb176a944edfa
Instruction Fuzzy Hash: 16F18D30B00205EFDB24DF68DD59B6EBBB6BF88745F148429D406AB395DB35AC42CB90

Function 01660F07 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

x!$q, xrefs: 01660F14

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID: x!$q
API String ID: 0-1621810100
Opcode ID: 78bd452d753ba9f6bb66c3ec36824c131974602e423b97c626b3fd90e2f5ab8f
Instruction ID: 7210fdebb031c43b8f663ee4b3950f695f251c113eeb6a0a3c895df6845d7059
Opcode Fuzzy Hash: 78bd452d753ba9f6bb66c3ec36824c131974602e423b97c626b3fd90e2f5ab8f
Instruction Fuzzy Hash: 70F0E572A1E7948FC7134A399C102913FECDB5311471644FBEC84CB263E6628D04C7E6

Function 01664C68 Relevance: .4, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf15504b675dab0cbd74fb4f34699ed06c51df15d680572a20b146e125e117f
Instruction ID: b4491b9ba549e3fc16f62c0af5430e6aaba728d324880609480af116157d1d3a
Opcode Fuzzy Hash: 9bf15504b675dab0cbd74fb4f34699ed06c51df15d680572a20b146e125e117f
Instruction Fuzzy Hash: 7D218131A05255DFDB14EFACD9587AE7BF6AF89300F144429E402A7380DF359D00CBA5

Function 01664868 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424bd79a46034281a43ed6b674e31954dd706ce4c4dc1403f9ecd91f4c4ced89
Instruction ID: eeae3f77c1257b83d421a74a7648d4544a7490b50a2c20b57ef54ad97f9c3bd9
Opcode Fuzzy Hash: 424bd79a46034281a43ed6b674e31954dd706ce4c4dc1403f9ecd91f4c4ced89
Instruction Fuzzy Hash: 82A13630200605DFD725DF28C884E69BBF6EF45350F4AC5A9E4499B626EB31FD94CB84

Function 01661062 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66baded623453bbc8c1db95309860c4b4edb1686ed2bc52c44c768361ec8847
Instruction ID: cebafcb9b8b100a0e75911df06a8cc563f55b902e94daeef76564840d0503819
Opcode Fuzzy Hash: b66baded623453bbc8c1db95309860c4b4edb1686ed2bc52c44c768361ec8847
Instruction Fuzzy Hash: 11915D71A00208EFCB15DFE9D9549EEBBBEFF89300F14812AE506A7254DB369945CF90

Function 01665E28 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9dd2bb5f2e490b4bb3143c79ec46bc7ef21fdc7883b551b370a1e53a9355b9
Instruction ID: aa62282b2be330e8488e30c5810112a97aaecd708bd87ae40fbc85d1a600a9c5
Opcode Fuzzy Hash: 2d9dd2bb5f2e490b4bb3143c79ec46bc7ef21fdc7883b551b370a1e53a9355b9
Instruction Fuzzy Hash: 96616930B00215AFDB14DF69DD45BAEBBFABF88750F148069E506AB391CB359C41CBA0

Function 016617C8 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cdeb954548272598a1133d718f87da815695c84a6c68e3044a45d0d6d79eaf1
Instruction ID: ed979c932b0121c78dd7fa5a03d9b04d3e8cec8565bf9b25aa994fd820b230cb
Opcode Fuzzy Hash: 1cdeb954548272598a1133d718f87da815695c84a6c68e3044a45d0d6d79eaf1
Instruction Fuzzy Hash: 8E51C071E003099FDB15EFB9A8106EEBBB6EFC5310F1481BAD419E7250EB354A16CB91

Function 01661CC0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f3bcb512143478fc614b58d6888abfa581f7c84621b92ead1e1a0c7c877a9c
Instruction ID: 21e7aadf3d39345530d2de5a1822f4ac2e0b270da5cf9e57d589139941320582
Opcode Fuzzy Hash: 55f3bcb512143478fc614b58d6888abfa581f7c84621b92ead1e1a0c7c877a9c
Instruction Fuzzy Hash: 8D41AC31B00206DFDB14EF78E8449AA7BBAFF89301B108169E405CB365EB359D06CB91

Function 01660848 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f86a993a0694933516956a5edc3963db70fc0e75ccbea26103c0870df2f0b5f
Instruction ID: df0ce70d2801760ad90dca53c40d2ba836a004408fcb40ed2ce2b433d35a5769
Opcode Fuzzy Hash: 8f86a993a0694933516956a5edc3963db70fc0e75ccbea26103c0870df2f0b5f
Instruction Fuzzy Hash: 8B419DB0A00209DFDB04EBBCE85479DBBB6FF84304F109529E409AB355EB359D56CB92

Function 01661CB0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae17569247681554d58dce09a40bcee159a7c3b85e5942e5e22f37eccc78af9
Instruction ID: 07c5c75198a38c4bda7eaa5d784039bdb5fd1f014ac74bd602a8aad9ce3c594e
Opcode Fuzzy Hash: 1ae17569247681554d58dce09a40bcee159a7c3b85e5942e5e22f37eccc78af9
Instruction Fuzzy Hash: 9F415E75700205DFDB14EF69E8449AA7BFAFF89311B108169E805CB368EB359D06CB51

Function 01662777 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd5a359d77626b925fd2b01c9a3beb0a5f42df220accbdee8625c354f221b59
Instruction ID: 262f33b3637adfee43d6687cdf0df76f7d71a8bfc3a410b781f5662d79952772
Opcode Fuzzy Hash: 3fd5a359d77626b925fd2b01c9a3beb0a5f42df220accbdee8625c354f221b59
Instruction Fuzzy Hash: 2A318931A01204CFE7258FA9DD64BA97BFAEF45311F4984AEE405CB296D739DC44CBA0

Function 01660838 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b262354eed428a4ed75a948d72bbcdd3f13515e96e1d790aaec76a81897774c6
Instruction ID: 5024be10efed636d40cf5047d60c1b02eb70950587845968e3a5206f10d3d8fe
Opcode Fuzzy Hash: b262354eed428a4ed75a948d72bbcdd3f13515e96e1d790aaec76a81897774c6
Instruction Fuzzy Hash: B2318FB0A00209DFDB00EFF8E894A9DBBB6FF84304F109129E0046B255DB799C96CB51

Function 01661B68 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0cc6f19bf0d2987a45deb0588cef44d2dc430b2d46e67c8a21b81c1b298b2d
Instruction ID: 3f60052696712bcc9da17141ad82e880b4cd8368ba3fe816cc13a3dd3a394654
Opcode Fuzzy Hash: 2d0cc6f19bf0d2987a45deb0588cef44d2dc430b2d46e67c8a21b81c1b298b2d
Instruction Fuzzy Hash: 13216D70B40215CFD748EFB8C88896DBBB5AF8970172044A9D506DB361DB35EC02CB90

Function 01661B78 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e559d59994674b38bb217c22c51f400fa1d8dcb602d6d072a98fb354fcc80507
Instruction ID: 09aa829e776009361de189c1429879e0e572fdf41ecbc31af948d921f434950d
Opcode Fuzzy Hash: e559d59994674b38bb217c22c51f400fa1d8dcb602d6d072a98fb354fcc80507
Instruction Fuzzy Hash: 8F214F70B40215CFDB58EFB9C49896D7BB1AF49B0172044A9D506DB371DB39DC02CB90

Function 01664F48 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498857cf162b8f8abc1901cd4b080b2645caa7fa79fdc1748db2e6fcf87b23e7
Instruction ID: 12569559efe5f202803922f629f541ca2b971945e80b604f33416599d9f1cbd6
Opcode Fuzzy Hash: 498857cf162b8f8abc1901cd4b080b2645caa7fa79fdc1748db2e6fcf87b23e7
Instruction Fuzzy Hash: 3B116334A04215DBEB14EBADD9587AE7BF6AF88200F144429E502A7380DF359D05C7A5

Function 01666060 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728e1f6ef84245b27ffecac4f017c2e719f50b803a61a4ba82b2859f177ccc40
Instruction ID: 2c067f33932a0622c4ea7ffe1757b13b951609cf1f1ec753271e487d807b3305
Opcode Fuzzy Hash: 728e1f6ef84245b27ffecac4f017c2e719f50b803a61a4ba82b2859f177ccc40
Instruction Fuzzy Hash: 5C110271E04248AFC765DF68EC58BAE3BBAEFC5314F1041AEE0059B252DB754911CB91

Function 01665218 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b340d05763598a9f225e5e30b2f8d978cf33c6f583d5d2ed37d9ef108436f3c
Instruction ID: ce693eaf3622db0fbc0d9dc7855c8602982c6fee56f39e22920edc62d6b57f37
Opcode Fuzzy Hash: 7b340d05763598a9f225e5e30b2f8d978cf33c6f583d5d2ed37d9ef108436f3c
Instruction Fuzzy Hash: 0D017131750220DFD3299B3DE84893A37EAEF8976131541B9E905DB371CA35EC128BA0

Function 01665228 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9188186ee2847e124a5ef5f017d5c644cc7991f486c146040b2c6b4d5c2f18c
Instruction ID: c3790cfdfdaef28c3747640b7c029cb1324ba0be633ebcff0d0387d6c6628b3b
Opcode Fuzzy Hash: c9188186ee2847e124a5ef5f017d5c644cc7991f486c146040b2c6b4d5c2f18c
Instruction Fuzzy Hash: C3F0AF32710120DFD7289B3DF84882A77EEEF88B6131140B9E905DB330CA36EC018BA0

Function 01660A98 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016d6dadbfc681ad5ee942cad860ae381f738eaff19739bf931e720a75aa1ba4
Instruction ID: f190507f446f4f36ce3af0dfdf20a12546266eb0ec3007675de405707c2ea021
Opcode Fuzzy Hash: 016d6dadbfc681ad5ee942cad860ae381f738eaff19739bf931e720a75aa1ba4
Instruction Fuzzy Hash: 93F08130700240ABD7255B78A96976E7B59AB81751F4441BDEA02C73D5EFB7CC80C750

Function 01660AA8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c85f542ac41da93cb2d0cd10fa0405890b4cec93debc2c151a4278dbb3dbc52
Instruction ID: a2deb94b50b5191cdfd3c4e89a7ff079a470b36850dbb982419397157108ff43
Opcode Fuzzy Hash: 0c85f542ac41da93cb2d0cd10fa0405890b4cec93debc2c151a4278dbb3dbc52
Instruction Fuzzy Hash: 60F06D30700250A7D72467B8AA6932E7B5EAB80790F4441B9EA06C3385DFBBCC80C7A1

Function 01665139 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c86dd77e58f3df06a0c65aaa5a34c3ab0e3233fa71f4e50c35970b394e73d2
Instruction ID: 57aca94a019aa1f53c78bc4c4ba8b6973a0ca20743b81841631b1ba8ae9aeff3
Opcode Fuzzy Hash: d3c86dd77e58f3df06a0c65aaa5a34c3ab0e3233fa71f4e50c35970b394e73d2
Instruction Fuzzy Hash: D0F0E9313061009FC714DB65EC54D6E7BBAEFC93517048279F40AC7365CA365D11C7A0

Function 01664B34 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 263ba75527bce7189c82feb92fd2157bd950456672e12ca36ba4bae1cc1c5992
Instruction ID: 1927f9064a5f8aa39dc16c79397bc918d7084caf002c013aaba129bd84022874
Opcode Fuzzy Hash: 263ba75527bce7189c82feb92fd2157bd950456672e12ca36ba4bae1cc1c5992
Instruction Fuzzy Hash: 55F02E71D0A384EFCB01CBF5AC490ECBFB1EF81304B04C0DAD09687625EA798A4A8B51

Function 01665148 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e590762da0f0c522f2a2a66058d9cd1d8fb399a757e342a4fd904a6c1e2da3
Instruction ID: 82a1bb7792c020dfa63df24b0d631685fde4a75af62eadd19a7132a028a3001e
Opcode Fuzzy Hash: 61e590762da0f0c522f2a2a66058d9cd1d8fb399a757e342a4fd904a6c1e2da3
Instruction Fuzzy Hash: 40E09232301104ABC724DB6AE89895EBBFEEBC8361B548539E50EC3319DE369C0187A0

Function 016613B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6190e89f01ed2475481d7a790a29c3ffc53e9a4b2e705f6c57c821c39b348221
Instruction ID: 20203bf12336c221114682554a71b2866c0a458f05cb10c7785c0db6a59a7288
Opcode Fuzzy Hash: 6190e89f01ed2475481d7a790a29c3ffc53e9a4b2e705f6c57c821c39b348221
Instruction Fuzzy Hash: BCF0A4B4640206CFDB24DF78E558AA87BB6FF89345F2044A9E4069B3A1CB7A9C45CF00

Function 01660F28 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7928bbec14962136b98917bfd736cc3056c2e4cb59e3498c609bef0dbc5dfca
Instruction ID: d5097994d4e94c0f4c83b7628f8cca429695ff4124dc7ed058cb4711d4015494
Opcode Fuzzy Hash: c7928bbec14962136b98917bfd736cc3056c2e4cb59e3498c609bef0dbc5dfca
Instruction Fuzzy Hash: 14E09230905208EFCB00DFE4E95169C7BB5FB09208B1045D9D809D7211E6359E10DB41

Function 01660F38 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1476193441.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1660000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b351e12c1f82e51ae5a543b6bc41bf2c57451bf06192efe0226013e96a2580b4
Instruction ID: 17d2302ca0bc71f6ef4234f8d7ecf22264749b014aeb38634830f936bbe551c1
Opcode Fuzzy Hash: b351e12c1f82e51ae5a543b6bc41bf2c57451bf06192efe0226013e96a2580b4
Instruction Fuzzy Hash: B5D01270E00209EFCB10DFB8E90555D77F9EB48208B104199940DD3200EA319E109B81

Analysis Process: Honda.exePID: 7312, Parent PID: 3504COMMON

Executed Functions

Function 013C2CC9 Relevance: 1.6, Instructions: 1602COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81d4975d7337ef0b266eebbd320aac41e26017935561e931b02c4f96f3a587a
Instruction ID: cf8ee0bb972d7cf226057fcd4b0e959ea6dc94a791fae6aef712cbf357cf8d1f
Opcode Fuzzy Hash: a81d4975d7337ef0b266eebbd320aac41e26017935561e931b02c4f96f3a587a
Instruction Fuzzy Hash: EFE28B30A01719EBEB25EB60DC54BA9B3B6FF89700F1185A5E5083B295DFB16E81CB41

Function 013C5AB1 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3072099234b5bb8698e3f30153d652363534b498120083ed47fd7d305082b8c
Instruction ID: ecf3788b6522c069e1ceb8d6c0999ac8f4acf17d8863d26a5df600106f3f575d
Opcode Fuzzy Hash: f3072099234b5bb8698e3f30153d652363534b498120083ed47fd7d305082b8c
Instruction Fuzzy Hash: 84A15E30B01705CFEB28DB68C95877ABBA2BF84B09F14C42DD41A9B695DB75EC41CB90

Function 013C2788 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02207ea8f3602ea2822f4bb66c495a9fcf79c97bd9500b3c8e7fc390da7a1d21
Instruction ID: 8003945336ddaff8dca2811fc2f158657fab9d456a5f0e72d9ece8bfa9c93f4b
Opcode Fuzzy Hash: 02207ea8f3602ea2822f4bb66c495a9fcf79c97bd9500b3c8e7fc390da7a1d21
Instruction Fuzzy Hash: 5DF15831600208DFEB15DFA8C858BAEBBF6FF88701F158069E9069B2A5DB35DC51CB50

Function 013C1071 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6e284e5a4013b56fd4bdf9701e7c4300631ac4a589ee795cbeb001fd02e772
Instruction ID: 2edd466484073b9a6ff35e713584ad3e5a819c2ad3e1dc9e2c36b09d06f4b203
Opcode Fuzzy Hash: 0f6e284e5a4013b56fd4bdf9701e7c4300631ac4a589ee795cbeb001fd02e772
Instruction Fuzzy Hash: 04917F75E00208DFCB19EFE5D9649EEBBBABF88304F14802AE506E7254DB35A905DF50

Function 013C1CC0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1762a124134a27c096c7a2997ac77d18104fd9e436ac7f2eef9f5871d60b242a
Instruction ID: f891858335a2732affaa8d379f5034701d791af8a3bb43858f15b5fdf0d65a74
Opcode Fuzzy Hash: 1762a124134a27c096c7a2997ac77d18104fd9e436ac7f2eef9f5871d60b242a
Instruction Fuzzy Hash: 1C41B034A00209DFC719EF68D8649AE7BF6FF89311B10C56AE405DB269DF349D05CB51

Function 013C0848 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b384763572333282d823f8c5e7750e755b9ff8a9c283e6955d02bf58cbfd1f
Instruction ID: 962684e2b3ffb5a76e5b9e15599c6930bef40a40c5aa8538472f4de4381ae7fe
Opcode Fuzzy Hash: 21b384763572333282d823f8c5e7750e755b9ff8a9c283e6955d02bf58cbfd1f
Instruction Fuzzy Hash: CC419F74A0024DDFDB09EBBCE8547ADBBB6BF84704F108529E005AF255DB349D45CBA2

Function 013C1CB0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98cc749a9b0eb1c107115d9b16576d45d624848a4bbc662ea36e2eea22bf2c06
Instruction ID: cb1aa0a6b6a849066571c535b205fbec90160dad999e3da94cc08f96d13bbb3d
Opcode Fuzzy Hash: 98cc749a9b0eb1c107115d9b16576d45d624848a4bbc662ea36e2eea22bf2c06
Instruction Fuzzy Hash: 9741C038A00209DFD709EF68D8549AABBF6FF89715B00C56AE401DB265EB30AD05CB55

Function 013C2777 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db60bbf2894ecf0bf9d350d40de7ddabc6027da44d2025ea5c9dd2f65ff182f5
Instruction ID: 5d7ebd1ea5bd2b4c8ca97b3d944e8a5900aa28e507ecb4fa889f4456f31baa7e
Opcode Fuzzy Hash: db60bbf2894ecf0bf9d350d40de7ddabc6027da44d2025ea5c9dd2f65ff182f5
Instruction Fuzzy Hash: FE319E31A04304CFEB25DFA9D984BAB7BFAAF49B05F0584A9E505CB191DB39DC44CB60

Function 013C6070 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e93f7bc20a52614af4d2b7e2e0ff291a65268316c1ba5411d4ce90825ef774f
Instruction ID: 67dac6ef549515257f596bdcf1385ee2c50817324d73835e82f728fdc51d41f6
Opcode Fuzzy Hash: 3e93f7bc20a52614af4d2b7e2e0ff291a65268316c1ba5411d4ce90825ef774f
Instruction Fuzzy Hash: 0E21DE75E002499FCB19EFB9D8587AEBBB6EBC8318F10846ED009A7241DF7159068B91

Function 013C1B68 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5f983eca3516417dc9cbb34d319151cd889626aa7f6e1d75fce14d5f123cc3
Instruction ID: 3dcca4d0ea60e12c51231222c7470a7e8deb003d7b85d2ba69854fa469532749
Opcode Fuzzy Hash: 1e5f983eca3516417dc9cbb34d319151cd889626aa7f6e1d75fce14d5f123cc3
Instruction Fuzzy Hash: 8C216D71B40215CFDB48EFB8D49896D7BB2AF49B0572044A9E506DB371DB35EC02CB90

Function 013C0838 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6ddb50dcfa23ddb71f35bd4a79842aafabe27c32c512127292e3becb723ec2
Instruction ID: c1dfdb2ac2849a1c712ae1614ca716187c04be946b7f25d90e800abc89f50111
Opcode Fuzzy Hash: 6b6ddb50dcfa23ddb71f35bd4a79842aafabe27c32c512127292e3becb723ec2
Instruction Fuzzy Hash: 18315C7890024DDFDB09EBA8E894B9DBBB2BF84304F10C129E005AF265DB759885CB56

Function 013C1B78 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5103977d283af1e6ab416310bfc06a1a5715327d3bfa4d718a66bcc652fe0318
Instruction ID: 6d7345f296a0ed155d65959b573b9ef1975f2ca4f77cccf604bf3684d6a294ac
Opcode Fuzzy Hash: 5103977d283af1e6ab416310bfc06a1a5715327d3bfa4d718a66bcc652fe0318
Instruction Fuzzy Hash: E5211A74B40215CFDB58EFB8C49896D7BB2AF48B15B2044A9E906DB361DB35EC02DB90

Function 013C4F48 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa9528796b5f08b9e04667b2ec271111a1533c59b834539de7fbd9fee09cec7
Instruction ID: 29874c3c2a7380d5c8f0ffe294ab40af213d46737ca88f40fb619b354417ed3a
Opcode Fuzzy Hash: 3fa9528796b5f08b9e04667b2ec271111a1533c59b834539de7fbd9fee09cec7
Instruction Fuzzy Hash: FC118F31A0421A8BEB14EBBAC9687AE7BF6BF88704F144429D501F7384DF359D058BA5

Function 013C5FC1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b237564b4797f5669a13f1df9ba00acebde4651a36a9aa28b9d510fee3c7fb44
Instruction ID: 4bdf5bed042123f099b6e31877cd658fee13d474a547c71392cbf71cce54febd
Opcode Fuzzy Hash: b237564b4797f5669a13f1df9ba00acebde4651a36a9aa28b9d510fee3c7fb44
Instruction Fuzzy Hash: AF1182753041249FD318AB79D498B3A37A6BB88A65B148079E50ADB364CE35EC01DB90

Function 013C4F45 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc86c889d0f3a1323c2e03e36bf7eed391a40a3e457fcab7406dadafca6d4200
Instruction ID: ddd6546bcee357ba7c84156b578ba42b16d468df7b771963acc1a9a0779dd5c5
Opcode Fuzzy Hash: bc86c889d0f3a1323c2e03e36bf7eed391a40a3e457fcab7406dadafca6d4200
Instruction Fuzzy Hash: 5C116D31A0421A8FEB14EBA9C9287BE7BF6BF88704F104429D402F7384DB359D058BA5

Function 013C52ED Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4b320d60ba081c2ac5ba149efb0da60d4d27413e1f56f64b22a267c2aaaabb1
Instruction ID: 7e47a52eeaca16e0e0e8cef8f72817b32c2917a79ca057ce1004834f6afd772c
Opcode Fuzzy Hash: e4b320d60ba081c2ac5ba149efb0da60d4d27413e1f56f64b22a267c2aaaabb1
Instruction Fuzzy Hash: 8C01FC76704124CFC71AAB7CF4584693BEA9F99A5431141F6E844CF336DA20DC52CBA1

Function 013C18F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12e52762d2cfb281a6a7e6e00571cd4e11d17d50c187558e2f906640265a79b
Instruction ID: 7f92f2a90e4a4b0a53b8634d9ce835d102033e89941648be1b0f5f8150c6e875
Opcode Fuzzy Hash: e12e52762d2cfb281a6a7e6e00571cd4e11d17d50c187558e2f906640265a79b
Instruction Fuzzy Hash: E2015A36A00108CFCB54EFA9E8046EEBBB4EB94725F00803AE559E3200E7306A55DBD0

Function 013C5228 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6480b7261fca40dd8c4f00cd0ba57e0185359423c1c583a28811118a713eb821
Instruction ID: f98a3b8d99d30868f92f54746c60d832b5e955bb649d29d68b6aa156d7614e09
Opcode Fuzzy Hash: 6480b7261fca40dd8c4f00cd0ba57e0185359423c1c583a28811118a713eb821
Instruction Fuzzy Hash: 7CF04F767101248FD718AB7DE458D2A77EAAF89B6531601BAE905DB335CA31EC018BA0

Function 013C4AB9 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8086a658a22b91155346abce03d289292e5a3c0647d3b657c16762e8d404e37
Instruction ID: e7e49d0b7d0178629bdf2f98c7cfae0e1088155a51dc94331179fbe78c9d7d0d
Opcode Fuzzy Hash: b8086a658a22b91155346abce03d289292e5a3c0647d3b657c16762e8d404e37
Instruction Fuzzy Hash: EF01EC70A00218EFCB44EBB9D8586AD7BF6EF89304F1080A9E50AD7264DA3559458B50

Function 013C0A98 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835a335ca11470d2864c04378db5027959ce0ad34859316f006e5a2cd7966d00
Instruction ID: 5fe9c056f7bcf07b1afbd15d89d051b3cbb9de5ce4ccbae172708965baea0bf4
Opcode Fuzzy Hash: 835a335ca11470d2864c04378db5027959ce0ad34859316f006e5a2cd7966d00
Instruction Fuzzy Hash: 7AF08138B003889BEB1C9778E8787793B55AB91B15F45057DE502C7294DF76CC80C740

Function 013C0AA8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bef40ab0416f6a0614f0870974489daca2ec9d4240a773d3817d95804321794
Instruction ID: 62c2830de699bf1a3579d2af7775f4a3980b0220e7226a7c0bb5b613ffede341
Opcode Fuzzy Hash: 1bef40ab0416f6a0614f0870974489daca2ec9d4240a773d3817d95804321794
Instruction Fuzzy Hash: 65F06D3870039897E71CA7B8E87837A3A5AAB40B54F44057DAA06C3294DFB6DC80C790

Function 013C4B34 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae09dedd2153e47c51f308b6a78a3716db4a3618eb933c764c09599bb7f46d9
Instruction ID: 673cde78318af0c57581fe0221f2de8aa155677936cb033a85c56495aab6bd3a
Opcode Fuzzy Hash: 4ae09dedd2153e47c51f308b6a78a3716db4a3618eb933c764c09599bb7f46d9
Instruction Fuzzy Hash: DDF0B475D09348EFDB01DBF5AC651ECBFB1EF81308B1480DAD096CB565EB74860A8B51

Function 013C0ED7 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 047f78aea49857727897742e84d019e7024fa062e5a31e0c7caf2e42d05a55eb
Instruction ID: 0b984fbec5fa0bb0cb842b7b7443d0c8ff4e1629544642234ba91ba55408c5a0
Opcode Fuzzy Hash: 047f78aea49857727897742e84d019e7024fa062e5a31e0c7caf2e42d05a55eb
Instruction Fuzzy Hash: 88F0E5B6E1A247CFCB01DBB4E9A56D87FA4EB55318B1041DEC008DB209FA704F05DB52

Function 013C5148 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e61f2da23c1d212cc4cd94e82dc17aad3c30bdf1c25a067aaf7476566ef43d9a
Instruction ID: 9ae25f597a275cafd1da1da765e4379e66d33337c406abd19b49213e73b24919
Opcode Fuzzy Hash: e61f2da23c1d212cc4cd94e82dc17aad3c30bdf1c25a067aaf7476566ef43d9a
Instruction Fuzzy Hash: EBE092363021049BC314EB69E89896ABBFEEBC9361F548439F58EC7359DE359C0187A0

Function 013C13B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 470aa6ad468041e62f08ac49f559ac2a2de2f5afcb7d59ca4983411324d14b9e
Instruction ID: 6cac341d253c955b290576f9c2ddd667c6a30fa6d7e549ca2fc28e4951f3b665
Opcode Fuzzy Hash: 470aa6ad468041e62f08ac49f559ac2a2de2f5afcb7d59ca4983411324d14b9e
Instruction Fuzzy Hash: 09F0A9B864120ACFD718EF64D169A6877B2AB48715F1044ADE4069F361CB759C45CF01

Function 013C0F70 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9cf3f8fc76f97d582ca5f6db2aebb82b7be468f7c290ecc8ee086f0dd0bc966
Instruction ID: 3b0c6ab5c8d0538481dc49927d4337192cd1ebbb273a95772bbee25c419e72d1
Opcode Fuzzy Hash: c9cf3f8fc76f97d582ca5f6db2aebb82b7be468f7c290ecc8ee086f0dd0bc966
Instruction Fuzzy Hash: E5E0C2311193848FC305AA79E82055277D89B13658B0004FBE884C7222E140ED4483D1

Function 013C0F38 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1556572777.00000000013C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_13c0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34e1382e64d13880ea4b050f3e194fc25712c5c44e56292afdbc16aaebafd4d
Instruction ID: 398f4aa58b4964037437f02aae3edb459030774c5e6b46854b3761d162a1bfb9
Opcode Fuzzy Hash: f34e1382e64d13880ea4b050f3e194fc25712c5c44e56292afdbc16aaebafd4d
Instruction Fuzzy Hash: 2CD01775A0520DEFCB00EFA8E91165DB7F9EB88208B1085A9D409D7200EA71AE009BA5

Analysis Process: Honda.exePID: 3420, Parent PID: 3504COMMON

Executed Functions

Function 00772788 Relevance: 2.0, Instructions: 1996COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96445ff8d5506ec81ad8804d00508f32ea534ea1b3843f239288b7e4322a4c84
Instruction ID: 15479219e24cf5151120bf375e8716c748d2cecd8450fff209d868a77d85f631
Opcode Fuzzy Hash: 96445ff8d5506ec81ad8804d00508f32ea534ea1b3843f239288b7e4322a4c84
Instruction Fuzzy Hash: C3038A30A00719DBEB21EF60DC44BAAB3B6FF99700F51C5A5E5086B295DBB56EC1CB40

Function 00775A41 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e7b5d9eb486f98a26cb164fd99a83017184e27c00963a174ec398a8d0aa148
Instruction ID: 9562c3b105ccbcda851dcc7a22c19275094a2d6b329100b59a04cf6ae63505f4
Opcode Fuzzy Hash: e0e7b5d9eb486f98a26cb164fd99a83017184e27c00963a174ec398a8d0aa148
Instruction Fuzzy Hash: 28F16D30A00B05DFDB24DB64C984B6EBBF2BF85751F14C429D40AAB295DBB9ED41CB50

Function 007717C8 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

D@r, xrefs: 0077182E

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID: D@r
API String ID: 0-3332416283
Opcode ID: 72a8208025dfd20281e3ad33b7c3fe857ce241ce7e3d436712d0c79734feac17
Instruction ID: 8357b919c3c357b6378ca4eaa2b751b7a2998f7b55a5fd439fcb1274aa897679
Opcode Fuzzy Hash: 72a8208025dfd20281e3ad33b7c3fe857ce241ce7e3d436712d0c79734feac17
Instruction Fuzzy Hash: BA51D431E042499FDB15DBB998146EEBFB2EFC5310F04C0BAD159E7291EB385A06CB91

Function 00770F07 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

x!$q, xrefs: 00770F14

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID: x!$q
API String ID: 0-1621810100
Opcode ID: c03a0161a06d1730c6282108d0a62bb9f0239f3cdd30eb8a45548ef782d0bcf9
Instruction ID: be59820a1a39f5474a7a2460b129744407269622ae50d16f7ba2483d2f81f6f2
Opcode Fuzzy Hash: c03a0161a06d1730c6282108d0a62bb9f0239f3cdd30eb8a45548ef782d0bcf9
Instruction Fuzzy Hash: F8F0E56262D3D48FDF6217255C142513FA48653284F0684FBD98CCB263F1559C0883E5

Function 00774C68 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5c261314e52f32531147a1b8058ce57d45ad74efbc2310ac238dbd4777cc474
Instruction ID: 7910c20cd064a8b9d79a09911483fca733b9749b5585073b7d3b6538e98c11b3
Opcode Fuzzy Hash: c5c261314e52f32531147a1b8058ce57d45ad74efbc2310ac238dbd4777cc474
Instruction Fuzzy Hash: B4212470A08244CFDF10EBB9C9547AE7BF6AF89340F188029D445B72D0DF388900CBA1

Function 00771063 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781d5751655ee0715fea7748ad7b2ff2e8c8643b0549bd4d00edab03e9d3c1b2
Instruction ID: 9af4eebbdfe9a42dd712e850a8b1a1bcb9ec64cc9bea5458b90fe799e46085ed
Opcode Fuzzy Hash: 781d5751655ee0715fea7748ad7b2ff2e8c8643b0549bd4d00edab03e9d3c1b2
Instruction Fuzzy Hash: 1DB17A71A00208DFCF15DFE5D854AEEBBBABF48340F14812AE509E7254DB399946CF90

Function 00774868 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b39a24c127c15b0841949fb55b8f6a727ad0373683b48bf5de5d1af9598c2a
Instruction ID: 533d6a1e6d5e8629124f417d855f412d40ac9107dbeb463ac30cb18c2812adfb
Opcode Fuzzy Hash: d6b39a24c127c15b0841949fb55b8f6a727ad0373683b48bf5de5d1af9598c2a
Instruction Fuzzy Hash: 7EA14730600606CFCB25DF28C984E69B7F2EF45390F46C5A9E0499B662E734FD94CB84

Function 00775E28 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4266beab015c897de344067cfa34ecdd82afc764882ba5d566cb670ea327dc
Instruction ID: a7d02c8cd6624f0aac687905ce88e1e572e60c509555ddc4f80bde16896b7b85
Opcode Fuzzy Hash: ac4266beab015c897de344067cfa34ecdd82afc764882ba5d566cb670ea327dc
Instruction Fuzzy Hash: 0B619E30B006189FDB14DF64D894BAEBBF2BF88751F18C069E509EB295DB789D41CB50

Function 00771B68 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8d4e423f064fa2e309ca719b9fe411ff17e667b6d7841e3cf09c46a75d2c09
Instruction ID: 79fe2e4830bbb60969cbe7f21f9fb0a02e6f594d754acb5b610f2f2668b1800e
Opcode Fuzzy Hash: aa8d4e423f064fa2e309ca719b9fe411ff17e667b6d7841e3cf09c46a75d2c09
Instruction Fuzzy Hash: A541C270B00204CFDB59DB7CC458A6DBBB2AF45B01B9584B9D50A9B272DB39DC02DB91

Function 00771CC0 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa033a70e62313420f11662dc7fdd0d49f99b7b192da2754e6ee4211a442335
Instruction ID: 04b1852cc0e2b3a7457146be22f73d5e5e8060359eb61593040265cb78f316a4
Opcode Fuzzy Hash: 0fa033a70e62313420f11662dc7fdd0d49f99b7b192da2754e6ee4211a442335
Instruction Fuzzy Hash: E241A134700205DFDB25EF69D85499E77B6FF88351B20C169E409CB269DB389D06CF51

Function 00770848 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48cceb6ca8df35fe1cc5f6f0dc4b69f087a7b887bffbde9d004e589a6c8bfb48
Instruction ID: 1ac0c2fb7d893bc5d75840eda2514db4c8993e1e8578154a31ad5c1766f071ca
Opcode Fuzzy Hash: 48cceb6ca8df35fe1cc5f6f0dc4b69f087a7b887bffbde9d004e589a6c8bfb48
Instruction Fuzzy Hash: 5F418070A00208DFDB05EBB8E894B9D7BB6FF84300F10C569E109AB255DB78AD85CB95

Function 00771B78 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6a0a9dfef00d5fb22ac2b69f1045e18580176c90d0b7f9dd90ce6288893c82
Instruction ID: 6ddcec847a4aa120f6fb55b9f43fa29c3253e812aeaccb96992e1b87d8c26619
Opcode Fuzzy Hash: 9d6a0a9dfef00d5fb22ac2b69f1045e18580176c90d0b7f9dd90ce6288893c82
Instruction Fuzzy Hash: D6213D70B40115CFCB58EFB8C49896D77B2AF48711B6044A9D50ADB371DB39DD02CB90

Function 00771C73 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711744e55ae33b1d158c67f1383950ab2e542f30b53c72ea82943dbec28ca242
Instruction ID: 8abe2fce63259a8dabdcc1b018e67e6d229f5596f025e578a6678c6e38b58a87
Opcode Fuzzy Hash: 711744e55ae33b1d158c67f1383950ab2e542f30b53c72ea82943dbec28ca242
Instruction Fuzzy Hash: CA119074740111CFDB19EBA8D8989AD77B2AF48714B1180D8D50ADF3B2DB39ED028B90

Function 00776060 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9436f760d8c50189dbdac041e4184fce9c2c0018568c23c90749a06625f318
Instruction ID: 0d5f883c3e0bebce96d368cd3d81a9d07aabcc2c737202ec2899a937a1fa0717
Opcode Fuzzy Hash: fc9436f760d8c50189dbdac041e4184fce9c2c0018568c23c90749a06625f318
Instruction Fuzzy Hash: 941125B1D047496FCB259B799C08B9E7FAAEB86310F0141ADD0189B282EF795905C791

Function 00774F48 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c9284ff95d488ef7bb01de8ec086f77929d65aeeb9cee4d3ed3e93187b44f9
Instruction ID: ecb319ab05c2aca13a25fbaf650bee95239c7db28478c47beeb4cde3330e3f16
Opcode Fuzzy Hash: c4c9284ff95d488ef7bb01de8ec086f77929d65aeeb9cee4d3ed3e93187b44f9
Instruction Fuzzy Hash: C9118F70A04258CBEF14EBBAC9547AE7BF6AF89340F148429D405B7384DF399D00DBA1

Function 00775218 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac387c84517d861d797704a9b7a422374ee4c270a2caee715b228e4d68c1e0b
Instruction ID: f4972375b3950a47840f92ba68e26198dbc2721d9841e419e34719d65b43b74f
Opcode Fuzzy Hash: cac387c84517d861d797704a9b7a422374ee4c270a2caee715b228e4d68c1e0b
Instruction Fuzzy Hash: 3F01F775700220CFD7295B39E85891A77EAAF9976131640F9E505DB376CE34EC0187A0

Function 00775228 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cc7e285aadcd582074f6879802b2246739af9caec4b0284e28062c56a8d130
Instruction ID: e25df7ae41865795560383abad371b6344e6b051854e2728e9d5bc59d2b642aa
Opcode Fuzzy Hash: 70cc7e285aadcd582074f6879802b2246739af9caec4b0284e28062c56a8d130
Instruction Fuzzy Hash: 11F0A472710120CFD728AB3DE48881A77EEAF89B6131140B9E905DB330CA35EC018BE0

Function 00770AA8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1497cb16ddc57f41608c83cc8c9144f0a4be67a7b81141b3c35298af39ff269
Instruction ID: 8a876ffd275fa626bc2c6dae839d78c968b600df413d6d325535da1f07ea9170
Opcode Fuzzy Hash: d1497cb16ddc57f41608c83cc8c9144f0a4be67a7b81141b3c35298af39ff269
Instruction Fuzzy Hash: 46F06D307007508BCB24A7B4AC6873A365AAB40794F46C46DAA0AC32A5DEB9DC81C7D4

Function 00775139 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02415d2a2b18c8ade96df5a6c8d75fe0926575be106f99f3cc734cbab90d1617
Instruction ID: 6e875dfebd8bd5d4c944438a0e76efeeb26d02cfd089840cda593fdc621e98ee
Opcode Fuzzy Hash: 02415d2a2b18c8ade96df5a6c8d75fe0926575be106f99f3cc734cbab90d1617
Instruction Fuzzy Hash: 29F024323052406FC3159B24EC64A5A7BAAEBCA321B19817AE449C72A2DA384C028760

Function 00774B34 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26cd4d3e07b18a4d265b063fe2eaaee38d13a22ec4ff6d5303078e54b5578e8
Instruction ID: ce2d78cf86501c7ea0d06216f516a13fc8d3caf75fb4551655faedabb2977137
Opcode Fuzzy Hash: b26cd4d3e07b18a4d265b063fe2eaaee38d13a22ec4ff6d5303078e54b5578e8
Instruction Fuzzy Hash: D6F0F071909244EFDB01CBF5A8440ECBFB1EF82300B54C0EAD05A87261EB788645CB51

Function 00775148 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3bf808b9dbe939f0cac947a5a71a951cccb8ca353119b569ac4396b2466841
Instruction ID: 8a71e722b8ec525a20b69a4ae761ea7b4ce3447e6be9faf909228e504b7cbda5
Opcode Fuzzy Hash: 2b3bf808b9dbe939f0cac947a5a71a951cccb8ca353119b569ac4396b2466841
Instruction Fuzzy Hash: EAE09232301204AFC314EB29EC9895AB7BAFBC93617548439E50AC3325DE399C0287A4

Function 007713B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f627fc1e856f3becbcda74deb071c77f0db636403e3ca2b4ecc828e4d6f199
Instruction ID: 769e63282006a97314c8424688a49627363a6d7f1babecd3283aaa7b5493f1dc
Opcode Fuzzy Hash: b4f627fc1e856f3becbcda74deb071c77f0db636403e3ca2b4ecc828e4d6f199
Instruction Fuzzy Hash: 4EF0F4B4600205CFDB24EF64D198A68B7B2FF88314F2084A8E40A8B3A1CB799802CF00

Function 00770F28 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8945dddd1db925645b68ebfc1ea43a3a4b87f301c18d37374b80312f875770
Instruction ID: d646997f3f4d265f6b71702cdbb5ef133450e460eeb380689b75016451650f27
Opcode Fuzzy Hash: 4b8945dddd1db925645b68ebfc1ea43a3a4b87f301c18d37374b80312f875770
Instruction Fuzzy Hash: 58E09271909248EFCB11DFB4ED11A5CBFB5DB07350F1682DAD84CD71A2EA346E018751

Function 00770F38 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1638504147.0000000000770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_770000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c85b08da04eb3382f50451cb189f1f20a64000e3c6ebf0391a13e6f9172a6d
Instruction ID: c167f05e9fef407dd087b8df31e5fbcf374e07bd552eed851cb07779b7df75f7
Opcode Fuzzy Hash: d2c85b08da04eb3382f50451cb189f1f20a64000e3c6ebf0391a13e6f9172a6d
Instruction Fuzzy Hash: DFD01771E00208EF8B00EFB8E94559DBBF9EB48310F2081A9950CD3210EA35AF009B81

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report qBtDOzhQnS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_qBtDOzhQnS.exe_61834c8bbb89331017ec34ae3ed187d76665b41_0168f847_0495cdc9-a3cb-4a91-88c9-dbd64baaf92c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA14.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD80.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE1E.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Honda.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

C:\Users\user\AppData\Local\Temp\Honda\Honda.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_b15445d604f64b66a25f8010e88b0dd0.lnk

C:\Windows\appcompat\Programs\Amcache.hve

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
qBtDOzhQnS.exe

Function 00E82F7C Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Function 00E9C9D4 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Function 00E9DDAA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00E9762C Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 00E9D9AE Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Function 00E857E2 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON