Edit tour

Windows Analysis Report
papercut-hive.exe

Overview

General Information

Sample name:	papercut-hive.exe
Analysis ID:	1542234
MD5:	7253bd3220cd819a8c822ebcfbd03ded
SHA1:	6fd8e9384b4a7f1239505c7dcd034be810979ab7
SHA256:	dc9a1d2826175fd74c92ad9f842eddc80c9ff593770dbbf7ed4f2d9690f2e70c
Infos:

Detection

Score:	26
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Sigma detected: rundll32 run dll from internet

Uses netstat to query active network connections and open ports

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Creates a process in suspended mode (likely to inject code)

Creates files inside the driver directory

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

papercut-hive.exe (PID: 1400 cmdline: "C:\Users\user\Desktop\papercut-hive.exe" MD5: 7253BD3220CD819A8C822EBCFBD03DED)

papercut-hive.tmp (PID: 6172 cmdline: "C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp" /SL5="$1047A,31229352,845824,C:\Users\user\Desktop\papercut-hive.exe" MD5: 6F986EF33F81F6A1000EEAF12445651D)

cmd.exe (PID: 6644 cmdline: "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""netstat" -anb > "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\~execwithresult.txt"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

NETSTAT.EXE (PID: 5804 cmdline: "netstat" -anb MD5: 7FDDD6681EA81CE26E64452336F479E6)

cmd.exe (PID: 6480 cmdline: "C:\Windows\system32\cmd.exe" /C wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value > "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\antivirus-info.log" 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 2820 cmdline: wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

taskkill.exe (PID: 6688 cmdline: "taskkill.exe" /f /im "pc-print-client-service.exe" MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 1048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5384 cmdline: "taskkill.exe" /f /im "pc-print-client.exe" MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 408 cmdline: "net.exe" start spooler MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

conhost.exe (PID: 4204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net1.exe (PID: 6220 cmdline: C:\Windows\system32\net1 start spooler MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

pc-print-client.exe (PID: 6764 cmdline: "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe" -installPrintQueue -printerId="PaperCut Printer" -printerName="PaperCut Printer" "-driverFilePath=C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf" -logFile="C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log" MD5: F65100B9805BF914F9F77AA08566AFAB)

rundll32.exe (PID: 2452 cmdline: rundll32.exe printui.dll,PrintUIEntry /ia /m "PaperCut Global PostScript - NTNS" /f C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf /u MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6588 cmdline: rundll32.exe printui.dll,PrintUIEntry /y /if /b "PaperCut Printer" /x /n "PaperCut Printer" /m "PaperCut Global PostScript - NTNS" /r http://localhost:9265/printers/papercutpocket /u /q MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1268 cmdline: rundll32.exe printui.dll,PrintUIEntry /q /y /n "PaperCut Printer" MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4448 cmdline: rundll32.exe printui.dll,PrintUIEntry /q /Sr /n "PaperCut Printer" /a C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\printer-settings.bin p h i r g u d c 2 MD5: EF3179D498793BF4234F708D3BE28633)

drvinst.exe (PID: 5136 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\pcglobal.inf" "9" "48fde5adf" "000000000000015C" "WinSta0\Default" "0000000000000144" "208" "c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-global-print-driver" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

PrintIsolationHost.exe (PID: 3176 cmdline: C:\Windows\system32\PrintIsolationHost.exe -Embedding MD5: 6770F8087D1E082ACFCF610CD078CDC6)

cleanup

Sigma Signatures

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: "net.exe" start spooler, CommandLine: "net.exe" start spooler, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp" /SL5="$1047A,31229352,845824,C:\Users\user\Desktop\papercut-hive.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp, ParentProcessId: 6172, ParentProcessName: papercut-hive.tmp, ProcessCommandLine: "net.exe" start spooler, ProcessId: 408, ProcessName: net.exe

Sigma detected: Start Windows Service Via Net.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "net.exe" start spooler, CommandLine: "net.exe" start spooler, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp" /SL5="$1047A,31229352,845824,C:\Users\user\Desktop\papercut-hive.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp, ParentProcessId: 6172, ParentProcessName: papercut-hive.tmp, ProcessCommandLine: "net.exe" start spooler, ProcessId: 408, ProcessName: net.exe

Data Obfuscation

Sigma detected: rundll32 run dll from internet

Source: Process started

Author: Joe Security: Data: Command: rundll32.exe printui.dll,PrintUIEntry /y /if /b "PaperCut Printer" /x /n "PaperCut Printer" /m "PaperCut Global PostScript - NTNS" /r http://localhost:9265/printers/papercutpocket /u /q, CommandLine: rundll32.exe printui.dll,PrintUIEntry /y /if /b "PaperCut Printer" /x /n "PaperCut Printer" /m "PaperCut Global PostScript - NTNS" /r http://localhost:9265/printers/papercutpocket /u /q, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe" -installPrintQueue -printerId="PaperCut Printer" -printerName="PaperCut Printer" "-driverFilePath=C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf" -logFile="C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log", ParentImage: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe, ParentProcessId: 6764, ParentProcessName: pc-print-client.exe, ProcessCommandLine: rundll32.exe printui.dll,PrintUIEntry /y /if /b "PaperCut Printer" /x /n "PaperCut Printer" /m "PaperCut Global PostScript - NTNS" /r http://localhost:9265/printers/papercutpocket /u /q, ProcessId: 6588, ProcessName: rundll32.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: papercut-hive.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	File created: C:\Users\user\AppData\Local\Temp\Setup Log 2024-10-25 #001.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log			Jump to behavior

Source: papercut-hive.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 104.119.110.121:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.210.172:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.214.120:443 -> 192.168.2.5:56558 version: TLS 1.2

Source: papercut-hive.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb source: vcredist_x64.exe.2.dr
Source:	Binary string: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb4 source: vcredist_x64.exe.2.dr

Networking

Uses netstat to query active network connections and open ports

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\NETSTAT.EXE "netstat" -anb

Source: Joe Sandbox View	IP Address: 104.119.110.121 104.119.110.121
Source: Joe Sandbox View	IP Address: 199.232.210.172 199.232.210.172

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /vs/17/release/vc_redist.x64.exe HTTP/1.1Accept: /User-Agent: InnoDownloadPlugin/1.5Host: aka.msConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/pr/368cc6bf-087b-49f9-93e6-ab05b70a58e0/814E9DA5EC5E5D6A8FA701999D1FC3BADDF7F3ADC528E202590E9B1CB73E4A11/VC_redist.x64.exe HTTP/1.1Accept: /User-Agent: InnoDownloadPlugin/1.5Connection: Keep-AliveCache-Control: no-cacheHost: download.visualstudio.microsoft.com
Source: global traffic	HTTP traffic detected: GET /files/open-source/ghost-trap/ghost-trap-installer-1.5.10.03.exe HTTP/1.1Accept: /User-Agent: InnoDownloadPlugin/1.5Host: cdn1.papercut.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: aka.ms
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 197.87.175.4.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: cdn1.papercut.com
Source: global traffic	DNS traffic detected: DNS query: pmitc.papercut.com

Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://127.0.0.1:9263image:
Source: vcredist_x64.exe.2.dr	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationc:
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://bourbon.io
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crt0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0N
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: pc-print-client.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG3CodeSigningECCSHA3842021CA1.crl0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: pc-print-client.exe, 00000012.00000002.2631688601.000000C000020000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://localhostus-genesisstaginggngkernel32.dllC:
Source: pc-print-client.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0W
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: papercut-hive.exe, 00000000.00000003.2707442358.0000000001836000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.00000000030B6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.papercut.com/
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.papercut.com/0http://www.papercut.com/0http://www.papercut.com/
Source: papercut-hive.tmp, 00000002.00000003.2702866559.00000000030B6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.papercut.com/Yk
Source: pc-print-client.exe, 00000012.00000002.2631688601.000000C000022000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://.papercusoftwarehttp://lus-genestesttstau-stagitemplate
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://127.0.0.1:9266idna:
Source: papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/
Source: papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/YoS(&
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2704291741.00000000015A7000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.0000000004230000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe
Source: papercut-hive.tmp, 00000002.00000002.2705901345.0000000001595000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe4
Source: papercut-hive.tmp, 00000002.00000003.2698392651.0000000004015000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe==
Source: papercut-hive.tmp, 00000002.00000002.2705901345.0000000001595000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exeH
Source: papercut-hive.tmp, 00000002.00000003.2698392651.0000000004015000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exet))
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://au-staging.pmitc.papercut.softwareinsufficient
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://au.pmitc.papercut.comhttps://eu.pmitc.papercut.comhttps://uk.pmitc.papercut.cominteger
Source: papercut-hive.tmp, 00000002.00000002.2706959213.0000000006650000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn1.papercut.com/
Source: papercut-hive.tmp, 00000002.00000003.2704291741.00000000015C8000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.0000000004230000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2698392651.0000000004015000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn1.papercut.com/files/open-source/ghost-trap/ghost-trap-installer-1.5.10.03.exe
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Barlow:ital
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlow/v12/7cHpv4kjgoGqM7E_DMs8.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E30-8s51op.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3j-ws51op.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v30/u-440qyriQwlOrhSvowK_l5-fCZJ.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v30/u-4n0qyriQwlOrhSvowK_l52xwNZWMf_.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcecodepro/v22/HI_diYsKILxRpg3hIP6sJ7fM7PqPMcMnZFqUwX28DMyQtMlrSQ.ttf
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v21/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDc.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7g.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v21/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCds18E.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdr.ttf)
Source: papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdr.ttf)
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.000000000428D000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000002FEA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/PaperCutSoftware/GhostTrap
Source: papercut-hive.tmp, 00000002.00000003.2702866559.0000000002FEA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/PaperCutSoftware/GhostTrapn;
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.000000000423A000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://installer-downloader-dot-pc-pmitc.appspot.com/public/installer-downloader/upload-installer-l
Source: papercut-hive.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: pc-print-client.exe, 00000012.00000002.2631688601.000000C0000FF000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2631688601.000000C0000CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://multiverse.papercut.com
Source: pc-print-client.exe, 00000012.00000002.2631688601.000000C0000FF000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2631688601.000000C0000CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://multiverse.papercut.software
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://pc-pmitc.appspot.com//print-client/secure/printclient-gateway/org/%s/upload-support-logs/v1c
Source: pc-print-client.exe, 00000012.00000002.2631688601.000000C000022000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pmitc.papercut.com/
Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	String found in binary or memory: https://protobuf.dev/reference/go/faq#namespace-conflictin
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F0DB000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000000.2094710725.0000000000B01000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.000000000429C000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.papercut.com/kb/PaperCutPocketHive/PrinterInstallerIssue#portconflict
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003064000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.papercut.com/kb/PaperCutPocketHive/PrinterInstallerIssue#services
Source: papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003064000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.papercut.com/kb/PaperCutPocketHive/PrinterInstallerIssue#win
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F0DB000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000000.2094710725.0000000000B01000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56558
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443

Source: unknown	HTTPS traffic detected: 104.119.110.121:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.210.172:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.214.120:443 -> 192.168.2.5:56558 version: TLS 1.2

Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: Server 2008 R2 Server 2012 R2 is unavailable not a function()<>@,;:\"/[]?=(Get-Resources),M3.2.0,M11.1.0/manual-link/v10601021504Z0700400 Bad Request476837158203125: cannot parse : no frame (sp=<invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAcknowledge-JobAddDllDirectoryCLSIDFromStringCallWindowProcWCancel-DocumentCardinality(%d)ClientAuthType(ContainingOneofCreateHardLinkWCreatePopupMenuCreateWindowExWDelete-DocumentDeviceIoControlDiacriticalDot;DialogBoxParamWDisable-PrinterDoubleRightTee;DownLeftVector;DragAcceptFilesDrawThemeTextExDuplicateHandleExcludeClipRectExtensionRangesFailed to find Failed to load FindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGdiplusShutdownGetActiveWindowGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetDpiForWindowGetEnhMetaFileWGetModuleHandleGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWGetThreadLocaleGreaterGreater;HalfClosedLocalHanifi_RohingyaHorizontalLine;Idempotency-KeyImpersonateSelfInsertMenuItemWInvisibleComma;InvisibleTimes;IsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2LeftDownVector;LeftRightArrow;Leftrightarrow;Length RequiredLessSlantEqual;LongRightArrow;Longrightarrow;LowerLeftArrow;MoveToEx failedNTSTATUS 0x%08xNestedLessLess;Not ImplementedNotGreaterLess;NotLessGreater;NotSubsetEqual;NotTrueTypeFontNotVerticalBar;OleUninitializeOpEnablePrinterOpFetchDocumentOpResumePrinterOpenCurlyQuote;OpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512PaperCut PocketPartial ContentPlayEnhMetaFilePolyline failedPostQuitMessageProcess32FirstWProfileNotFoundPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRegisterClassExRequest TimeoutRequiredNumbersRestart-PrinterReverseElement;RightTeeVector;RightVectorBar;RtlDefaultNpAclSetActiveWindowSetCommTimeoutsSetSecurityInfoSetVolumeLabelWSetWinEventHookShortDownArrow;ShortLeftArrow;SquareSuperset;Startup-PrinterStatusErrorBusyStatusErrorGoneStringFromGUID2TildeFullEqual;TrackMouseEventTrigger backoffUnknown name=%qUnmapViewOfFileUpperLeftArrow;WTSConnectQueryWTSDisconnectedWindowFromPointX-Forwarded-ForX-Frame-OptionsZeroWidthSpace;]

memstr_f5122bf8-8

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\pcglobal.cat	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\pcglobal.cat (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\SETF9EB.tmp	Jump to dropped file

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}

Jump to behavior

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\pcglobal.inf_amd64_c520b12f50e0cc2f	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf	Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe	File created: C:\Windows\system32\spool\DRIVERS\x64\3\pcntns.BPD	Jump to behavior

Source: C:\Windows\System32\drvinst.exe

File deleted: C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\SETF9DB.tmp

Jump to behavior

Source: papercut-hive.tmp.0.dr

Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: papercut-hive.tmp.0.dr	Static PE information: Number of sections : 11 > 10
Source: papercut-hive.exe	Static PE information: Number of sections : 11 > 10
Source: ghost-trap-installer-1.5.10.03.exe.2.dr	Static PE information: Number of sections : 11 > 10

Source: papercut-hive.exe, 00000000.00000000.2090959358.0000000000589000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs papercut-hive.exe
Source: papercut-hive.exe, 00000000.00000003.2093280982.000000007F3DA000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs papercut-hive.exe
Source: papercut-hive.exe, 00000000.00000003.2092843159.00000000035EE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs papercut-hive.exe
Source: papercut-hive.exe	Binary or memory string: OriginalFileName vs papercut-hive.exe

Source: papercut-hive.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: sus26.troj.evad.winEXE@36/40@5/5

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4204:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6544:120:WilError_03

Source: C:\Users\user\Desktop\papercut-hive.exe

File created: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe

File opened: C:\Windows\system32\510ddcc02339e45e163cfab24ac57aa1131fc43941a0fcdf5aeac7654ae0ddfcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: C:\Users\user\Desktop\papercut-hive.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\papercut-hive.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "pc-print-client-service.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "pc-print-client.exe")

Source: C:\Users\user\Desktop\papercut-hive.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /ia /m "PaperCut Global PostScript - NTNS" /f C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf /u

Source: taskkill.exe, 0000000D.00000002.2553023259.0000020158625000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "pc-print-client.exe");

Source: papercut-hive.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\papercut-hive.exe

File read: C:\Users\user\Desktop\papercut-hive.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\papercut-hive.exe "C:\Users\user\Desktop\papercut-hive.exe"
Source: C:\Users\user\Desktop\papercut-hive.exe	Process created: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp "C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp" /SL5="$1047A,31229352,845824,C:\Users\user\Desktop\papercut-hive.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""netstat" -anb > "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\~execwithresult.txt""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE "netstat" -anb
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value > "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\antivirus-info.log" 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Windows\System32\taskkill.exe "taskkill.exe" /f /im "pc-print-client-service.exe"
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Windows\System32\taskkill.exe "taskkill.exe" /f /im "pc-print-client.exe"
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Windows\System32\net.exe "net.exe" start spooler
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start spooler
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe" -installPrintQueue -printerId="PaperCut Printer" -printerName="PaperCut Printer" "-driverFilePath=C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf" -logFile="C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log"
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /ia /m "PaperCut Global PostScript - NTNS" /f C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf /u
Source: unknown	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\pcglobal.inf" "9" "48fde5adf" "000000000000015C" "WinSta0\Default" "0000000000000144" "208" "c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-global-print-driver"
Source: unknown	Process created: C:\Windows\System32\PrintIsolationHost.exe C:\Windows\system32\PrintIsolationHost.exe -Embedding
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /y /if /b "PaperCut Printer" /x /n "PaperCut Printer" /m "PaperCut Global PostScript - NTNS" /r http://localhost:9265/printers/papercutpocket /u /q
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /q /y /n "PaperCut Printer"
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /q /Sr /n "PaperCut Printer" /a C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\printer-settings.bin p h i r g u d c 2
Source: C:\Users\user\Desktop\papercut-hive.exe	Process created: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp "C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp" /SL5="$1047A,31229352,845824,C:\Users\user\Desktop\papercut-hive.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""netstat" -anb > "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\~execwithresult.txt""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value > "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\antivirus-info.log" 2>&1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Windows\System32\taskkill.exe "taskkill.exe" /f /im "pc-print-client-service.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Windows\System32\taskkill.exe "taskkill.exe" /f /im "pc-print-client.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Windows\System32\net.exe "net.exe" start spooler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe" -installPrintQueue -printerId="PaperCut Printer" -printerName="PaperCut Printer" "-driverFilePath=C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf" -logFile="C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE "netstat" -anb	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start spooler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /ia /m "PaperCut Global PostScript - NTNS" /f C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf /u	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /y /if /b "PaperCut Printer" /x /n "PaperCut Printer" /m "PaperCut Global PostScript - NTNS" /r http://localhost:9265/printers/papercutpocket /u /q	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /q /y /n "PaperCut Printer"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /q /Sr /n "PaperCut Printer" /a C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\printer-settings.bin p h i r g u d c 2	Jump to behavior

Source: C:\Users\user\Desktop\papercut-hive.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\papercut-hive.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: snmpapi.dll	Jump to behavior
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: inetmib1.dll	Jump to behavior
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe	Section loaded: printisolationproxy.dll	Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe	Section loaded: spoolss.dll	Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe	Section loaded: coloradapterclient.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Automated click: OK

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: papercut-hive.exe

Static PE information: certificate valid

Source: papercut-hive.exe

Static file information: File size 32219600 > 1048576

Source: papercut-hive.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb source: vcredist_x64.exe.2.dr
Source:	Binary string: C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb4 source: vcredist_x64.exe.2.dr

Source: papercut-hive.exe	Static PE information: section name: .didata
Source: papercut-hive.tmp.0.dr	Static PE information: section name: .didata
Source: vcredist_x64.exe.2.dr	Static PE information: section name: .wixburn
Source: ghost-trap-installer-1.5.10.03.exe.2.dr	Static PE information: section name: .didata
Source: pc-print-client.exe.2.dr	Static PE information: section name: .symtab

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Code function: 2_3_01580459 push es; iretd	2_3_01580474
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Code function: 2_3_0157C451 push es; iretd	2_3_0157C46C
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Code function: 2_3_01580455 push es; ret	2_3_01580458
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Code function: 2_3_0157C44D push es; ret	2_3_0157C450
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Code function: 2_3_01580505 push es; ret	2_3_01580508
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Code function: 2_3_0157C4FD push es; ret	2_3_0157C500

Source: C:\Users\user\Desktop\papercut-hive.exe	File created: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\ghost-trap-installer-1.5.10.03.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\idp.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	File created: C:\Users\user\AppData\Local\Temp\Setup Log 2024-10-25 #001.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	File created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log			Jump to behavior

Source: C:\Users\user\Desktop\papercut-hive.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\PrintIsolationHost.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\ghost-trap-installer-1.5.10.03.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\idp.dll	Jump to dropped file

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: papercut-hive.tmp, 00000002.00000003.2704291741.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9
Source: NETSTAT.EXE, 00000005.00000002.2099596498.000002242FBD9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%
Source: papercut-hive.tmp, papercut-hive.tmp, 00000002.00000003.2704291741.00000000015D0000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: pc-print-client.exe, 00000012.00000002.2644780329.0000016A8896C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\NETSTAT.EXE	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\NETSTAT.EXE	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE "netstat" -anb	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start spooler	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /ia /m "PaperCut Global PostScript - NTNS" /f C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf /u	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /y /if /b "PaperCut Printer" /x /n "PaperCut Printer" /m "PaperCut Global PostScript - NTNS" /r http://localhost:9265/printers/papercutpocket /u /q	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /q /y /n "PaperCut Printer"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe printui.dll,PrintUIEntry /q /Sr /n "PaperCut Printer" /a C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\printer-settings.bin p h i r g u d c 2	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Windows\System32\taskkill.exe "taskkill.exe" /f /im "pc-print-client-service.exe"			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Windows\System32\taskkill.exe "taskkill.exe" /f /im "pc-print-client.exe"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe "c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-print-client.exe" -installprintqueue -printerid="papercut printer" -printername="papercut printer" "-driverfilepath=c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-global-print-driver\pcglobal.inf" -logfile="c:\users\user\appdata\local\temp\is-b2r1d.tmp\queue_install.log"
Source: unknown	Process created: C:\Windows\System32\drvinst.exe drvinst.exe "4" "0" "c:\users\user\appdata\local\temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\pcglobal.inf" "9" "48fde5adf" "000000000000015c" "winsta0\default" "0000000000000144" "208" "c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-global-print-driver"
Source: C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe "c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-print-client.exe" -installprintqueue -printerid="papercut printer" -printername="papercut printer" "-driverfilepath=c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-global-print-driver\pcglobal.inf" -logfile="c:\users\user\appdata\local\temp\is-b2r1d.tmp\queue_install.log"	Jump to behavior

Source: papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr

Binary or memory string: %s, gp->status=, not pointer-byte block (3814697265625403 Forbidden: unknown pc <unknown: %T>Accept-RangesAnimateWindowAuthorizationBrowserSearchCLIENT_RANDOMCONNECT_ERRORCUPS-Get-PPDsCUPS-Move-JobCache-ControlCertOpenStoreCoTaskMemFreeContent-RangeCreateActCtxWCreateRectRgnDeleteServiceDestroyWindowDownArrowBar;DownTeeArrow;DrawFocusRectECDSAWithSHA1EndDocPrinterEnumPrintersWEnumProcessesExitWindowsExExponentialE;FQDN too longFindFirstFileFindNextFileWFindResourceWFreeAddrInfoWGC sweep waitGet-DocumentsGetClassNameWGetClientRectGetDeviceCapsGetDriveTypeWGetScrollInfoGetSystemMenuGetThemeColorGetWindowLongGetWindowRectGreaterEqual;GreaterTilde;Gunjala_GondiHanja / KanjiHilbertSpace;Hold-New-JobsHumpDownHump;If-None-MatchImageList_AddIntersection;IsPlaceholderJWS holds JWEKana / HangulLast-ModifiedLeftArrowBar;LeftTeeArrow;LeftTriangle;LeftUpVector;LineTo failedLoop DetectedMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWNotCongruent;NotHumpEqual;NotLessEqual;NotLessTilde;Old_HungarianOleInitializeOpCupsGetPpdsOpCupsMoveJobOpHoldNewJobsOpResubmitJobOpValidateJobOpenClipboardOpenThemeDataPKCS1WithSHA1PaperCut HivePause-PrinterPdhCloseQueryPrinterID: %qProportional;RegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWReprocess-JobReservedNamesReset ContentRightCeiling;RoundImplies;RtlGetVersionRtlInitStringRtlMoveMemorySHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSSSTREAM_CLOSEDSend-DocumentSetBrushOrgExSetScrollInfoSetWindowLongShellExecuteWShell_TrayWndShortUpArrow;SquareSubset;StartServiceWSysFreeStringThread32FirstUnderBracket;Unknown panicUsage of %s:

Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\pcglobal.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\pcglobal.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: papercut-hive.tmp, 00000002.00000003.2702866559.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.0000000004229000.00000004.00001000.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2110858859.000001E21B9A1000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2111694641.000001E21B803000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2111760335.000001E21B806000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2110642425.000001E21B7F9000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000002.2112382243.000001E21BA9B000.00000004.00000020.00020000.00000000.sdmp, antivirus-info.log.6.dr	Binary or memory string: pathToSignedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: WMIC.exe, 00000008.00000002.2112382243.000001E21BA9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gnedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: WMIC.exe, 00000008.00000002.2112238830.000001E21B7D8000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000002.2112099275.000001E21B7B7000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2110743546.000001E21B7D7000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2110801990.000001E21B7E5000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2111398787.000001E21B97C000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2111773868.000001E21B7B7000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000003.2110642425.000001E21B7B2000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000008.00000002.2112263295.000001E21B7E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	2 Masquerading	11 Input Capture	21 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	2 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	1 System Network Connections Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
papercut-hive.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\ghost-trap-installer-1.5.10.03.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\idp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\vcredist_x64.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.bohemiancoding.com/sketch	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://www.innosetup.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
d1d4ywpuwg1f9b.cloudfront.net	52.222.214.120	true	false	unknown
aka.ms	104.119.110.121	true	false	unknown
pmitc.papercut.com	34.111.87.71	true	false	unknown
cdn1.papercut.com	unknown	unknown	false	unknown
198.187.3.20.in-addr.arpa	unknown	unknown	false	unknown
197.87.175.4.in-addr.arpa	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://aka.ms/vs/17/release/vc_redist.x64.exe	false		unknown
https://cdn1.papercut.com/files/open-source/ghost-trap/ghost-trap-installer-1.5.10.03.exe	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/PaperCutSoftware/GhostTrapn;	papercut-hive.tmp, 00000002.00000003.2702866559.0000000002FEA000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	papercut-hive.exe	false		unknown
https://aka.ms/vs/17/release/vc_redist.x64.exe==	papercut-hive.tmp, 00000002.00000003.2698392651.0000000004015000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.papercut.com/	papercut-hive.exe, 00000000.00000003.2707442358.0000000001836000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.00000000030B6000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://.papercusoftwarehttp://lus-genestesttstau-stagitemplate	pc-print-client.exe, 00000012.00000002.2631688601.000000C000022000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.bohemiancoding.com/sketch	papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	false	URL Reputation: safe	unknown
https://protobuf.dev/reference/go/faq#namespace-conflictin	papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	false		unknown
https://pc-pmitc.appspot.com//print-client/secure/printclient-gateway/org/%s/upload-support-logs/v1c	papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	false		unknown
https://aka.ms/YoS(&	papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://127.0.0.1:9263image:	papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	false		unknown
https://www.papercut.com/kb/PaperCutPocketHive/PrinterInstallerIssue#portconflict	papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.000000000429C000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://aka.ms/vs/17/release/vc_redist.x64.exeH	papercut-hive.tmp, 00000002.00000002.2705901345.0000000001595000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/	papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/vs/17/release/vc_redist.x64.exet))	papercut-hive.tmp, 00000002.00000003.2698392651.0000000004015000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.papercut.com/kb/PaperCutPocketHive/PrinterInstallerIssue#win	papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003064000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://appsyndication.org/2006/appsynapplicationc:	vcredist_x64.exe.2.dr	false		unknown
https://multiverse.papercut.com	pc-print-client.exe, 00000012.00000002.2631688601.000000C0000FF000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2631688601.000000C0000CC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://multiverse.papercut.software	pc-print-client.exe, 00000012.00000002.2631688601.000000C0000FF000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2631688601.000000C0000CC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.remobjects.com/ps	papercut-hive.exe, 00000000.00000003.2093280982.000000007F0DB000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000000.2094710725.0000000000B01000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
http://localhostus-genesisstaginggngkernel32.dllC:	pc-print-client.exe, 00000012.00000002.2631688601.000000C000020000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://au-staging.pmitc.papercut.softwareinsufficient	papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	false		unknown
https://www.innosetup.com/	papercut-hive.exe, 00000000.00000003.2093280982.000000007F0DB000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2092843159.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000000.2094710725.0000000000B01000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://www.papercut.com/kb/PaperCutPocketHive/PrinterInstallerIssue#services	papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003064000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://pmitc.papercut.com/	pc-print-client.exe, 00000012.00000002.2631688601.000000C000022000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://au.pmitc.papercut.comhttps://eu.pmitc.papercut.comhttps://uk.pmitc.papercut.cominteger	papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	false		unknown
https://aka.ms/vs/17/release/vc_redist.x64.exe4	papercut-hive.tmp, 00000002.00000002.2705901345.0000000001595000.00000004.00000020.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2704291741.0000000001590000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://bourbon.io	papercut-hive.tmp, 00000002.00000003.2698494496.00000000044B5000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	false		unknown
https://127.0.0.1:9266idna:	papercut-hive.tmp, 00000002.00000003.2698494496.0000000004310000.00000004.00001000.00020000.00000000.sdmp, pc-print-client.exe, 00000012.00000002.2630254047.0000000000F85000.00000002.00000001.01000000.0000000A.sdmp, pc-print-client.exe.2.dr	false		unknown
http://www.papercut.com/Yk	papercut-hive.tmp, 00000002.00000003.2702866559.00000000030B6000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://cdn1.papercut.com/	papercut-hive.tmp, 00000002.00000002.2706959213.0000000006650000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.papercut.com/0http://www.papercut.com/0http://www.papercut.com/	papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/PaperCutSoftware/GhostTrap	papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.000000000428D000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000002FEA000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://installer-downloader-dot-pc-pmitc.appspot.com/public/installer-downloader/upload-installer-l	papercut-hive.exe, 00000000.00000003.2091285016.00000000034D0000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.exe, 00000000.00000003.2707442358.00000000017E3000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702866559.0000000003007000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2702370361.000000000423A000.00000004.00001000.00020000.00000000.sdmp, papercut-hive.tmp, 00000002.00000003.2096649458.0000000003F90000.00000004.00001000.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.222.214.120	d1d4ywpuwg1f9b.cloudfront.net	United States	16509	AMAZON-02US	false
34.111.87.71	pmitc.papercut.com	United States	15169	GOOGLEUS	false
104.119.110.121	aka.ms	United States	16625	AKAMAI-ASUS	false
199.232.210.172	fg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542234
Start date and time:	2024-10-25 17:23:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	papercut-hive.exe
Detection:	SUS
Classification:	sus26.troj.evad.winEXE@36/40@5/5
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): download.visualstudio.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, visualstudio-geo.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target papercut-hive.tmp, PID 6172 because there are no executed function
Execution Graph export aborted for target pc-print-client.exe, PID 6764 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: papercut-hive.exe

Simulations

Behavior and APIs

Time	Type	Description
11:24:05	API Interceptor	1x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.119.110.121	vs_BuildTools.zip	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Malware-gen.31578.13203.exe	Get hash	malicious	Unknown	Browse
	Axactor Microsoft - Introduksjonsm#U00f8te.msg	Get hash	malicious	EvilProxy	Browse
	vs_Professional.exe	Get hash	malicious	Unknown	Browse
	https://emails.microsoft.com/dc/zSgS2A6q0riGfHtfc6vB4o2EDiQ6lN3O6qiMomONyUJ0HsQ2sZIsMh689GSSYbTLO3mCkWaodie4MAOslvNCWW_9a3plE0P-Ez0LQY78TZmDPHuwNSWhLFzTYMtoZfimsqDGDjfg-w-v-HUlOmaZvGFLFwxVF_4UkVJu8KOKwPs=/MTU3LUdRRS0zODIAAAGVXXQTXko_YJBSIbQm_RlsGLlFgr2A-kJcbF9EmGwaO1zI2Do4ydFFpnBfqgMZYQyQQ3e8Go8=	Get hash	malicious	HTMLPhisher	Browse
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	Unknown	Browse
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	Unknown	Browse
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	Unknown	Browse
	http://pub-c00e6b233835461aa39db2b6b030abc8.r2.dev/bbb2.html	Get hash	malicious	HTMLPhisher	Browse
199.232.210.172	ALVARA-072.msi	Get hash	malicious	AteraAgent	Browse
	with you.eml	Get hash	malicious	Unknown	Browse
	roba.txt	Get hash	malicious	Meterpreter, ReflectiveLoader	Browse
	vs_BuildTools.zip	Get hash	malicious	Unknown	Browse
	https://firebasestorage.googleapis.com/v0/b/lecongtai-bb82b.appspot.com/o/16-10%2FCompilation%20of%20copyright-protected%20videos%20and%20images.zip?alt=media&token=c97d235f-3349-47aa-b756-15ecdbdf39b1	Get hash	malicious	Python Stealer, Braodo	Browse
	ordine.pdf	Get hash	malicious	Unknown	Browse
	Heritage Commercial Flooring.pdf	Get hash	malicious	Unknown	Browse
	https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail	Get hash	malicious	Unknown	Browse
	bc3c228ad2c13f96cb14375c3860e802.pdf	Get hash	malicious	Unknown	Browse
	original (1).eml	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
aka.ms	vs_BuildTools.zip	Get hash	malicious	Unknown	Browse	104.119.110.121
	XYrLOQoLE4.exe	Get hash	malicious	Unknown	Browse	2.17.1.249
	SecuriteInfo.com.Win64.Malware-gen.31578.13203.exe	Get hash	malicious	Unknown	Browse	104.119.110.121
	original.eml	Get hash	malicious	Tycoon2FA	Browse	92.122.18.57
	kUiqbpzmbo.exe	Get hash	malicious	XWorm	Browse	92.122.18.57
	Axactor Microsoft - Introduksjonsm#U00f8te.msg	Get hash	malicious	EvilProxy	Browse	104.119.110.121
	http://serviceappinfms12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	92.122.18.57
	vs_Professional.exe	Get hash	malicious	Unknown	Browse	104.119.110.121
	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	Unknown	Browse	2.22.34.124
	https://emails.microsoft.com/dc/zSgS2A6q0riGfHtfc6vB4o2EDiQ6lN3O6qiMomONyUJ0HsQ2sZIsMh689GSSYbTLO3mCkWaodie4MAOslvNCWW_9a3plE0P-Ez0LQY78TZmDPHuwNSWhLFzTYMtoZfimsqDGDjfg-w-v-HUlOmaZvGFLFwxVF_4UkVJu8KOKwPs=/MTU3LUdRRS0zODIAAAGVXXQTXko_YJBSIbQm_RlsGLlFgr2A-kJcbF9EmGwaO1zI2Do4ydFFpnBfqgMZYQyQQ3e8Go8=	Get hash	malicious	HTMLPhisher	Browse	104.119.110.121
fg.microsoft.map.fastly.net	vs_BuildTools.zip	Get hash	malicious	Unknown	Browse	199.232.210.172
	XYrLOQoLE4.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://r20.rs6.net/tn.jsp?t=ujqgb8abb.0.0.zumspjcab.0&id=preview&r=3&p=http%3A%2F%2Ffiles.constantcontact.com%2F99239f29001%2F765a22db-b453-4315-a344-dc2294500069.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	SecuriteInfo.com.Win64.Malware-gen.31578.13203.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://ig-leaks.github.io/insta_chat/instagram/	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	FATURALAR PDF.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	RLmUO7bibu.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://ecom.bio/88bmwbm?gad_source=1&gclid=Cj0KCQjwiuC2BhDSARIsALOVfBJ293HpuZvtJvhD8kPzmEW6CdE9kLYMBSVdTvNfgfsL__VlxT7t4s4aAiVuEALw_wcB	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	[EXT] [ #ENCRYPT ] WSRB 401k, Trustee to Trustee Transfer form.eml	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ldr_clp.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	104.102.49.254
	ldr_clp.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	3rd_cc_form_Oct_2024.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://developmentltd.online/	Get hash	malicious	Captcha Phish	Browse	2.19.126.219
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
FASTLYUS	file.exe	Get hash	malicious	Unknown	Browse	151.101.1.91
	file.exe	Get hash	malicious	Unknown	Browse	151.101.129.91
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Ffairwaygilbert.com%2Fnew%2FdtMyxOyre1WJ8xvj5DnN7kDa/Y2hyaXMuaGF3a2luc0BwZXJyeWhvbWVzLmNvbQ==	Get hash	malicious	Tycoon2FA	Browse	151.101.2.137
	file.exe	Get hash	malicious	Unknown	Browse	151.101.65.91
	file.exe	Get hash	malicious	Unknown	Browse	151.101.129.91
	https://pub-535a4999ab4b4c1e81647bad9b888e40.r2.dev/onedrivefresh.html	Get hash	malicious	Unknown	Browse	151.101.194.137
	Purchase Order 10-25-2024.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.129.46
	ALVARA-072.msi	Get hash	malicious	AteraAgent	Browse	199.232.210.172
	file.exe	Get hash	malicious	Unknown	Browse	151.101.129.91
	file.exe	Get hash	malicious	Unknown	Browse	151.101.193.91
AMAZON-02US	https://atpscan.global.hornetsecurity.com/?d=NnVkJrcOtS6jUcSOl6gFYT9DOTvhRx9_0n2vBuK3wGL4RfM1M4gwz-cei5V3Dmlh&f=VRGvOaKnOixCQPnN5E8Zd55sAVwpSzujOffY4RbLuwaxI18GkkIlhnlDIOqXjYsl&i=&k=IMq7&m=Eg31PQDiRU2Qx94y2dnGUum54tAMBzZzPaQN8QexaGJVzCG-OVPo4Om5V2lRlns7wwMWrL4CnmlsokgWfWk2TbD2kmpRAVDDTYG9PjUhZhfW-BwkapmD9W6_zQVWXFVN&n=KNtSaiODbNsJQEbSEZDwh34xn1itEQQfP1UznpoGI5WaWwC1dWtBevnqXGm5H-f7&r=2Ow9cKZ98a-5wptqW8Y-zAwN-MJuNt25fcQbqzqwDypDZl3_sT7dioYpzt-h-3hX&s=1f78a40d69089fa0743a8630bc133d18afc652a160161afdf52202844b072b54&u=https%3A%2F%2Ft.ly%2Fe_R6v	Get hash	malicious	Unknown	Browse	54.72.231.100
	19387759999PO-RFQ-INVOICE-doc.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Ffairwaygilbert.com%2Fnew%2FdtMyxOyre1WJ8xvj5DnN7kDa/Y2hyaXMuaGF3a2luc0BwZXJyeWhvbWVzLmNvbQ==	Get hash	malicious	Tycoon2FA	Browse	54.76.121.43
	Purchase Order 10-25-2024.pdf	Get hash	malicious	HTMLPhisher	Browse	52.32.117.27
	https://ipfox.co.uk/pages/thanks.html#RXJpay5Kb2huc29uQGFnLnN0YXRlLm1uLnVz	Get hash	malicious	Unknown	Browse	13.32.99.97
	https://mailengine.co/click_tracking?&redirectLink=http://embeds.beehiiv.com/d23df48a-754a-480b-9a5d-db66c2c46b92&source=email&ref=aa65ba1ae9f26d91fc495f31741706695402983&workflowInstance=65ba1aea0488580fac6abe1f&responseTemplate=630f7d144c49ff20dfe2b3c2&version=2	Get hash	malicious	Unknown	Browse	54.171.3.70
	ALVARA-072.msi	Get hash	malicious	AteraAgent	Browse	13.35.58.124
	main_mpsl.elf	Get hash	malicious	Mirai	Browse	54.247.62.1
	https://realestatemania.ca/kxyNao-7Ms6e-WBJnj-uMnVb-7gZJL-v8aOp.php	Get hash	malicious	Unknown	Browse	3.164.163.115
	https://developmentltd.online/	Get hash	malicious	Captcha Phish	Browse	13.33.187.74

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	52.222.214.120 104.119.110.121 199.232.210.172
	COMPROBANTE DE PAGO.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	52.222.214.120 104.119.110.121 199.232.210.172
	Justificante.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	52.222.214.120 104.119.110.121 199.232.210.172
	n#U00ba 7064-2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	52.222.214.120 104.119.110.121 199.232.210.172
	Factura 1-014685.pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	52.222.214.120 104.119.110.121 199.232.210.172
	PILNE ZAPYTANIE RFQ-05567-2024.10.25.vbs	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	52.222.214.120 104.119.110.121 199.232.210.172
	Factura n#U00baB-2542.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	52.222.214.120 104.119.110.121 199.232.210.172
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	52.222.214.120 104.119.110.121 199.232.210.172
	Agreement for YouTube cooperation.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	52.222.214.120 104.119.110.121 199.232.210.172
	3rd_cc_form_Oct_2024.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	52.222.214.120 104.119.110.121 199.232.210.172

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\_isetup\_setup64.tmp	Reminder.exe	Get hash	malicious	Amadey	Browse
	yM3BrI8G1E	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_7046d0b264f80a016ec10158377c7e76c395cffb.zip	Get hash	malicious	Xmrig	Browse
	Reminder.exe	Get hash	malicious	Amadey	Browse
	Reminder.exe	Get hash	malicious	Amadey	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?	Get hash	malicious	Unknown	Browse
	http://www.5movierulz.mom	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.4445.21502.exe	Get hash	malicious	Unknown	Browse
	NETGATE Spy Emergency.exe	Get hash	malicious	Amadey	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Prs295.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	10728
Entropy (8bit):	2.1743955238142725
Encrypted:	false
SSDEEP:	96:YybJaNkifQC44T+Jt67q4jEWfSpJtrjgxmVFo:dg867Xje3gx3
MD5:	EEBA05CBB1FE3356985E1B64D0DA28D1
SHA1:	F271A1D2395C75527619562FF78A017AC8D8906F
SHA-256:	C8AB8F667F14F99E8E58C550D96DE351B955C844987BF977736F7978616772C4
SHA-512:	91D840C3A93B24B47B6E8BFDC5676C9420D76E6BA94F72711B5289169E6DA86074522E42FA05CAE72B4E083321A2432686B3584514EDE1FFEFC10CB557F3868C
Malicious:	false
Preview:	H.......\|.......0...............0%......H.......................`...............................................<...................*..."...........P...................................................P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Setup Log 2024-10-25 #001.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (375), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	19585
Entropy (8bit):	5.081649921354875
Encrypted:	false
SSDEEP:	384:kDX0OMWV60TtWMTgG4+XJlhJwk7Ug9QQP0dx+UQhLcj:4Nqj
MD5:	FC298426EE9A38D312524FE48520382E
SHA1:	3C3E8D4D39CB5B7B24DDB34A8207F27B3B9A020B
SHA-256:	B075CAC244508F4431D4378CF8BA0AA3230D499FA5DB0CA1A41F9EFB308FCACF
SHA-512:	52384A02C94B2A236393DE4F532EB385FCD5E2EDCF6C59F93F4935EFD5ED4C9D63D1DC413636CEA080A077801965DF969B3DF6A66EF12D568B479F37E11FB6EE
Malicious:	false
Preview:	.2024-10-25 11:24:04.139 Log opened. (Time zone: UTC-04:00)..2024-10-25 11:24:04.139 Setup version: Inno Setup version 6.3.3..2024-10-25 11:24:04.139 Original Setup EXE: C:\Users\user\Desktop\papercut-hive.exe..2024-10-25 11:24:04.139 Setup command line: /SL5="$1047A,31229352,845824,C:\Users\user\Desktop\papercut-hive.exe" ..2024-10-25 11:24:04.139 Windows version: 10.0.19045..2024-10-25 11:24:04.139 Windows architecture: x64 (64-bit)..2024-10-25 11:24:04.139 Machine types supported by system: x86 x64..2024-10-25 11:24:04.139 User privileges: Administrative..2024-10-25 11:24:04.201 Administrative install mode: Yes..2024-10-25 11:24:04.201 Install mode root key: HKEY_LOCAL_MACHINE..2024-10-25 11:24:04.201 64-bit install mode: Yes..2024-10-25 11:24:04.217 Created protected temporary directory: C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp..2024-10-25 11:24:04.217 -- DLL function import --..2024-10-25 11:24:04.217 Function name: idpAddFile..2024-10-25 1

C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp

Download File

Process:	C:\Users\user\Desktop\papercut-hive.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3385968
Entropy (8bit):	6.541537595398069
Encrypted:	false
SSDEEP:	98304:OJYVM+LtVt3P/KuG2ONG9iqLRQE9333TU:PVL/tnHGYiql5FU
MD5:	6F986EF33F81F6A1000EEAF12445651D
SHA1:	36C67D7A61804EF02B605507882F53826E427B17
SHA-256:	5D85D8D2DA0D7378F45D63FE5832C54ACF9FD366C3CF0B750E68DF22723D2342
SHA-512:	EAA09734987F283A28F478058450515E4935D18876BAC499CBFFD63E24251DEFF788331CF3CC28112B25180B818275957E18E04F56D521B48C972EA6FEC8661D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04......X4...@......@...................P,.n.....,.j:...P0..............`3.pJ....,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Reminder.exe, Detection: malicious, Browse Filename: yM3BrI8G1E, Detection: malicious, Browse Filename: MDE_File_Sample_7046d0b264f80a016ec10158377c7e76c395cffb.zip, Detection: malicious, Browse Filename: Reminder.exe, Detection: malicious, Browse Filename: Reminder.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.4445.21502.exe, Detection: malicious, Browse Filename: NETGATE Spy Emergency.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\antivirus-info.log

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	534
Entropy (8bit):	3.7215794790753955
Encrypted:	false
SSDEEP:	12:QCjHF5o7GXwi03ell556ntll5MHW3lcbOooKDdfg9aMgalv3KLP:QSR03elDEntlD0W32/FDdg9aMguvOP
MD5:	BADD11B8E3771A5E945A1A5A826BFDBC
SHA1:	3BD34720D25876F9FEF0E6059FBBC2C6D0CB9A7D
SHA-256:	81B59FBD914C2F8DE4A3D3F55FF6FC53737FDF89B706528C16A17559DBFBD3C9
SHA-512:	FA694ABBF7EA729E2AB7A7040042BD801D79772E3D3CEEDF1D2E69794E3AC6F0093DDFE7FE2903EF0AEEF39C06F7017251447338FE5D7616A0CA28C1A960288E
Malicious:	false
Preview:	..........d.i.s.p.l.a.y.N.a.m.e.=.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.....i.n.s.t.a.n.c.e.G.u.i.d.=.{.D.6.8.D.D.C.3.A.-.8.3.1.F.-.4.f.a.e.-.9.E.4.4.-.D.A.1.3.2.C.1.A.C.F.4.6.}.....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e.=.w.i.n.d.o.w.s.d.e.f.e.n.d.e.r.:././.....p.a.t.h.T.o.S.i.g.n.e.d.R.e.p.o.r.t.i.n.g.E.x.e.=.%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.s.M.p.e.n.g...e.x.e.....p.r.o.d.u.c.t.S.t.a.t.e.=.3.9.7.5.6.8.....t.i.m.e.s.t.a.m.p.=.W.e.d.,. .0.4. .O.c.t. .2.0.2.3. .1.3.:.4.5.:.0.3. .G.M.T.............

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\.gitattributes

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	3.977219172272857
Encrypted:	false
SSDEEP:	3:nJX7Mwc1JcswXs1JDYL+qML+c:Jrfkc/kMLnMLj
MD5:	690B8F29CE97990CFC1378324E8AF628
SHA1:	D968F3610FD87CFACA70FDAC1DE740DADE1A6C71
SHA-256:	9720533DE8799EDC830DA08447AE5864E14E2A2DA2EBD109AF438521E4531B5F
SHA-512:	FBDC00B3939258C9C2D05F41A715F49867351AFB131A3333E69D54EE0C9B69718AA1C0C667D47D2928A67165D126F0FA9D9ED7EFF5C78A09231FDC6E3169E437
Malicious:	false
Preview:	pcglobal.cat binary.pcglobal.inf binary.pcglobal.ppd binary.pcntns.ppd binary

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\pcglobal.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	data
Category:	dropped
Size (bytes):	11816
Entropy (8bit):	7.183071569445355
Encrypted:	false
SSDEEP:	192:H9WTgFB24OcGEUvyyKwnsFWQF/SFWGaN4NhrJgX01k9z3Aak1s:dW8ctrnsFRpSUTN4tgR9zrn
MD5:	C1FA5D6107C00977E330349FFB07F380
SHA1:	C967B395AB4E4B26708F9A042DC255721D98D630
SHA-256:	022980B4726628E2A304E74007D6ADE1C978493307B334497D91F9EEDD9417DB
SHA-512:	4E6A5F6F5996792C144F45062BD2AE9F67BFEBD5A2969A5F72D1160FB983FEFC017A1821118CC186638D6F4142EC8A8D035278886D5084240860D40EC5DCAD08
Malicious:	false
Preview:	0..$...H..........0......1.0...`.H.e......0.....+.....7......0...0...+.....7...........J.R....0..211125004413Z0...+.....7.....0...0....R7.7.F.B.E.0.E.8.C.5.3.6.C.8.6.7.4.C.0.2.4.F.E.7.2.B.3.9.6.2.5.F.5.E.7.A.4.4.3.C...1..M08..+.....7...10(...F.i.l.e........p.c.n.t.n.s...p.p.d...0E..+.....7...17050...+.....7.......0!0...+........w....6.gL.O.+9b_^zD<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RD.8.8.7.4.4.C.5.F.E.5.7.6.F.C.7.5.A.E.B.6.2.6.3.5.1.A.4.7.9.B.3.6.4.7.0.D.0.7.D...1..Q0<..+.....7...1.0,...F.i.l.e........p.c.g.l.o.b.a.l...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........D..Wo.Z.bcQ.y.dp.}0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RE.9.7.0

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\pcglobal.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4517
Entropy (8bit):	5.301420417870783
Encrypted:	false
SSDEEP:	96:9quijt+Jr6CQYPXBqFT0QKk/xwpcxtsps0sszsFsUH:zij37YvBqFT0QTmd0H
MD5:	0CBC2ED5B1CA87B0A57C2D3B8D24E96E
SHA1:	D88744C5FE576FC75AEB626351A479B36470D07D
SHA-256:	C0E6231D40C609DD7AC1B0DD4D9FAAA784ECADA7F468D46B42A4AC818878A7F3
SHA-512:	47FCA9CA3678F29AE9FC00085C56CD91FC29262D4CFB41C219FD853267F25C2FFEF3865C7AF5BDC89577EB8FCAC0F6CD654F36EB38A0BD8F9548A115BA9BD92D
Malicious:	false
Preview:	; pcglobal.inf..; INF file for PaperCut Global PostScript driver..; Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved.....[Strings]..ManufacturerName="PaperCut"..DriverName="PaperCut Global PostScript"..DriverNameNTNS="PaperCut Global PostScript - NTNS"......[Version]..Signature="$Windows NT$" ; All Windows versions...Provider=%ManufacturerName%..Class=Printer ; Device setup class...ClassGUID={4D36E979-E325-11CE-BFC1-08002BE10318} ; From devguid.h...CatalogFile=pcglobal.cat..DriverVer = 08/05/2021,101.0.1.0 ; mm/dd/yyyy,w.x.y.z..DriverIsolation=2 ; Isolated. can be run as a separate process.....;..; SourceDisksNames Section...; Identifies the distribution disks or CD-ROM discs that contain the source files to be..; transferred to the target computer during installation...;..[SourceDisksNames]..1 = %DriverName%....;..; SourceDisksFiles Section...; Name

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\pcglobal.ppd

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	17980
Entropy (8bit):	5.110121716980155
Encrypted:	false
SSDEEP:	192:d1fM/SihhrFIYODdDJPId0PbPPeScNXFthmekNaWR3WSp4u+LzXvA6ZD:vfFihhrSZDdDJPIdtbO4u+LzfFZD
MD5:	4559236DAE31768C392B1793727C5941
SHA1:	E9703C30CE7CCE5FD0496C4C1BBC7A8CBBE123E6
SHA-256:	EA22FE16B562BDDFDA46E3DD4B3AC830CE5F064929BCFF6B67DCDFC3E9D36821
SHA-512:	146BBFCA3AB6AEC4D4BAB5D403EC9B7DACE4417296F4340F184CB45D919DFEC441F0FE4887D3B7590ED322423939B63E41D2AAFB1B78F452A6E15F090BE7AE30
Malicious:	false
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved...% Copyright (c) 2005 Microsoft Corp. All rights reserved...% Permission is granted for redistribution of this file as long as this copyright notice is intact..% and the content of the file is not altered in any way from its original form.....FormatVersion: "4.3" % The PPD file format version. ..FileVersion: "101.0.1.0" % PPD file version. Keep it sync with INF version...LanguageEncoding: ISOLatin1..LanguageVersion: English..Product: "(PaperCut Global PostScript)" ..PSVersion: "(3010)"..Manufacturer: "PaperCut" % Keep it sync with the INF file manufacturer...ModelName: "PaperCut Global PostScript" % Manufacturer name followed by device...ShortNickName: "pcglobal"..NickName: "PaperCut Global PostScript" *% Used in the UI

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\pcntns.ppd

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	14936
Entropy (8bit):	5.124023486899187
Encrypted:	false
SSDEEP:	192:d1fM/KiuhrFIEeScNXFthmekNaWR3WSp4u+LzXvA6ZD:vfDiuhrSLbO4u+LzfFZD
MD5:	8E4D52887A32ADB2DD7B7BE154386C9B
SHA1:	77FBE0E8C536C8674C024FE72B39625F5E7A443C
SHA-256:	4C2196498AA1E5371A583FE716E99D4ECBD26140618F22882CF21022A93D2E53
SHA-512:	6580E7DC0483F5F8FAF973D0C4A18C4AC69FDB45C1A2ADBF8E7758FB548B207A86C95356EDEA77702FC23E4D5AF76AA14D5EB63C1415DF73B537D39AFA927321
Malicious:	false
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved...% Copyright (c) 2005 Microsoft Corp. All rights reserved...% Permission is granted for redistribution of this file as long as this copyright notice is intact..% and the content of the file is not altered in any way from its original form.....FormatVersion: "4.3" % The PPD file format version. ..FileVersion: "101.0.1.0" % PPD file version. Keep it sync with INF version...LanguageEncoding: ISOLatin1..LanguageVersion: English..Product: "(PaperCut Global PostScript - NTNS)" ..PSVersion: "(3010)"..Manufacturer: "PaperCut" % Keep it sync with the INF file manufacturer...ModelName: "PaperCut Global PostScript - NTNS" % Manufacturer name followed by device...ShortNickName: "pcglobal"..NickName: "PaperCut Global PostScript - NTNS" *% Used in

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	14236272
Entropy (8bit):	6.390013658527998
Encrypted:	false
SSDEEP:	98304:H1Znb5tT/LsQm4kjNBeoEMoWpXQmJ+F1xqm:LvTTsDNeXPPqm
MD5:	F65100B9805BF914F9F77AA08566AFAB
SHA1:	3617F0260F64A901213587CD35F79E095F7A5633
SHA-256:	4F4DDB33A225A71AD699156E0271ADF07B84F55B3051D19B5C68EC0EA442DA4C
SHA-512:	CBD45F41F1316233DCDD894B19F076205CE616ACB1E0BEC46B89FECE24C4B3147E8ABAE0FE3BC47998C02A73E4C270CD43D96945B6F052CAA064122F307766CE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."......8U..R................@...........................................`... .........................................................................pJ..............................................................H............................text....7U......8U................. ..`.rdata...{..PU...{..>U.............@..@.data............R..................@....idata...............4..............@....reloc...............:..............@..B.symtab................................B.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\printer-settings-us-ca.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	data
Category:	dropped
Size (bytes):	16780
Entropy (8bit):	2.018182144325611
Encrypted:	false
SSDEEP:	96:sBaNk8PfofQmPfN44T+Jt67q4jEWfSpJf96JOhccrxBaNkMPf5Pf:s4gbQ67Xj06JQxIR
MD5:	A7C2E59EA7DA76458F57A3CEC94AD4F2
SHA1:	215548803E78634B458CBFB700248782F08B9566
SHA-256:	2D2F724EE164B172F3BE01FDA288D17515B42C9D436E0531B435186EC6E4D416
SHA-512:	1DFA903AB6675A72DCAD814E7B690F9CEF27B653FA718A8BBBA8F30B65D46F507113A5767B1CDA6AA920C04C22727065BAEF76DF63DB8D8E5C9002806CA7C94E
Malicious:	false
Preview:	H........ ......3........<.......8......H.......`.......$6......x ..................................>...<...................`...........\|...z.......P...................................z...............P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\printer-settings.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	data
Category:	dropped
Size (bytes):	16780
Entropy (8bit):	2.012301759828577
Encrypted:	false
SSDEEP:	96:sBaNkafpfQMfM44T+Jt67q4jEWfSpJf96JOhccrxBaNkKfof:sIRLN67Xj06JQxYA
MD5:	0188820F8D1F9E537C49B2DF1697A5E5
SHA1:	1C13235A80AEE6775C8F8BCF0A41B398E24859BF
SHA-256:	5579D7D552B1596752CAAE4F3DEE8E26C29C1868D119D8B261B13BE0CBA2B03C
SHA-512:	8748914F05415DB96801CAC48112BC992A23790A68FB0B1F31ADD4C9704999B7BD2BA3CDCAEDEA1273B2EDF6BFF06E37FEEBCD950BB5F8E2F425A5E4E8426FEA
Malicious:	false
Preview:	H........ ......3........<.......8......H.......`.......$6......x ..................................>...<...................`...........\|...z.......P...................................z...............P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\data\config\cloud-region.conf

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.6464393446710157
Encrypted:	false
SSDEEP:	3:DIvX:kP
MD5:	F8B5DCBCDDDC5AA373D11105AB5BA5AE
SHA1:	5D1DD0A46025DA03673978F42A75D4707604683D
SHA-256:	EE44E6637CFB87DCC766A9390C2B8E0BD63C512DAF25DA1058272E0D94A85E8B
SHA-512:	6AD49BDB56093504AC9FF8E3F002B1F335085528350C3CCFA5FCEC823F6245E2B00B31D02A4632BBB578A5A520288B92A1C432C4A0DE8A102152D7CF442A1311
Malicious:	false
Preview:	us-genesis

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\ghost-trap-installer-1.5.10.03.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	47184925
Entropy (8bit):	7.997841711247933
Encrypted:	true
SSDEEP:	786432:9AfetGUEh0Rw8BVEtRxg0P/VPE0Yx2RQuvkRpaSfRRFMQzjFemm0bX2/f:9AKG3qwKVEtRieo6SpMQnFMam/f
MD5:	6BEC66D2079FA4402527770AC2037085
SHA1:	FCF8B6678E404563B29E960BF83D14576B06D249
SHA-256:	54832CDA1A9B6FACFCED034B6E85FCF3B68F6A616867996283029C802AC96AE7
SHA-512:	14859BC944DC36E515D77FE85A1E10E23DDDB41F65D28278A55A189DD93A170223B40D27F8B7C4A603F6961556921F6B24A1C056A52DE70E054CBE0174579966
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@.......................................@......@...................p..q....P.......................................................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\idp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237568
Entropy (8bit):	6.42067568634536
Encrypted:	false
SSDEEP:	3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
MD5:	55C310C0319260D798757557AB3BF636
SHA1:	0892EB7ED31D8BB20A56C6835990749011A2D8DE
SHA-256:	54E7E0AD32A22B775131A6288F083ED3286A9A436941377FC20F85DD9AD983ED
SHA-512:	E0082109737097658677D7963CBF28D412DCA3FA8F5812C2567E53849336CE45EBAE2C0430DF74BFE16C0F3EEBB46961BC1A10F32CA7947692A900162128AE57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)Wj.H99.H99.H99..D9.H99..W9.H99..T9-H99zGd9.H99.H894H99..K9.H99..C9.H99..E9.H99..A9.H99Rich.H99........................PE..L......W...........!................Nr..............................................0............................... ;......h/..d.......................................................................@............................................text...i........................... ..`.rdata...n.......p..................@..@.data....:...@... ...@..............@....rsrc................`..............@..@.reloc..b-.......0...p..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\post.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	PC bitmap, Windows 3.x format, 420 x 250 x 16, image size 210002, resolution 2834 x 2834 px/m, cbSize 210056, bits offset 54
Category:	dropped
Size (bytes):	210056
Entropy (8bit):	3.461640444793451
Encrypted:	false
SSDEEP:	768:8aVAwJcGJ60sIRYYuSoFmfAVYgptlJhUG:8wA4cGJ60sApUFm4VYIj
MD5:	B75F1EF5AE5394974A2974844EFD7A02
SHA1:	00F370C99AB1E71CE69F588818EEF3D4C5DDA911
SHA-256:	5F886B8FF04B75CB7DEAEFBF31F8F02C8A0D84DE15F2181E370B9D3461E26829
SHA-512:	E9AD1DD6BE1C7E648F492A93FB7C9C61B861B35900DCF1A3D3BA7797AF22AF703A901C62B3F8ABE46F1E058219055D8F850D253CBF7D25EAA1DDF6033B256E40
Malicious:	false
Preview:	BM.4......6...(...................R4...................w.w.s.s{o9g.{.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{9g{o.s.s.w.w.w.w.s.s{o9g..............................................................................................

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2019
Entropy (8bit):	5.25117330690567
Encrypted:	false
SSDEEP:	48:GNkF3AWqsLuMKDE69KL9VKbyhWQhmhZy9ZKb6gT5kNkIZR:GN0wIPb5WcKZhLTwk0R
MD5:	A468CB349CCF75ACF0DCFA5C9627CFC0
SHA1:	7EA284E2EBD86BEF6946E8A2F0CE5B2F31509937
SHA-256:	012422FD0C9237C62ECE4D6A71037DC26D4018717DB7C5FA7623B7E1D0B99748
SHA-512:	DD9D5B6A36560C490E8D703A90EE488DC66629EF2E6F59123391425B1AF19C09D3DF52071FA0D43A5D5A888D0F4B78219DF63B32225ABA435788579DE28F063B
Malicious:	true
Preview:	SUPPORT: writing all logs in this file {"src":"main.go:82"}.SUPPORT: PaperCut PrintClient version: 2024-10-14-0344 {"src":"main.go:160"}.SUPPORT: Running as user with GID -1, UID -1 {"src":"main.go:161"}.SUPPORT: PrinterID: "PaperCut Printer" {"src":"main.go:176"}.SUPPORT: printerName: "PaperCut Printer" {"src":"main.go:177"}.SUPPORT: PrintClient starting in installPrintQueue mode {"src":"main.go:180"}.SUPPORT: ping 0 successful {"src":"main.go:195"}.SUPPORT: Installing on Windows os {"src":"installer_windows.go:27"}.SUPPORT: command running: [rundll32.exe printui.dll,PrintUIEntry /ia /m PaperCut Global PostScript - NTNS /f C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf /u] {"src":"utils.go:13"}.SUPPORT: command running: [rundll32.exe printui.dll,PrintUIEntry /y /if /b PaperCut Printer /x /n PaperCut Printer /m PaperCut Global PostScript - NTNS /r http://localhost:9265/printers/papercutpocket /u /q] {"src":"utils.go:13"}.ERROR: Unsupported op

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\vcredist_x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25502344
Entropy (8bit):	7.99690603041159
Encrypted:	true
SSDEEP:	786432:moKpx5hYBug51MMlQi7PZdJXiq1+N76JupzS:Upx56Bu61FZPZdxQcUzS
MD5:	689D09BCE45C75DB883DB7E78B6F4E9B
SHA1:	BA92A00F0F55DCAE85C1BBD098EFE606BD080B3C
SHA-256:	814E9DA5EC5E5D6A8FA701999D1FC3BADDF7F3ADC528E202590E9B1CB73E4A11
SHA-512:	4DB5078FDD9EB9CE00A1B6195A67C779A1D3C719DE0FBD4729ADBDAC2D8CA442CF4E0A31AA40D213F29617EC073F1A7E42570DCC2F931EB9534C45F1EC6DE253
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]aN.<...<...<...L...<...L..j<...T...<...T...<...T...<...L...<...L...<...L...<...<...=..PU...<..PU...<...<...<..PU...<..Rich.<..........................PE..L......e..........................................@.................................\....@............................................T;...............(...P...>.....T...................4........F..@...................T........................text...>........................... ..`.rdata..&...........................@..@.data...<...........................@....wixburn8...........................@..@.rsrc...T;.......<..................@..@.reloc...>...P...@..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\~execwithresult.txt

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	4710
Entropy (8bit):	4.213937953780392
Encrypted:	false
SSDEEP:	96:01cZyXhszGZxq7l8lAlxO6dmbuE85dESsBzVolZEDt22e8OO6CJUu3enEXEAVKVm:nZ4z8aSPmbuE85dESsBzVolZEDt2ALAm
MD5:	1620A078BA81DBB5AFFD2C0B678EB7F6
SHA1:	3ABCC647AB1798F4177045D491E10815424AA1F7
SHA-256:	34DAF550002E9BCD22ADC72DE9F1AC2738224754A7FEBB3FFE9CC6694FD1B4D6
SHA-512:	4924D3B9EBC0E13B233DAAC76FA2D5DB2A5EB17055403B265EC8AE36CBACA336D7DE3D3F88D36B30048926E7C5E914E229DE2FC06B32DC0261A008C0488AE5EF
Malicious:	false
Preview:	..Active Connections.... Proto Local Address Foreign Address State.. TCP 0.0.0.0:135 0.0.0.0:0 LISTENING.. RpcEptMapper.. [svchost.exe].. TCP 0.0.0.0:445 0.0.0.0:0 LISTENING.. Can not obtain ownership information.. TCP 0.0.0.0:5040 0.0.0.0:0 LISTENING.. CDPSvc.. [svchost.exe].. TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING.. [lsass.exe].. TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING.. Can not obtain ownership information.. TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING.. EventLog.. [svchost.exe].. TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING.. Schedule.. [svchost.exe].. TCP 0.0.0.0:49668 0.0.0.0:0 LISTENING.. [spoolsv.exe].. TCP 0.0.0.0:49669 0.0.0.0:0 LISTENING.. Can not obtain ownership information.. TCP 0.0.0.0:49670 0.0.0.0:0 LIST

C:\Users\user\AppData\Local\Temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\SETF815.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	14936
Entropy (8bit):	5.124023486899187
Encrypted:	false
SSDEEP:	192:d1fM/KiuhrFIEeScNXFthmekNaWR3WSp4u+LzXvA6ZD:vfDiuhrSLbO4u+LzfFZD
MD5:	8E4D52887A32ADB2DD7B7BE154386C9B
SHA1:	77FBE0E8C536C8674C024FE72B39625F5E7A443C
SHA-256:	4C2196498AA1E5371A583FE716E99D4ECBD26140618F22882CF21022A93D2E53
SHA-512:	6580E7DC0483F5F8FAF973D0C4A18C4AC69FDB45C1A2ADBF8E7758FB548B207A86C95356EDEA77702FC23E4D5AF76AA14D5EB63C1415DF73B537D39AFA927321
Malicious:	false
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved...% Copyright (c) 2005 Microsoft Corp. All rights reserved...% Permission is granted for redistribution of this file as long as this copyright notice is intact..% and the content of the file is not altered in any way from its original form.....FormatVersion: "4.3" % The PPD file format version. ..FileVersion: "101.0.1.0" % PPD file version. Keep it sync with INF version...LanguageEncoding: ISOLatin1..LanguageVersion: English..Product: "(PaperCut Global PostScript - NTNS)" ..PSVersion: "(3010)"..Manufacturer: "PaperCut" % Keep it sync with the INF file manufacturer...ModelName: "PaperCut Global PostScript - NTNS" % Manufacturer name followed by device...ShortNickName: "pcglobal"..NickName: "PaperCut Global PostScript - NTNS" *% Used in

C:\Users\user\AppData\Local\Temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\SETF836.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11816
Entropy (8bit):	7.183071569445355
Encrypted:	false
SSDEEP:	192:H9WTgFB24OcGEUvyyKwnsFWQF/SFWGaN4NhrJgX01k9z3Aak1s:dW8ctrnsFRpSUTN4tgR9zrn
MD5:	C1FA5D6107C00977E330349FFB07F380
SHA1:	C967B395AB4E4B26708F9A042DC255721D98D630
SHA-256:	022980B4726628E2A304E74007D6ADE1C978493307B334497D91F9EEDD9417DB
SHA-512:	4E6A5F6F5996792C144F45062BD2AE9F67BFEBD5A2969A5F72D1160FB983FEFC017A1821118CC186638D6F4142EC8A8D035278886D5084240860D40EC5DCAD08
Malicious:	false
Preview:	0..$...H..........0......1.0...`.H.e......0.....+.....7......0...0...+.....7...........J.R....0..211125004413Z0...+.....7.....0...0....R7.7.F.B.E.0.E.8.C.5.3.6.C.8.6.7.4.C.0.2.4.F.E.7.2.B.3.9.6.2.5.F.5.E.7.A.4.4.3.C...1..M08..+.....7...10(...F.i.l.e........p.c.n.t.n.s...p.p.d...0E..+.....7...17050...+.....7.......0!0...+........w....6.gL.O.+9b_^zD<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RD.8.8.7.4.4.C.5.F.E.5.7.6.F.C.7.5.A.E.B.6.2.6.3.5.1.A.4.7.9.B.3.6.4.7.0.D.0.7.D...1..Q0<..+.....7...1.0,...F.i.l.e........p.c.g.l.o.b.a.l...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........D..Wo.Z.bcQ.y.dp.}0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RE.9.7.0

C:\Users\user\AppData\Local\Temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\SETF846.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4517
Entropy (8bit):	5.301420417870783
Encrypted:	false
SSDEEP:	96:9quijt+Jr6CQYPXBqFT0QKk/xwpcxtsps0sszsFsUH:zij37YvBqFT0QTmd0H
MD5:	0CBC2ED5B1CA87B0A57C2D3B8D24E96E
SHA1:	D88744C5FE576FC75AEB626351A479B36470D07D
SHA-256:	C0E6231D40C609DD7AC1B0DD4D9FAAA784ECADA7F468D46B42A4AC818878A7F3
SHA-512:	47FCA9CA3678F29AE9FC00085C56CD91FC29262D4CFB41C219FD853267F25C2FFEF3865C7AF5BDC89577EB8FCAC0F6CD654F36EB38A0BD8F9548A115BA9BD92D
Malicious:	false
Preview:	; pcglobal.inf..; INF file for PaperCut Global PostScript driver..; Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved.....[Strings]..ManufacturerName="PaperCut"..DriverName="PaperCut Global PostScript"..DriverNameNTNS="PaperCut Global PostScript - NTNS"......[Version]..Signature="$Windows NT$" ; All Windows versions...Provider=%ManufacturerName%..Class=Printer ; Device setup class...ClassGUID={4D36E979-E325-11CE-BFC1-08002BE10318} ; From devguid.h...CatalogFile=pcglobal.cat..DriverVer = 08/05/2021,101.0.1.0 ; mm/dd/yyyy,w.x.y.z..DriverIsolation=2 ; Isolated. can be run as a separate process.....;..; SourceDisksNames Section...; Identifies the distribution disks or CD-ROM discs that contain the source files to be..; transferred to the target computer during installation...;..[SourceDisksNames]..1 = %DriverName%....;..; SourceDisksFiles Section...; Name

C:\Users\user\AppData\Local\Temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\SETF867.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	17980
Entropy (8bit):	5.110121716980155
Encrypted:	false
SSDEEP:	192:d1fM/SihhrFIYODdDJPId0PbPPeScNXFthmekNaWR3WSp4u+LzXvA6ZD:vfFihhrSZDdDJPIdtbO4u+LzfFZD
MD5:	4559236DAE31768C392B1793727C5941
SHA1:	E9703C30CE7CCE5FD0496C4C1BBC7A8CBBE123E6
SHA-256:	EA22FE16B562BDDFDA46E3DD4B3AC830CE5F064929BCFF6B67DCDFC3E9D36821
SHA-512:	146BBFCA3AB6AEC4D4BAB5D403EC9B7DACE4417296F4340F184CB45D919DFEC441F0FE4887D3B7590ED322423939B63E41D2AAFB1B78F452A6E15F090BE7AE30
Malicious:	false
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved...% Copyright (c) 2005 Microsoft Corp. All rights reserved...% Permission is granted for redistribution of this file as long as this copyright notice is intact..% and the content of the file is not altered in any way from its original form.....FormatVersion: "4.3" % The PPD file format version. ..FileVersion: "101.0.1.0" % PPD file version. Keep it sync with INF version...LanguageEncoding: ISOLatin1..LanguageVersion: English..Product: "(PaperCut Global PostScript)" ..PSVersion: "(3010)"..Manufacturer: "PaperCut" % Keep it sync with the INF file manufacturer...ModelName: "PaperCut Global PostScript" % Manufacturer name followed by device...ShortNickName: "pcglobal"..NickName: "PaperCut Global PostScript" *% Used in the UI

C:\Users\user\AppData\Local\Temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\pcglobal.cat (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	11816
Entropy (8bit):	7.183071569445355
Encrypted:	false
SSDEEP:	192:H9WTgFB24OcGEUvyyKwnsFWQF/SFWGaN4NhrJgX01k9z3Aak1s:dW8ctrnsFRpSUTN4tgR9zrn
MD5:	C1FA5D6107C00977E330349FFB07F380
SHA1:	C967B395AB4E4B26708F9A042DC255721D98D630
SHA-256:	022980B4726628E2A304E74007D6ADE1C978493307B334497D91F9EEDD9417DB
SHA-512:	4E6A5F6F5996792C144F45062BD2AE9F67BFEBD5A2969A5F72D1160FB983FEFC017A1821118CC186638D6F4142EC8A8D035278886D5084240860D40EC5DCAD08
Malicious:	false
Preview:	0..$...H..........0......1.0...`.H.e......0.....+.....7......0...0...+.....7...........J.R....0..211125004413Z0...+.....7.....0...0....R7.7.F.B.E.0.E.8.C.5.3.6.C.8.6.7.4.C.0.2.4.F.E.7.2.B.3.9.6.2.5.F.5.E.7.A.4.4.3.C...1..M08..+.....7...10(...F.i.l.e........p.c.n.t.n.s...p.p.d...0E..+.....7...17050...+.....7.......0!0...+........w....6.gL.O.+9b_^zD<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RD.8.8.7.4.4.C.5.F.E.5.7.6.F.C.7.5.A.E.B.6.2.6.3.5.1.A.4.7.9.B.3.6.4.7.0.D.0.7.D...1..Q0<..+.....7...1.0,...F.i.l.e........p.c.g.l.o.b.a.l...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........D..Wo.Z.bcQ.y.dp.}0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RE.9.7.0

C:\Users\user\AppData\Local\Temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\pcglobal.inf (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4517
Entropy (8bit):	5.301420417870783
Encrypted:	false
SSDEEP:	96:9quijt+Jr6CQYPXBqFT0QKk/xwpcxtsps0sszsFsUH:zij37YvBqFT0QTmd0H
MD5:	0CBC2ED5B1CA87B0A57C2D3B8D24E96E
SHA1:	D88744C5FE576FC75AEB626351A479B36470D07D
SHA-256:	C0E6231D40C609DD7AC1B0DD4D9FAAA784ECADA7F468D46B42A4AC818878A7F3
SHA-512:	47FCA9CA3678F29AE9FC00085C56CD91FC29262D4CFB41C219FD853267F25C2FFEF3865C7AF5BDC89577EB8FCAC0F6CD654F36EB38A0BD8F9548A115BA9BD92D
Malicious:	false
Preview:	; pcglobal.inf..; INF file for PaperCut Global PostScript driver..; Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved.....[Strings]..ManufacturerName="PaperCut"..DriverName="PaperCut Global PostScript"..DriverNameNTNS="PaperCut Global PostScript - NTNS"......[Version]..Signature="$Windows NT$" ; All Windows versions...Provider=%ManufacturerName%..Class=Printer ; Device setup class...ClassGUID={4D36E979-E325-11CE-BFC1-08002BE10318} ; From devguid.h...CatalogFile=pcglobal.cat..DriverVer = 08/05/2021,101.0.1.0 ; mm/dd/yyyy,w.x.y.z..DriverIsolation=2 ; Isolated. can be run as a separate process.....;..; SourceDisksNames Section...; Identifies the distribution disks or CD-ROM discs that contain the source files to be..; transferred to the target computer during installation...;..[SourceDisksNames]..1 = %DriverName%....;..; SourceDisksFiles Section...; Name

C:\Users\user\AppData\Local\Temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\pcglobal.ppd (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	17980
Entropy (8bit):	5.110121716980155
Encrypted:	false
SSDEEP:	192:d1fM/SihhrFIYODdDJPId0PbPPeScNXFthmekNaWR3WSp4u+LzXvA6ZD:vfFihhrSZDdDJPIdtbO4u+LzfFZD
MD5:	4559236DAE31768C392B1793727C5941
SHA1:	E9703C30CE7CCE5FD0496C4C1BBC7A8CBBE123E6
SHA-256:	EA22FE16B562BDDFDA46E3DD4B3AC830CE5F064929BCFF6B67DCDFC3E9D36821
SHA-512:	146BBFCA3AB6AEC4D4BAB5D403EC9B7DACE4417296F4340F184CB45D919DFEC441F0FE4887D3B7590ED322423939B63E41D2AAFB1B78F452A6E15F090BE7AE30
Malicious:	false
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved...% Copyright (c) 2005 Microsoft Corp. All rights reserved...% Permission is granted for redistribution of this file as long as this copyright notice is intact..% and the content of the file is not altered in any way from its original form.....FormatVersion: "4.3" % The PPD file format version. ..FileVersion: "101.0.1.0" % PPD file version. Keep it sync with INF version...LanguageEncoding: ISOLatin1..LanguageVersion: English..Product: "(PaperCut Global PostScript)" ..PSVersion: "(3010)"..Manufacturer: "PaperCut" % Keep it sync with the INF file manufacturer...ModelName: "PaperCut Global PostScript" % Manufacturer name followed by device...ShortNickName: "pcglobal"..NickName: "PaperCut Global PostScript" *% Used in the UI

C:\Users\user\AppData\Local\Temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\pcntns.ppd (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	14936
Entropy (8bit):	5.124023486899187
Encrypted:	false
SSDEEP:	192:d1fM/KiuhrFIEeScNXFthmekNaWR3WSp4u+LzXvA6ZD:vfDiuhrSLbO4u+LzfFZD
MD5:	8E4D52887A32ADB2DD7B7BE154386C9B
SHA1:	77FBE0E8C536C8674C024FE72B39625F5E7A443C
SHA-256:	4C2196498AA1E5371A583FE716E99D4ECBD26140618F22882CF21022A93D2E53
SHA-512:	6580E7DC0483F5F8FAF973D0C4A18C4AC69FDB45C1A2ADBF8E7758FB548B207A86C95356EDEA77702FC23E4D5AF76AA14D5EB63C1415DF73B537D39AFA927321
Malicious:	false
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved...% Copyright (c) 2005 Microsoft Corp. All rights reserved...% Permission is granted for redistribution of this file as long as this copyright notice is intact..% and the content of the file is not altered in any way from its original form.....FormatVersion: "4.3" % The PPD file format version. ..FileVersion: "101.0.1.0" % PPD file version. Keep it sync with INF version...LanguageEncoding: ISOLatin1..LanguageVersion: English..Product: "(PaperCut Global PostScript - NTNS)" ..PSVersion: "(3010)"..Manufacturer: "PaperCut" % Keep it sync with the INF file manufacturer...ModelName: "PaperCut Global PostScript - NTNS" % Manufacturer name followed by device...ShortNickName: "pcglobal"..NickName: "PaperCut Global PostScript - NTNS" *% Used in

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4517
Entropy (8bit):	5.301420417870783
Encrypted:	false
SSDEEP:	96:9quijt+Jr6CQYPXBqFT0QKk/xwpcxtsps0sszsFsUH:zij37YvBqFT0QTmd0H
MD5:	0CBC2ED5B1CA87B0A57C2D3B8D24E96E
SHA1:	D88744C5FE576FC75AEB626351A479B36470D07D
SHA-256:	C0E6231D40C609DD7AC1B0DD4D9FAAA784ECADA7F468D46B42A4AC818878A7F3
SHA-512:	47FCA9CA3678F29AE9FC00085C56CD91FC29262D4CFB41C219FD853267F25C2FFEF3865C7AF5BDC89577EB8FCAC0F6CD654F36EB38A0BD8F9548A115BA9BD92D
Malicious:	false
Preview:	; pcglobal.inf..; INF file for PaperCut Global PostScript driver..; Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved.....[Strings]..ManufacturerName="PaperCut"..DriverName="PaperCut Global PostScript"..DriverNameNTNS="PaperCut Global PostScript - NTNS"......[Version]..Signature="$Windows NT$" ; All Windows versions...Provider=%ManufacturerName%..Class=Printer ; Device setup class...ClassGUID={4D36E979-E325-11CE-BFC1-08002BE10318} ; From devguid.h...CatalogFile=pcglobal.cat..DriverVer = 08/05/2021,101.0.1.0 ; mm/dd/yyyy,w.x.y.z..DriverIsolation=2 ; Isolated. can be run as a separate process.....;..; SourceDisksNames Section...; Identifies the distribution disks or CD-ROM discs that contain the source files to be..; transferred to the target computer during installation...;..[SourceDisksNames]..1 = %DriverName%....;..; SourceDisksFiles Section...; Name

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	52012
Entropy (8bit):	5.3544476248462045
Encrypted:	false
SSDEEP:	384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwrP3UQGSE254jEPpiXw4i3x:Own95cdyYloiwTyz25ThiE
MD5:	797061849F59DBDD29B72334BBB581BF
SHA1:	672D500A4C3177F256A554222543EF42CC5F56D5
SHA-256:	224DAD36F52F1D9F64029DECB2FA911BE38571CDC5618A63E8647ABF9811F68F
SHA-512:	74A62DE73A67D9FBFC1BFC22C4B9FBD6399CDB996EF43B175EF8FCC59ED96B32E56562F82E2EA11362E59536837998C3B6A10A59B3410633CE9B1DA2FCB31C13
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\SETF9DB.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	14936
Entropy (8bit):	5.124023486899187
Encrypted:	false
SSDEEP:	192:d1fM/KiuhrFIEeScNXFthmekNaWR3WSp4u+LzXvA6ZD:vfDiuhrSLbO4u+LzfFZD
MD5:	8E4D52887A32ADB2DD7B7BE154386C9B
SHA1:	77FBE0E8C536C8674C024FE72B39625F5E7A443C
SHA-256:	4C2196498AA1E5371A583FE716E99D4ECBD26140618F22882CF21022A93D2E53
SHA-512:	6580E7DC0483F5F8FAF973D0C4A18C4AC69FDB45C1A2ADBF8E7758FB548B207A86C95356EDEA77702FC23E4D5AF76AA14D5EB63C1415DF73B537D39AFA927321
Malicious:	false
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved...% Copyright (c) 2005 Microsoft Corp. All rights reserved...% Permission is granted for redistribution of this file as long as this copyright notice is intact..% and the content of the file is not altered in any way from its original form.....FormatVersion: "4.3" % The PPD file format version. ..FileVersion: "101.0.1.0" % PPD file version. Keep it sync with INF version...LanguageEncoding: ISOLatin1..LanguageVersion: English..Product: "(PaperCut Global PostScript - NTNS)" ..PSVersion: "(3010)"..Manufacturer: "PaperCut" % Keep it sync with the INF file manufacturer...ModelName: "PaperCut Global PostScript - NTNS" % Manufacturer name followed by device...ShortNickName: "pcglobal"..NickName: "PaperCut Global PostScript - NTNS" *% Used in

C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\SETF9EB.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	11816
Entropy (8bit):	7.183071569445355
Encrypted:	false
SSDEEP:	192:H9WTgFB24OcGEUvyyKwnsFWQF/SFWGaN4NhrJgX01k9z3Aak1s:dW8ctrnsFRpSUTN4tgR9zrn
MD5:	C1FA5D6107C00977E330349FFB07F380
SHA1:	C967B395AB4E4B26708F9A042DC255721D98D630
SHA-256:	022980B4726628E2A304E74007D6ADE1C978493307B334497D91F9EEDD9417DB
SHA-512:	4E6A5F6F5996792C144F45062BD2AE9F67BFEBD5A2969A5F72D1160FB983FEFC017A1821118CC186638D6F4142EC8A8D035278886D5084240860D40EC5DCAD08
Malicious:	false
Preview:	0..$...H..........0......1.0...`.H.e......0.....+.....7......0...0...+.....7...........J.R....0..211125004413Z0...+.....7.....0...0....R7.7.F.B.E.0.E.8.C.5.3.6.C.8.6.7.4.C.0.2.4.F.E.7.2.B.3.9.6.2.5.F.5.E.7.A.4.4.3.C...1..M08..+.....7...10(...F.i.l.e........p.c.n.t.n.s...p.p.d...0E..+.....7...17050...+.....7.......0!0...+........w....6.gL.O.+9b_^zD<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RD.8.8.7.4.4.C.5.F.E.5.7.6.F.C.7.5.A.E.B.6.2.6.3.5.1.A.4.7.9.B.3.6.4.7.0.D.0.7.D...1..Q0<..+.....7...1.0,...F.i.l.e........p.c.g.l.o.b.a.l...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........D..Wo.Z.bcQ.y.dp.}0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RE.9.7.0

C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\SETF9FC.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4517
Entropy (8bit):	5.301420417870783
Encrypted:	false
SSDEEP:	96:9quijt+Jr6CQYPXBqFT0QKk/xwpcxtsps0sszsFsUH:zij37YvBqFT0QTmd0H
MD5:	0CBC2ED5B1CA87B0A57C2D3B8D24E96E
SHA1:	D88744C5FE576FC75AEB626351A479B36470D07D
SHA-256:	C0E6231D40C609DD7AC1B0DD4D9FAAA784ECADA7F468D46B42A4AC818878A7F3
SHA-512:	47FCA9CA3678F29AE9FC00085C56CD91FC29262D4CFB41C219FD853267F25C2FFEF3865C7AF5BDC89577EB8FCAC0F6CD654F36EB38A0BD8F9548A115BA9BD92D
Malicious:	false
Preview:	; pcglobal.inf..; INF file for PaperCut Global PostScript driver..; Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved.....[Strings]..ManufacturerName="PaperCut"..DriverName="PaperCut Global PostScript"..DriverNameNTNS="PaperCut Global PostScript - NTNS"......[Version]..Signature="$Windows NT$" ; All Windows versions...Provider=%ManufacturerName%..Class=Printer ; Device setup class...ClassGUID={4D36E979-E325-11CE-BFC1-08002BE10318} ; From devguid.h...CatalogFile=pcglobal.cat..DriverVer = 08/05/2021,101.0.1.0 ; mm/dd/yyyy,w.x.y.z..DriverIsolation=2 ; Isolated. can be run as a separate process.....;..; SourceDisksNames Section...; Identifies the distribution disks or CD-ROM discs that contain the source files to be..; transferred to the target computer during installation...;..[SourceDisksNames]..1 = %DriverName%....;..; SourceDisksFiles Section...; Name

C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\SETFA0C.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	17980
Entropy (8bit):	5.110121716980155
Encrypted:	false
SSDEEP:	192:d1fM/SihhrFIYODdDJPId0PbPPeScNXFthmekNaWR3WSp4u+LzXvA6ZD:vfFihhrSZDdDJPIdtbO4u+LzfFZD
MD5:	4559236DAE31768C392B1793727C5941
SHA1:	E9703C30CE7CCE5FD0496C4C1BBC7A8CBBE123E6
SHA-256:	EA22FE16B562BDDFDA46E3DD4B3AC830CE5F064929BCFF6B67DCDFC3E9D36821
SHA-512:	146BBFCA3AB6AEC4D4BAB5D403EC9B7DACE4417296F4340F184CB45D919DFEC441F0FE4887D3B7590ED322423939B63E41D2AAFB1B78F452A6E15F090BE7AE30
Malicious:	false
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved...% Copyright (c) 2005 Microsoft Corp. All rights reserved...% Permission is granted for redistribution of this file as long as this copyright notice is intact..% and the content of the file is not altered in any way from its original form.....FormatVersion: "4.3" % The PPD file format version. ..FileVersion: "101.0.1.0" % PPD file version. Keep it sync with INF version...LanguageEncoding: ISOLatin1..LanguageVersion: English..Product: "(PaperCut Global PostScript)" ..PSVersion: "(3010)"..Manufacturer: "PaperCut" % Keep it sync with the INF file manufacturer...ModelName: "PaperCut Global PostScript" % Manufacturer name followed by device...ShortNickName: "pcglobal"..NickName: "PaperCut Global PostScript" *% Used in the UI

C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\pcglobal.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	11816
Entropy (8bit):	7.183071569445355
Encrypted:	false
SSDEEP:	192:H9WTgFB24OcGEUvyyKwnsFWQF/SFWGaN4NhrJgX01k9z3Aak1s:dW8ctrnsFRpSUTN4tgR9zrn
MD5:	C1FA5D6107C00977E330349FFB07F380
SHA1:	C967B395AB4E4B26708F9A042DC255721D98D630
SHA-256:	022980B4726628E2A304E74007D6ADE1C978493307B334497D91F9EEDD9417DB
SHA-512:	4E6A5F6F5996792C144F45062BD2AE9F67BFEBD5A2969A5F72D1160FB983FEFC017A1821118CC186638D6F4142EC8A8D035278886D5084240860D40EC5DCAD08
Malicious:	false
Preview:	0..$...H..........0......1.0...`.H.e......0.....+.....7......0...0...+.....7...........J.R....0..211125004413Z0...+.....7.....0...0....R7.7.F.B.E.0.E.8.C.5.3.6.C.8.6.7.4.C.0.2.4.F.E.7.2.B.3.9.6.2.5.F.5.E.7.A.4.4.3.C...1..M08..+.....7...10(...F.i.l.e........p.c.n.t.n.s...p.p.d...0E..+.....7...17050...+.....7.......0!0...+........w....6.gL.O.+9b_^zD<0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RD.8.8.7.4.4.C.5.F.E.5.7.6.F.C.7.5.A.E.B.6.2.6.3.5.1.A.4.7.9.B.3.6.4.7.0.D.0.7.D...1..Q0<..+.....7...1.0,...F.i.l.e........p.c.g.l.o.b.a.l...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.........D..Wo.Z.bcQ.y.dp.}0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RE.9.7.0

C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\pcglobal.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4517
Entropy (8bit):	5.301420417870783
Encrypted:	false
SSDEEP:	96:9quijt+Jr6CQYPXBqFT0QKk/xwpcxtsps0sszsFsUH:zij37YvBqFT0QTmd0H
MD5:	0CBC2ED5B1CA87B0A57C2D3B8D24E96E
SHA1:	D88744C5FE576FC75AEB626351A479B36470D07D
SHA-256:	C0E6231D40C609DD7AC1B0DD4D9FAAA784ECADA7F468D46B42A4AC818878A7F3
SHA-512:	47FCA9CA3678F29AE9FC00085C56CD91FC29262D4CFB41C219FD853267F25C2FFEF3865C7AF5BDC89577EB8FCAC0F6CD654F36EB38A0BD8F9548A115BA9BD92D
Malicious:	false
Preview:	; pcglobal.inf..; INF file for PaperCut Global PostScript driver..; Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved.....[Strings]..ManufacturerName="PaperCut"..DriverName="PaperCut Global PostScript"..DriverNameNTNS="PaperCut Global PostScript - NTNS"......[Version]..Signature="$Windows NT$" ; All Windows versions...Provider=%ManufacturerName%..Class=Printer ; Device setup class...ClassGUID={4D36E979-E325-11CE-BFC1-08002BE10318} ; From devguid.h...CatalogFile=pcglobal.cat..DriverVer = 08/05/2021,101.0.1.0 ; mm/dd/yyyy,w.x.y.z..DriverIsolation=2 ; Isolated. can be run as a separate process.....;..; SourceDisksNames Section...; Identifies the distribution disks or CD-ROM discs that contain the source files to be..; transferred to the target computer during installation...;..[SourceDisksNames]..1 = %DriverName%....;..; SourceDisksFiles Section...; Name

C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\pcglobal.ppd (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	17980
Entropy (8bit):	5.110121716980155
Encrypted:	false
SSDEEP:	192:d1fM/SihhrFIYODdDJPId0PbPPeScNXFthmekNaWR3WSp4u+LzXvA6ZD:vfFihhrSZDdDJPIdtbO4u+LzfFZD
MD5:	4559236DAE31768C392B1793727C5941
SHA1:	E9703C30CE7CCE5FD0496C4C1BBC7A8CBBE123E6
SHA-256:	EA22FE16B562BDDFDA46E3DD4B3AC830CE5F064929BCFF6B67DCDFC3E9D36821
SHA-512:	146BBFCA3AB6AEC4D4BAB5D403EC9B7DACE4417296F4340F184CB45D919DFEC441F0FE4887D3B7590ED322423939B63E41D2AAFB1B78F452A6E15F090BE7AE30
Malicious:	false
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved...% Copyright (c) 2005 Microsoft Corp. All rights reserved...% Permission is granted for redistribution of this file as long as this copyright notice is intact..% and the content of the file is not altered in any way from its original form.....FormatVersion: "4.3" % The PPD file format version. ..FileVersion: "101.0.1.0" % PPD file version. Keep it sync with INF version...LanguageEncoding: ISOLatin1..LanguageVersion: English..Product: "(PaperCut Global PostScript)" ..PSVersion: "(3010)"..Manufacturer: "PaperCut" % Keep it sync with the INF file manufacturer...ModelName: "PaperCut Global PostScript" % Manufacturer name followed by device...ShortNickName: "pcglobal"..NickName: "PaperCut Global PostScript" *% Used in the UI

C:\Windows\System32\DriverStore\Temp\{db7c9079-64f3-cb4a-9c36-b79a3d2cd1fb}\pcntns.ppd (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PPD file, version "4.3"
Category:	dropped
Size (bytes):	14936
Entropy (8bit):	5.124023486899187
Encrypted:	false
SSDEEP:	192:d1fM/KiuhrFIEeScNXFthmekNaWR3WSp4u+LzXvA6ZD:vfDiuhrSLbO4u+LzfFZD
MD5:	8E4D52887A32ADB2DD7B7BE154386C9B
SHA1:	77FBE0E8C536C8674C024FE72B39625F5E7A443C
SHA-256:	4C2196498AA1E5371A583FE716E99D4ECBD26140618F22882CF21022A93D2E53
SHA-512:	6580E7DC0483F5F8FAF973D0C4A18C4AC69FDB45C1A2ADBF8E7758FB548B207A86C95356EDEA77702FC23E4D5AF76AA14D5EB63C1415DF73B537D39AFA927321
Malicious:	false
Preview:	PPD-Adobe: "4.3"..% Adobe Systems PostScript(R) Printer Description File..% Copyright 1999-2021 PaperCut Software International Pty Ltd All rights reserved...% Copyright (c) 2005 Microsoft Corp. All rights reserved...% Permission is granted for redistribution of this file as long as this copyright notice is intact..% and the content of the file is not altered in any way from its original form.....FormatVersion: "4.3" % The PPD file format version. ..FileVersion: "101.0.1.0" % PPD file version. Keep it sync with INF version...LanguageEncoding: ISOLatin1..LanguageVersion: English..Product: "(PaperCut Global PostScript - NTNS)" ..PSVersion: "(3010)"..Manufacturer: "PaperCut" % Keep it sync with the INF file manufacturer...ModelName: "PaperCut Global PostScript - NTNS" % Manufacturer name followed by device...ShortNickName: "pcglobal"..NickName: "PaperCut Global PostScript - NTNS" *% Used in

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3474
Entropy (8bit):	5.366751166885206
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3YpgpNy:QO00eO00erMwmkB1kAk
MD5:	BD8E6BA45787B1798FFBC8D895CDE8E7
SHA1:	B109B43801E334B322A72A3D4B8A35AC6E4CCD5D
SHA-256:	443C031CFF62AEAE66F5FB4E27B5D3C185BB1F851600C8901884AE6D5FEE48E9
SHA-512:	BCC3AFC7A6B503B120F06BEAB5BCCD030F03929F064E50C1FB524BE8A4D57D7F28E9FF98C24BF1E22337C79725CD1A3826710A2D79EFCEF791F2F89D8A6D7174
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\System32\spool\drivers\x64\3\pcntns.BPD

Download File

Process:	C:\Windows\System32\PrintIsolationHost.exe
File Type:	data
Category:	dropped
Size (bytes):	12580
Entropy (8bit):	4.359516030986047
Encrypted:	false
SSDEEP:	192:M6W/HRIvAn+yZt3pS7Vf6zD1euBzs2gzP:uGI+yZtm6UuB
MD5:	586B41B5F741245BC29384656C42A1EB
SHA1:	F35A9006FC321BF12F488CDC7C8DB658A8FE9616
SHA-256:	BA667B5C32C55054ED353D519C7D78720276518EC9E6120C0182203D275A0CCD
SHA-512:	A48C7E41874A8B010056815E72F666B56C75F84392BF764C7B37A83D8DA5CCD0BAD4CE2080887BC4A5A40B9727CF9FD42B01E5A404140FC9328E2BE4CD87B898
Malicious:	false
Preview:	$1.. DPP....S..]................l.......................@.......H....................................'..Z....................'..........................................,.........e..................<..................................8c..8c..................................D...@...........<.......................................Z.................................................................................e.........@'..#...H'...................................................................................... (..............l'..........................................x'......x'..................................x...........C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.s.p.o.o.l.\.D.R.I.V.E.R.S.\.x.6.4.\.3.\.p.c.n.t.n.s...p.p.d.....p.c.g.l.o.b.a.l.....(0)... count 0 eq.. { false } { true exch startjob } ifelse.. not.. { (WARNING: Cannot modify initial VM.) =.. (Missing or invalid password.) =.. (Please contact the author of this software.) = flush quit.. } if......................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9957032699245
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	papercut-hive.exe
File size:	32'219'600 bytes
MD5:	7253bd3220cd819a8c822ebcfbd03ded
SHA1:	6fd8e9384b4a7f1239505c7dcd034be810979ab7
SHA256:	dc9a1d2826175fd74c92ad9f842eddc80c9ff593770dbbf7ed4f2d9690f2e70c
SHA512:	923c5403416c80ae7057d31a817038b6cfb21e98f5a130de8f6203962a78089d8e84890af0b6557016aa0571dfdc8469af6216df1848c59527dda194fcf329c5
SSDEEP:	786432:IC7C7vI2TFs0Vt8g9I3mgvto5WU8KKzBIhK:9C7gMD9Ova1EBIhK
TLSH:	50673313F78BE03AE0691B370572B65464FBBA915423AD129AEDB4ACCF325600D3E357
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0c0c2d33ceec80aa

Static PE Info

General

Entrypoint:	0x4a83bc
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	40ab50289f7ef5fae60801f88d4541fc

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	24/06/2024 02:00:00 17/02/2027 00:59:59
Subject Chain	CN=PaperCut Software Pty Ltd, O=PaperCut Software Pty Ltd, L=Camberwell, S=Victoria, C=AU, SERIALNUMBER=650 500 413, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=AU
Version:	3
Thumbprint MD5:	8460CD7B5A2EE2592DE93D1DEC407DF1
Thumbprint SHA-1:	08559E807EEC99FD30B77B676E9A2DDF080744B1
Thumbprint SHA-256:	4DAABB8F4DDE00A36901EBEC4630F95949F04C66D9B74220B5115B92B3B05BC0
Serial:	04907AD551E92E14EFAD57BF55ADF964

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004A2EBCh
call 00007FAFFCA97455h
xor eax, eax
push ebp
push 004A8AC1h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004A8A7Bh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004B0634h]
call 00007FAFFCB28DDBh
call 00007FAFFCB2892Eh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007FAFFCB23608h
mov edx, dword ptr [ebp-14h]
mov eax, 004B41F4h
call 00007FAFFCA91503h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004B41F4h]
mov dl, 01h
mov eax, dword ptr [0049CD14h]
call 00007FAFFCB24933h
mov dword ptr [004B41F8h], eax
xor edx, edx
push ebp
push 004A8A27h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FAFFCB28E63h
mov dword ptr [004B4200h], eax
mov eax, dword ptr [004B4200h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FAFFCB2FB4Ah
mov eax, dword ptr [004B4200h]
mov edx, 00000028h
call 00007FAFFCB25228h
mov edx, dword ptr [004B4200h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb7000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5000	0xfec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcb000	0x11000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1eb5760	0x4a70
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0x10fa8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb52d4	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb6000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa568c	0xa5800	b889d302f6fc48a904de33d8d947ae80	False	0.3620185045317221	data	6.377190161826806	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1b64	0x1c00	588dd0a8ab499300d3701cbd11b017d9	False	0.548828125	data	6.109264411030635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x3838	0x3a00	5c0c76e77aef52ebc6702430837ccb6e	False	0.35338092672413796	data	4.95916338709992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x7258	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb5000	0xfec	0x1000	627340dff539ef99048969aa4824fb2d	False	0.380615234375	data	5.020404933181373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb6000	0x1a4	0x200	fd11c1109737963cc6cb7258063abfd6	False	0.34765625	data	2.729290535217263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb7000	0x71	0x200	7de8ca0c7a61668a728fd3a88dc0942d	False	0.1796875	data	1.305578535725827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb9000	0x5d	0x200	d84006640084dc9f74a07c2ff9c7d656	False	0.189453125	data	1.3892750148744617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0x10fa8	0x11000	a85fda2741bd9417695daa5fc5a9d7a5	False	0.5789579503676471	data	6.709466460182023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xcb000	0x11000	0x11000	3bea35b3ef8788b8ffb821c6f8e058e6	False	0.18788775275735295	data	3.722924051896693	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xcb678	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2048	English	United States	0.1174924924924925
RT_ICON	0xcc0e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.15792682926829268
RT_ICON	0xcc748	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23387096774193547
RT_ICON	0xcca30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.39864864864864863
RT_ICON	0xccb58	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.08339210155148095
RT_ICON	0xce180	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1023454157782516
RT_ICON	0xcf028	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.10649819494584838
RT_ICON	0xcf8d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.10838150289017341
RT_ICON	0xcfe38	0x12e5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8712011577424024
RT_ICON	0xd1120	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.05668398677373642
RT_ICON	0xd5348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08475103734439834
RT_ICON	0xd78f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.09920262664165103
RT_ICON	0xd8998	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2047872340425532
RT_STRING	0xd8e00	0x3f8	data			0.3198818897637795
RT_STRING	0xd91f8	0x2dc	data			0.36475409836065575
RT_STRING	0xd94d4	0x430	data			0.40578358208955223
RT_STRING	0xd9904	0x44c	data			0.38636363636363635
RT_STRING	0xd9d50	0x2d4	data			0.39226519337016574
RT_STRING	0xda024	0xb8	data			0.6467391304347826
RT_STRING	0xda0dc	0x9c	data			0.6410256410256411
RT_STRING	0xda178	0x374	data			0.4230769230769231
RT_STRING	0xda4ec	0x398	data			0.3358695652173913
RT_STRING	0xda884	0x368	data			0.3795871559633027
RT_STRING	0xdabec	0x2a4	data			0.4275147928994083
RT_RCDATA	0xdae90	0x10	data			1.5
RT_RCDATA	0xdaea0	0x310	data			0.6173469387755102
RT_RCDATA	0xdb1b0	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0xdb1dc	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0xdb298	0x584	data	English	United States	0.2868271954674221
RT_MANIFEST	0xdb81c	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x40fc10
dbkFCallWrapperAddr	1	0x4b063c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 17:24:26.087959051 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:26.088043928 CEST	443	49753	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:26.088139057 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:26.101079941 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:26.101116896 CEST	443	49753	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:27.010741949 CEST	443	49753	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:27.010848999 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:27.144727945 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:27.144788980 CEST	443	49753	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:27.145756960 CEST	443	49753	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:27.145812988 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:27.148211956 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:27.195382118 CEST	443	49753	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:27.422574043 CEST	443	49753	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:27.422673941 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:27.422755003 CEST	443	49753	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:27.422792912 CEST	443	49753	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:27.422919989 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:27.422919989 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:27.423851013 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:27.423904896 CEST	443	49753	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:27.423937082 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:27.423964024 CEST	49753	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:27.437031031 CEST	49758	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:27.437076092 CEST	443	49758	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:27.437158108 CEST	49758	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:27.437438965 CEST	49758	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:27.437453032 CEST	443	49758	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:28.050909042 CEST	443	49758	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:28.050992966 CEST	49758	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:28.055727005 CEST	49758	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:28.055747986 CEST	443	49758	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:28.056224108 CEST	443	49758	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:28.056370020 CEST	49758	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:28.057104111 CEST	49758	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:28.103332996 CEST	443	49758	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:28.181502104 CEST	443	49758	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:28.181566000 CEST	49758	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:28.181811094 CEST	49758	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:28.181830883 CEST	443	49758	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:28.181891918 CEST	49758	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:28.201472044 CEST	49762	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:28.201513052 CEST	443	49762	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:28.201580048 CEST	49762	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:28.201850891 CEST	49762	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:28.201867104 CEST	443	49762	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:29.072894096 CEST	443	49762	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:29.073029995 CEST	49762	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:29.075620890 CEST	49762	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:29.075644970 CEST	443	49762	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:29.075795889 CEST	49762	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:29.075803995 CEST	443	49762	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:29.334449053 CEST	443	49762	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:29.334558964 CEST	49762	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:29.334597111 CEST	443	49762	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:29.334616899 CEST	443	49762	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:29.334655046 CEST	49762	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:29.334675074 CEST	49762	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:29.334749937 CEST	49762	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:29.334768057 CEST	443	49762	104.119.110.121	192.168.2.5
Oct 25, 2024 17:24:29.334795952 CEST	49762	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:29.334820032 CEST	49762	443	192.168.2.5	104.119.110.121
Oct 25, 2024 17:24:29.335738897 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:29.335854053 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:29.335949898 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:29.336221933 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:29.336260080 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:29.987811089 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:29.987919092 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:29.988368988 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:29.988399029 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:29.988544941 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:29.988558054 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.123342991 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.123498917 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.247049093 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.247092009 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.247138023 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.247149944 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.247229099 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.247267962 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.247284889 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.247328043 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.247366905 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.370867014 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.370914936 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.370990038 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.371017933 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.371048927 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.371073961 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.495167017 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.495233059 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.495306015 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.495342016 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.495376110 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.495395899 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.617485046 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.617595911 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.617613077 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.617670059 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.617794037 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.740588903 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.740637064 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.740700960 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.740717888 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.740767956 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.740787029 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.864468098 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.864514112 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.864594936 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.864664078 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.864706993 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.864732027 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.987556934 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.987622023 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.987700939 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.987729073 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:30.987762928 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:30.987783909 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.032401085 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.032449961 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.032521009 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.032538891 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.032573938 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.032596111 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.154671907 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.154731035 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.154788017 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.154805899 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.154844999 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.154867887 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.277585030 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.277642965 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.277713060 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.277724981 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.277767897 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.277784109 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.357676029 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.357722044 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.357810020 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.357820988 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.357873917 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.402353048 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.402411938 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.402582884 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.402595043 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.402648926 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.525033951 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.525091887 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.525162935 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.525173903 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.525242090 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.611928940 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.611984968 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.612054110 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.612073898 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.612112045 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.612133026 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.649384022 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.649429083 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.649477005 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.649491072 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.649538040 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.649559021 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.772196054 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.772226095 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.772310972 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.772342920 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.772396088 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.858798027 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.858860970 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.858947992 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.859029055 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.859067917 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.859091043 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.896704912 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.896770954 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.896816969 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.896833897 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:31.896891117 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:31.896891117 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.018735886 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.018786907 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.018915892 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.018945932 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.018978119 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.019000053 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.105876923 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.105921984 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.106028080 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.106045961 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.106092930 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.106116056 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.142412901 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.142456055 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.142537117 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.142551899 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.142607927 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.142628908 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.229368925 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.229437113 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.229473114 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.229491949 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.229542971 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.229562998 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.266314983 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.266357899 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.266419888 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.266433001 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.266483068 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.266501904 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.352577925 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.352627039 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.352669954 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.352731943 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.352771044 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.352792025 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.389843941 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.389892101 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.389933109 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.389960051 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.389991045 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.390008926 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.495250940 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.495292902 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.495359898 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.495379925 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.495425940 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.495446920 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.513402939 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.513447046 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.513557911 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.513576984 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.513638973 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.618849993 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.618894100 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.618947983 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.618962049 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.619025946 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.636693954 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.636734962 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.636801958 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.636814117 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.636850119 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.636878014 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.742017984 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.742059946 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.742103100 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.742130995 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.742156029 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.742175102 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.759795904 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.759836912 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.759876013 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.759890079 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.759917021 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.759943962 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.805402040 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.805444002 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.805486917 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.805505991 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.805536032 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.805557013 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.865981102 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.866024017 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.866086960 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.866108894 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.866139889 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.866162062 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.884495020 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.884536028 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.884727001 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.884747982 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.884805918 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.989193916 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.989250898 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.989300966 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.989327908 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:32.989356041 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:32.989377022 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.007673025 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.007731915 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.007750988 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.007766962 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.007796049 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.007817030 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.052525043 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.052571058 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.052723885 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.052740097 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.052810907 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.113403082 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.113445997 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.113497972 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.113513947 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.113540888 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.113562107 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.131746054 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.131786108 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.131951094 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.131968021 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.132025003 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.237410069 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.237457037 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.237509012 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.237529039 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.237559080 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.237598896 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.254262924 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.254302979 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.254339933 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.254353046 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.254388094 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.254410028 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.255623102 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.255665064 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.255705118 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.255717039 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.255744934 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.255784988 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.360611916 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.360652924 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.360692978 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.360713005 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.360742092 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.360764980 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.377784014 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.377825022 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.377868891 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.377891064 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.377917051 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.377937078 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.378330946 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.378397942 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.379801035 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.379841089 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.379878998 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.379899025 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.379935026 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.379955053 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.496148109 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.496196032 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.496248960 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.496268988 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.496298075 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.496315956 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.501621962 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.501665115 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.501718998 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.501732111 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.501761913 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.501780033 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.546931982 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.546972036 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.547116995 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.547132969 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.547243118 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.607980967 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.608026981 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.608087063 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.608151913 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.608191967 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.608216047 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.625005007 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.625046968 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.625205994 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.625226021 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.625286102 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.626075983 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.626116991 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.626163006 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.626184940 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.626209974 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.626235008 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.731297970 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.731363058 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.731487989 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.731511116 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.731569052 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.748075008 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.748115063 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.748159885 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.748176098 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.748205900 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.748224974 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.749439955 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.749480009 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.749526024 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.749545097 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.749574900 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.749594927 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.796015978 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.796071053 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.796114922 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.796128988 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.796159029 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.796175957 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.866730928 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.866789103 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.866851091 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.866873980 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.866923094 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.866924047 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.872302055 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.872353077 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.872396946 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.872417927 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.872441053 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.872463942 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.873058081 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.873105049 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.873164892 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.873164892 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.873179913 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.873233080 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.978091002 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.978121996 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.978193045 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.978209019 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.978260994 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.996067047 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.996115923 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.996165037 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.996175051 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.996190071 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.996220112 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.998387098 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.998434067 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.998471975 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.998478889 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.998511076 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.998716116 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.999160051 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.999202967 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.999241114 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.999247074 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:33.999279022 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:33.999304056 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.114800930 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.114845037 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.114993095 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.115057945 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.115148067 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.119661093 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.119734049 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.119744062 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.119761944 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.119793892 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.119813919 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.119843960 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.119903088 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.121884108 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.121927023 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.121973038 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.121990919 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.122016907 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.122036934 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.122601032 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.122641087 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.122682095 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.122700930 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.122724056 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.122747898 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.238181114 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.238226891 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.238262892 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.238276005 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.238328934 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.239028931 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.239088058 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.239094019 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.239134073 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.239161015 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.239181995 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.245153904 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.245196104 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.245240927 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.245249033 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.245280981 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.245305061 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.245770931 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.245810986 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.245846987 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.245853901 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.245877981 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.245901108 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.348166943 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.348211050 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.348246098 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.348278999 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.348297119 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.348320007 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.362648010 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.362721920 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.362725973 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.362751961 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.362772942 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.362797022 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.367177010 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.367217064 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.367252111 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.367259979 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.367284060 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.367304087 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.369168997 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.369223118 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.369249105 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.369307041 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.414297104 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.414345026 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.414400101 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.414411068 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.414437056 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.414458990 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.490824938 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.490865946 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.490931988 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.490952015 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.490983009 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.491005898 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.491507053 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.491549969 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.491596937 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.491610050 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.491640091 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.491657972 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.493490934 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.493536949 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.493593931 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.493613005 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.493637085 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.493658066 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.494146109 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.494188070 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.494211912 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.494230032 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.494256020 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.494275093 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.615372896 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.615417957 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.615498066 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.615530014 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.615550041 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.615573883 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.615664959 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.615758896 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.615765095 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.615796089 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.615823984 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.615839005 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.616384983 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.616424084 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.616461039 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.616504908 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.616513014 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.616619110 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.616952896 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.616992950 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.617072105 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.617072105 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.617100000 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.617146015 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.661360025 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.661438942 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.661443949 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.661484957 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.661506891 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.661539078 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.738318920 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.738420010 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.738533020 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.738564968 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.738635063 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.738918066 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.738972902 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.738996983 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.739011049 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.739043951 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.739064932 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.739583015 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.739636898 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.739664078 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.739676952 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.739703894 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.739738941 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.740292072 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.740350008 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.740371943 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.740386009 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.740415096 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.740434885 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.784732103 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.784792900 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.784836054 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.784852982 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.784960985 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.784960985 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.861803055 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.861907959 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.861913919 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.861952066 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.861979961 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.862001896 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.862272978 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.862324953 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.862334013 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.862361908 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.862386942 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.862395048 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.862870932 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.862940073 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.862941027 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.862974882 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.863003016 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.863012075 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.863647938 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.863709927 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.863714933 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.863730907 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.863771915 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.863789082 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.908253908 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.908315897 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.908360958 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.908376932 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.908425093 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.908452034 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.909107924 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.909162045 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.909200907 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.909213066 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.909251928 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.909271955 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.985856056 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.985928059 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.985990047 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.986015081 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.986062050 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.986080885 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.986555099 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.986608028 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.986623049 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.986637115 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.986682892 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.987004995 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.987061024 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.987061024 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.987070084 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.987112045 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.987138987 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.987158060 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.991014957 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.991069078 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.991099119 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.991112947 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:34.991142035 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:34.991163015 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.032057047 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.032115936 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.032162905 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.032182932 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.032211065 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.032233953 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.109112024 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.109178066 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.109225035 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.109245062 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.109273911 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.109294891 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.110089064 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.110150099 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.110168934 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.110183954 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.110214949 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.110232115 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.110713959 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.110766888 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.110780001 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.110790014 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.110819101 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.110847950 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.111509085 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.111565113 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.111569881 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.111603975 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.111619949 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.111644983 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.111958981 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.112015009 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.112036943 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.112097025 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.155599117 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.155659914 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.155689955 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.155709982 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.155740976 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.155761957 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.232340097 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.232398987 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.232436895 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.232450962 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.232485056 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.232495070 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.233736992 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.233793020 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.233814001 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.233820915 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.233841896 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.233866930 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.234055996 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.234112024 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.234127045 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.234133959 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.234162092 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.234183073 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.234661102 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.234711885 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.234719992 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.234750032 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.234766960 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.234795094 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.235126972 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.235179901 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.235193014 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.235199928 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.235233068 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.235254049 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.279103994 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.279171944 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.279186964 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.279217005 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.279239893 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.279259920 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.356008053 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.356069088 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.356102943 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.356158972 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.356195927 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.356219053 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.357310057 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.357363939 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.357397079 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.357410908 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.357439995 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.357461929 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.358064890 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.358119965 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.358141899 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.358155012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.358181953 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.358200073 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.358510017 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.358580112 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.358599901 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.358660936 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.359253883 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.359306097 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.359335899 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.359366894 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.359374046 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.359421015 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.359517097 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.359575987 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.402518988 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.402590036 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.402623892 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.402657986 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.402676105 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.402702093 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.495177984 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.495220900 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.495304108 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.495387077 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.495434046 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.495460033 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.495476007 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.495528936 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.495558977 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.495573997 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.495613098 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.495640039 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.496066093 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.496145964 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.496155024 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.496193886 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.496212959 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.496233940 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.496342897 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.496397018 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.496433973 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.496447086 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.496475935 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.496503115 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.497484922 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.497538090 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.497562885 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.497576952 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.497606039 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.497627020 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.525455952 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.525516987 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.525562048 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.525576115 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.525604010 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.525628090 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.525985956 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.526079893 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.526217937 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.526232958 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.526293039 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.827008963 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.827116013 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.827246904 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.827274084 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.827434063 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.827589035 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.827646017 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.827666998 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.827697992 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.827711105 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.827760935 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.828161955 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.828214884 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.828277111 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.828293085 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.828383923 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.829052925 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.829107046 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.829133034 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.829147100 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.829175949 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.829195023 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.829983950 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.830039978 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.830081940 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.830096006 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.830125093 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.830143929 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.830214977 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.830267906 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.830281019 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.830295086 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.830349922 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.830349922 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.830840111 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.830889940 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.830919981 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.830939054 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.830962896 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.830984116 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.831866026 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.831922054 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.831944942 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.831959963 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.831985950 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.832003117 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.832726955 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.832781076 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.832806110 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.832818985 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.832847118 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.832865000 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.832976103 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.833030939 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.833045959 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.833056927 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.833086014 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.833106041 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.833924055 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.833976030 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.834002972 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.834016085 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.834044933 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.834084034 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.834613085 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.834665060 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.834676027 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.834738970 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.834767103 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.834784985 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.835381985 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.835437059 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.835464954 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.835477114 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.835504055 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.835521936 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.835614920 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.835669994 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.835683107 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.835695982 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.835722923 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.835740089 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.836184978 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.836236954 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.836309910 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.836323023 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.836357117 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.836477041 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.865590096 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.865715981 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.865731955 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.865753889 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.865789890 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.865808010 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.865906954 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.865978956 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.866019011 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.866074085 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.866108894 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.866122007 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.866149902 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.866194010 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.866564989 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.866620064 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.866636038 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.866651058 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.866683960 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.866704941 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.867060900 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.867117882 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.867137909 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.867149115 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.867180109 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.867198944 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.867602110 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.867660999 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.867682934 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.867695093 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.867722034 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.867738962 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.868043900 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.868098021 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.868127108 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.868139029 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.868170023 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.868191957 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.896388054 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.896454096 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.896500111 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.896516085 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.896584034 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.937664032 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.937736988 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.937797070 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.937813997 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.937848091 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.937870979 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.989336014 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.989396095 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.989445925 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.989460945 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.989509106 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.989528894 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.989844084 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.989896059 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.989918947 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.989932060 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.989985943 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.989985943 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.990479946 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.990534067 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.990562916 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.990576029 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.990605116 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.990637064 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.991307974 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.991379023 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.991404057 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.991416931 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.991447926 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.991485119 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.991945982 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.992001057 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.992033005 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.992044926 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.992074013 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.992099047 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.992453098 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.992506027 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.992536068 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.992547989 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:35.992585897 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:35.992621899 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.019506931 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.019575119 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.019764900 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.019783020 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.019844055 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.060841084 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.060902119 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.060940027 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.060962915 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.060992002 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.061012030 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.112484932 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.112607002 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.112648010 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.112665892 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.112869978 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.113065004 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.113117933 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.113178968 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.113195896 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.113219023 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.113259077 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.113750935 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.113805056 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.113832951 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.113847017 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.113874912 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.113900900 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.114316940 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.114372969 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.114402056 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.114414930 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.114444017 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.114469051 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.115171909 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.115226030 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.115253925 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.115266085 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.115294933 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.115325928 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.115679979 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.115742922 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.115762949 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.115775108 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.115804911 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.115832090 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.142324924 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.142380953 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.142409086 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.142422915 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.142472029 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.142489910 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.143119097 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.143176079 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.143188953 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.143201113 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.143234968 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.143258095 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.220067024 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.220127106 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.220148087 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.220165014 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.220196962 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.220235109 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.236104012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.236160040 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.236232042 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.236247063 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.236274004 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.236315012 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.236882925 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.236936092 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.236969948 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.236982107 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.237018108 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.237035990 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.237535000 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.237586975 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.237612009 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.237623930 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.237651110 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.237668991 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.238337040 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.238424063 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.238435984 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.238483906 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.238507032 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.238527060 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.238908052 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.238961935 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.238972902 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.238986969 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.239020109 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.239043951 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.239622116 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.239676952 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.239701033 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.239713907 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.239742994 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.239762068 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.266113043 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.266170025 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.266192913 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.266215086 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.266247988 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.266285896 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.266797066 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.266851902 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.266868114 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.266880989 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.266908884 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.266947985 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.343883038 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.343949080 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.343976974 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.343992949 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.344037056 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.344083071 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.360253096 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.360308886 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.360354900 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.360368013 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.360409021 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.360435963 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.361052036 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.361104012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.361125946 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.361140013 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.361171961 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.361191988 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.361931086 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.361982107 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.362016916 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.362030029 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.362076998 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.362098932 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.362461090 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.362515926 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.362543106 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.362555981 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.362587929 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.362613916 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.363118887 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.363199949 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.363220930 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.363287926 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.364334106 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.364387989 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.364423037 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.364435911 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.364461899 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.364485025 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.364883900 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.364936113 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.364963055 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.364974976 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.365000963 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.365024090 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.389987946 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.390043020 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.390093088 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.390122890 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.390153885 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.390171051 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.391041040 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.391093969 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.391113997 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.391127110 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.391166925 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.391187906 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.490647078 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.490720034 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.490756989 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.490777969 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.490807056 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.490828037 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.491003036 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.491059065 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.491067886 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.491100073 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.491116047 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.491141081 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.491738081 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.491792917 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.491811991 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.491825104 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.491856098 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.491877079 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.492476940 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.492515087 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.492644072 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.492657900 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.492731094 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.492964029 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.493036032 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.493046045 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.493083000 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.493108034 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.493129969 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.493639946 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.493690968 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.493710995 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.493722916 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.493751049 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.493767977 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.494565964 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.494620085 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.494638920 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.494652033 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.494680882 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.494708061 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.512804031 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.512856007 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.512893915 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.512913942 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.512938023 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.512964964 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.513356924 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.513412952 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.513448000 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.513461113 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.513493061 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.513514042 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.514348984 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.514404058 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.514424086 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.514436960 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.514463902 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.514481068 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.607445955 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.607469082 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.607517004 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.607537031 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.607568026 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.607589960 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.609116077 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.609178066 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.609224081 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.609224081 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.609241009 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.609287977 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.609750986 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.609786987 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.609823942 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.609836102 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.609862089 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.609883070 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.610397100 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.610414982 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.610474110 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.610488892 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.610515118 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.610547066 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.613825083 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.613848925 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.613903999 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.613915920 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.613949060 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.613967896 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.614272118 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.614341021 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.614423037 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.614484072 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.614768028 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.614788055 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.614831924 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.614850998 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.614876986 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.614901066 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.615457058 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.615525961 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.615542889 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.615605116 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.637537956 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.637557983 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.637640953 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.637656927 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.637708902 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.638196945 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.638216972 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.638252020 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.638266087 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.638295889 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.638322115 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.713377953 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.713396072 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.713495970 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.713516951 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.713571072 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.730449915 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.730469942 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.730528116 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.730542898 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.730576038 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.730592966 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.733021021 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.733036041 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.733088017 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.733102083 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.733129978 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.733180046 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.733388901 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.733405113 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.733460903 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.733474016 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.733521938 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.733946085 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.733961105 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.734025002 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.734039068 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.734090090 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.737435102 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.737454891 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.737504959 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.737518072 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.737556934 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.737556934 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.738037109 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.738051891 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.738109112 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.738123894 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.738177061 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.738384962 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.738403082 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.738444090 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.738456011 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.738482952 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.738503933 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.739005089 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.739027977 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.739083052 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.739097118 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.739147902 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.739147902 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.761204004 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.761231899 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.761409998 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.761424065 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.761471987 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.761862993 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.761888981 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.761919975 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.761934996 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.761961937 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.761981964 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.802571058 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.802597046 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.802638054 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.802654028 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.802683115 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.802719116 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.853857040 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.853878021 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.853971004 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.853986025 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.854043961 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.856652975 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.856673956 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.856724977 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.856739998 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.856766939 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.856792927 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.857110023 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.857126951 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.857181072 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.857194901 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.857249975 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.857789040 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.857806921 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.857856035 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.857868910 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.857894897 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.857917070 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.860825062 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.860846043 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.860888958 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.860902071 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.860934019 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.860970974 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.861426115 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.861444950 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.861495018 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.861515045 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.861537933 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.861561060 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.861918926 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.861937046 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.861989021 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.862000942 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.862026930 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.862071037 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.862312078 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.862380981 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.862392902 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.862405062 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.862451077 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.862451077 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.884947062 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.884965897 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.885164022 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.885185003 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.885250092 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.885566950 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.885587931 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.885643005 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.885656118 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.885680914 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.885698080 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.886234045 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.886251926 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.886343956 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.886358023 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.886452913 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.960808039 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.960828066 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.961013079 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.961033106 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.961103916 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.979953051 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.979973078 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.980050087 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.980067015 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.980094910 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.980123997 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.980542898 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.980562925 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.980623007 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.980635881 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.980680943 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.981050968 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.981070995 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.981142044 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.981156111 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.981203079 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.981364012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.981434107 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.981437922 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.981479883 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.981542110 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.981542110 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.984555006 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.984605074 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.984646082 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.984658957 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.984688044 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.984708071 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.984996080 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.985064983 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.985150099 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.985224009 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.985554934 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.985598087 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.985630989 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.985644102 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.985671043 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.985693932 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.986336946 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.986377001 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.986421108 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.986433983 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.986459970 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.986479998 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.986722946 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.986763000 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.986795902 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.986808062 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:36.986834049 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:36.986851931 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.009151936 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.009196043 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.009278059 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.009304047 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.009335995 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.009356976 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.009578943 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.009618044 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.009651899 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.009665012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.009691000 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.009711981 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.084182978 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.084227085 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.084389925 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.084418058 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.084472895 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.101052999 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.101118088 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.101270914 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.101294041 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.101351023 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.103542089 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.103581905 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.103626966 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.103641033 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.103669882 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.103691101 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.104209900 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.104249001 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.104288101 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.104300976 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.104326963 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.104345083 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.104983091 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.105021000 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.105057001 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.105070114 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.105110884 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.105110884 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.108191013 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.108230114 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.108269930 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.108284950 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.108310938 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.108330965 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.108814955 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.108892918 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.109524012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.109602928 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.109858990 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.109905005 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.109935045 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.109947920 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.109973907 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.109992981 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.110116005 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.110156059 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.110183954 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.110196114 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.110223055 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.110244989 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.110249996 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.110280037 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.110323906 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.110332012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.110343933 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.110358953 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.110388994 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.110414028 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.132390022 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.132432938 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.132494926 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.132508993 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.132546902 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.132566929 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.132921934 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.132962942 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.132999897 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.133012056 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.133038998 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.133075953 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.133374929 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.133415937 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.133455992 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.133469105 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.133495092 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.133521080 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.207741022 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.207781076 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.207842112 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.207855940 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.207906961 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.208324909 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.224786043 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.224824905 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.224865913 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.224874973 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.224905968 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.224925041 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.227447987 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.227488995 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.227524042 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.227531910 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.227557898 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.227579117 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.227941036 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.227986097 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.228022099 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.228029013 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.228056908 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.228075981 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.228796959 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.228837013 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.228872061 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.228878975 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.228908062 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.228929043 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.231564045 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.231605053 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.231642008 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.231648922 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.231673002 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.231688023 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.233180046 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.233232021 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.233262062 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.233269930 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.233297110 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.233315945 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.233594894 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.233634949 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.233669043 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.233676910 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.233700991 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.233722925 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.235145092 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.235187054 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.235229969 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.235236883 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.235266924 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.235279083 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.235639095 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.235677958 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.235716105 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.235723019 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.235743999 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.235763073 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.255496025 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.255527973 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.255572081 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.255579948 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.255624056 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.255641937 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.256364107 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.256403923 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.256438971 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.256447077 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.256479025 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.256488085 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.256983042 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.257002115 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.257050991 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.257059097 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.257095098 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.257116079 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.295967102 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.295989037 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.296036959 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.296047926 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.296075106 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.296096087 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.348073959 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.348098040 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.348144054 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.348162889 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.348191977 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.348232031 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.350047112 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.350070000 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.350121975 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.350136995 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.350166082 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.350193024 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.350739002 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.350758076 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.350796938 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.350810051 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.350836992 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.350855112 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.351528883 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.351547956 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.351587057 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.351598978 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.351624966 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.351651907 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.354824066 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.354845047 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.354890108 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.354902983 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.354934931 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.354954958 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.356836081 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.356856108 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.356908083 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.356920958 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.356972933 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.356972933 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.357223034 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.357243061 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.357292891 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.357307911 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.357336044 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.357356071 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.357896090 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.357923031 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.357959986 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.357971907 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.358001947 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.358021975 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.358338118 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.358357906 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.358397007 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.358409882 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.358444929 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.358464003 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.358880043 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.358900070 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.358943939 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.358957052 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.358983994 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.359004021 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.379117012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.379137993 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.379184961 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.379199028 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.379230022 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.379251003 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.379698992 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.379717112 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.379762888 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.379776001 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.379802942 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.379821062 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.380362034 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.380383015 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.380433083 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.380445957 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.380475998 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.380492926 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.454227924 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.454251051 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.454307079 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.454323053 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.454351902 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.454417944 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.491004944 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.491028070 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.491144896 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.491163015 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.491225958 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.491954088 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.491975069 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.492017984 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.492032051 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.492069006 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.492089987 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.492402077 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.492425919 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.492460012 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.492472887 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.492502928 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.493160963 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.493185043 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.493228912 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.493242025 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.493266106 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.493268967 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.493292093 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.493330002 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.493346930 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.493372917 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.493392944 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.494153023 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.494185925 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.494261026 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.494261026 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.494276047 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.495239019 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.495266914 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.495306969 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.495348930 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.495381117 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.496175051 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.496193886 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.496244907 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.496254921 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.496273994 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.496277094 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.496303082 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.496316910 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.496355057 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.496366978 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.497041941 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.497060061 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.497098923 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.497116089 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.497143984 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.497504950 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.497865915 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.497885942 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.497931957 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.497945070 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.497972965 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.499243021 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.502629995 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.502650976 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.502748966 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.502763033 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.502815962 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.503130913 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.503153086 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.503225088 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.503238916 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.503592014 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.503724098 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.503742933 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.503794909 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.503808022 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.503835917 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.503854990 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.577941895 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.577991962 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.578062057 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.578114986 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.578150034 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.579401970 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.597551107 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.597620010 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.597650051 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.597688913 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.597728968 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.597728968 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.598099947 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.598141909 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.598171949 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.598185062 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.598212957 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.598231077 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.604065895 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.604108095 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.604150057 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.604162931 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.604193926 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.604213953 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.604751110 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.604792118 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.604816914 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.604830027 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.604856968 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.604877949 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.605293989 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.605335951 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.605355024 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.605366945 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.605396032 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.605416059 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.605891943 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.605937958 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.605959892 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.605973005 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.605999947 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.606019974 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.606786966 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.606853962 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.606857061 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.606885910 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.606918097 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.606940985 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.607492924 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.607533932 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.607562065 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.607595921 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.607623100 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.607635021 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.607641935 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.607683897 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.607700109 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.607732058 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.607736111 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.607758999 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.607793093 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.607819080 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.614486933 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.614527941 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.614572048 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.614588022 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.614618063 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.614638090 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.615034103 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.615075111 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.615098000 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.615111113 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.615137100 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.615154982 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.625952005 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.625971079 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.626049995 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.626065969 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.626092911 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.626267910 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.626374006 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.626394033 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.626434088 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.626446962 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.626472950 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.626909971 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.626933098 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.626965046 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.626985073 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.627012014 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.627032042 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.666508913 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.666528940 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.666615963 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.666630983 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.666659117 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.666685104 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.720655918 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.720700026 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.720765114 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.720781088 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.720810890 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.720841885 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.721179008 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.721220016 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.721251965 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.721265078 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.721291065 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.721309900 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.721752882 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.721793890 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.721822977 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.721836090 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.721853018 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.721869946 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.727765083 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.727804899 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.727849007 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.727861881 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.727915049 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.727915049 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.728302956 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.728347063 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.728382111 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.728394032 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.728420019 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.728437901 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.728928089 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.728965998 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.729022980 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.729039907 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.729067087 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.729418039 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.729464054 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.729486942 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.729501009 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.729535103 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.729554892 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.729897976 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.729938030 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.729969025 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.729980946 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.730014086 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.730034113 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.730344057 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.730386972 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.730411053 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.730422974 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.730452061 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.730472088 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.732661963 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.732701063 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.732738018 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.732752085 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.732779980 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.732800007 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.738008976 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.738051891 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.738104105 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.738117933 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.738147974 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.738168001 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.738437891 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.738478899 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.738516092 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.738534927 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.738559008 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.739399910 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.749325037 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.749367952 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.749434948 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.749448061 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.749475002 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.749499083 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.749923944 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.749975920 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.750017881 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.750030041 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.750056982 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.750576019 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.750626087 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.750655890 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.750670910 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.750699997 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.750720024 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.794778109 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.794820070 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.794879913 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.794894934 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.794946909 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.795378923 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.824896097 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.824944019 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.824982882 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.824991941 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.825022936 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.825037003 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.844444990 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.844522953 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.844537973 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.844561100 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.844593048 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.844610929 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.845076084 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.845115900 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.845153093 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.845170975 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.845195055 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.847394943 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.851228952 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.851272106 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.851332903 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.851332903 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.851351023 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.851633072 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.851701975 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.851715088 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.851744890 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.851782084 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.851802111 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.852410078 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.852452040 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.852497101 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.852509975 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.852546930 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.852546930 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.853046894 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.853086948 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.853117943 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.853132010 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.853183031 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.853403091 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.853615999 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.853686094 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.853703022 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.853768110 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.853895903 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.853935957 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.853965044 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.853990078 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.854038000 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.854038000 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.854562044 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.854600906 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.854636908 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.854650021 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.854677916 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.854705095 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.855277061 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.855333090 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.855360031 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.855371952 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.855398893 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.855417013 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.861691952 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.861733913 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.861886024 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.861902952 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.861960888 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.863272905 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.863329887 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.863353014 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.863364935 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.863393068 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.863409996 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.872862101 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.872905970 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.872945070 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.872958899 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.872988939 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.873008966 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.873830080 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.873872995 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.873910904 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.873923063 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.873950958 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.873969078 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.874619961 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.874659061 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.874696970 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.874708891 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.874737024 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.874753952 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.912997961 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.913042068 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.913099051 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.913120031 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.913151026 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.913244963 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.948494911 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.948515892 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.948591948 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.948607922 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.948662996 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.968116999 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.968158007 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.968208075 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.968220949 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.968252897 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.968282938 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.968513012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.968553066 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.968595028 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.968605995 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.968636036 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.968658924 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.968959093 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.969001055 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.969037056 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.969049931 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.969114065 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.975014925 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.975068092 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.975111008 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.975125074 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.975153923 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.975178003 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.975430012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.975470066 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.975508928 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.975522041 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.975554943 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.975574017 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.975889921 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.975930929 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.975967884 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.975979090 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.976011038 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.976032019 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.976526022 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.976566076 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.976603985 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.976615906 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.976644993 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.976661921 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.977037907 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.977077961 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.977124929 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.977143049 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.977170944 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.977194071 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.977457047 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.977530956 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.977535963 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.977557898 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.977596998 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.977616072 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.977691889 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.977756023 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.977816105 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.977883101 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.978247881 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.978287935 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.978327036 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.978339911 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.978367090 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.978485107 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.984865904 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.984911919 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.984941959 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.984956026 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.984985113 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.985002995 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.985408068 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.985445976 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.985492945 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.985505104 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.985531092 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.985559940 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.996288061 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.996330976 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.996371031 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.996383905 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.996414900 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.996433973 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.997237921 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.997278929 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.997315884 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.997328043 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.997358084 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.997378111 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.997874975 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.997915030 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.997951984 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.997971058 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.997999907 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.998019934 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.998565912 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.998605013 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.998642921 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.998675108 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:37.998701096 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:37.998809099 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.071907043 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.071954012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.072048903 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.072058916 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.072118998 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.072177887 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.091264963 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.091336012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.091382027 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.091391087 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.091449022 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.091770887 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.091810942 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.091841936 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.091850042 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.091883898 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.091905117 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.092473030 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.092510939 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.092557907 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.092565060 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.092597961 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.092626095 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.098123074 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.098165989 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.098263025 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.098270893 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.098290920 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.098318100 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.098881006 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.098920107 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.098958969 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.098965883 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.098999023 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.099025965 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.099215984 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.099253893 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.099292994 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.099301100 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.099342108 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.099445105 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.099693060 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.099731922 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.099770069 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.099776983 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.099808931 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.099833012 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.100163937 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.100202084 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.100234032 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.100240946 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.100274086 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.100302935 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.100617886 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.100656033 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.100692034 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.100698948 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.100730896 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.100753069 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.101027966 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.101069927 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.101100922 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.101108074 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.101142883 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.101166010 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.101645947 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.101686001 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.101722002 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.101730108 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.101761103 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.101788044 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.108309984 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.108350992 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.108402967 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.108413935 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.108448982 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.108475924 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.109057903 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.109097004 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.109266043 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.109273911 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.109325886 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.109371901 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.109416008 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.109445095 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.109452009 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.109498978 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.121732950 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.121778011 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.121836901 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.121848106 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.121871948 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.121900082 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.122472048 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.122512102 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.122550011 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.122558117 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.122587919 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.122617960 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.123884916 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.123923063 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.123960972 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.123967886 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.124001980 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.124018908 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.161705971 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.161778927 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.161819935 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.161828041 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.161885977 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.197319031 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.197361946 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.197442055 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.197448969 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.197484970 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.197495937 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.214749098 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.214791059 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.214958906 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.214967012 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.215020895 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.215244055 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.215287924 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.215333939 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.215342045 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.215382099 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.215408087 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.216069937 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.216109991 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.216146946 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.216155052 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.216188908 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.216213942 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.221786022 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.221827030 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.221873999 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.221882105 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.221921921 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.221949100 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.222281933 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.222342014 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.222364902 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.222372055 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.222409010 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.222433090 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.222774982 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.222812891 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.222848892 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.222856045 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.222891092 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.222915888 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.223184109 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.223222971 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.223258018 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.223264933 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.223298073 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.223329067 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.223913908 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.223954916 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.223992109 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.223999977 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.224031925 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.224055052 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.224153042 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.224196911 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.224232912 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.224240065 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.224276066 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.224292994 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.224766016 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.224806070 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.224841118 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.224848986 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.224884033 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.224910021 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.225094080 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.225135088 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.225167036 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.225173950 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.225208044 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.225236893 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.225661993 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.225713968 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.225753069 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.225760937 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.225789070 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.225814104 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.234473944 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.234517097 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.234570026 CEST	49766	443	192.168.2.5	199.232.210.172
Oct 25, 2024 17:24:38.234577894 CEST	443	49766	199.232.210.172	192.168.2.5
Oct 25, 2024 17:24:38.234613895 CEST	49766	443	192.168.2.5	199.232.210.172

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 17:24:26.072884083 CEST	192.168.2.5	1.1.1.1	0xec3f	Standard query (0)	aka.ms	A (IP address)	IN (0x0001)	false
Oct 25, 2024 17:24:37.292434931 CEST	192.168.2.5	1.1.1.1	0xd125	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 25, 2024 17:24:38.768361092 CEST	192.168.2.5	1.1.1.1	0xbf47	Standard query (0)	197.87.175.4.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 25, 2024 17:24:42.225441933 CEST	192.168.2.5	1.1.1.1	0x281b	Standard query (0)	cdn1.papercut.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 17:24:52.836231947 CEST	192.168.2.5	1.1.1.1	0x3762	Standard query (0)	pmitc.papercut.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 17:24:26.081707001 CEST	1.1.1.1	192.168.2.5	0xec3f	No error (0)	aka.ms		104.119.110.121	A (IP address)	IN (0x0001)	false
Oct 25, 2024 17:24:27.435935974 CEST	1.1.1.1	192.168.2.5	0xcfcc	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 25, 2024 17:24:27.435935974 CEST	1.1.1.1	192.168.2.5	0xcfcc	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 25, 2024 17:24:37.300951004 CEST	1.1.1.1	192.168.2.5	0xd125	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 25, 2024 17:24:38.776557922 CEST	1.1.1.1	192.168.2.5	0xbf47	Name error (3)	197.87.175.4.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 25, 2024 17:24:42.252064943 CEST	1.1.1.1	192.168.2.5	0x281b	No error (0)	cdn1.papercut.com	d1d4ywpuwg1f9b.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 17:24:42.252064943 CEST	1.1.1.1	192.168.2.5	0x281b	No error (0)	d1d4ywpuwg1f9b.cloudfront.net		52.222.214.120	A (IP address)	IN (0x0001)	false
Oct 25, 2024 17:24:42.252064943 CEST	1.1.1.1	192.168.2.5	0x281b	No error (0)	d1d4ywpuwg1f9b.cloudfront.net		52.222.214.51	A (IP address)	IN (0x0001)	false
Oct 25, 2024 17:24:42.252064943 CEST	1.1.1.1	192.168.2.5	0x281b	No error (0)	d1d4ywpuwg1f9b.cloudfront.net		52.222.214.13	A (IP address)	IN (0x0001)	false
Oct 25, 2024 17:24:42.252064943 CEST	1.1.1.1	192.168.2.5	0x281b	No error (0)	d1d4ywpuwg1f9b.cloudfront.net		52.222.214.93	A (IP address)	IN (0x0001)	false
Oct 25, 2024 17:24:52.843771935 CEST	1.1.1.1	192.168.2.5	0x3762	No error (0)	pmitc.papercut.com		34.111.87.71	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49753	104.119.110.121	443	6172	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp

Timestamp	Bytes transferred	Direction	Data
2024-10-25 15:24:27 UTC	162	OUT	HEAD /vs/17/release/vc_redist.x64.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: aka.ms Connection: Keep-Alive Cache-Control: no-cache
2024-10-25 15:24:27 UTC	581	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Server: Kestrel Location: https://download.visualstudio.microsoft.com/download/pr/368cc6bf-087b-49f9-93e6-ab05b70a58e0/814E9DA5EC5E5D6A8FA701999D1FC3BADDF7F3ADC528E202590E9B1CB73E4A11/VC_redist.x64.exe Request-Context: appId=cid-v1:26ef1154-5995-4d24-ad78-ef0b04f11587 X-Response-Cache-Status: True Expires: Fri, 25 Oct 2024 15:24:27 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 25 Oct 2024 15:24:27 GMT Connection: close Strict-Transport-Security: max-age=31536000 ; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49758	199.232.210.172	443	6172	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp

Timestamp	Bytes transferred	Direction	Data
2024-10-25 15:24:28 UTC	291	OUT	HEAD /download/pr/368cc6bf-087b-49f9-93e6-ab05b70a58e0/814E9DA5EC5E5D6A8FA701999D1FC3BADDF7F3ADC528E202590E9B1CB73E4A11/VC_redist.x64.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Connection: Keep-Alive Cache-Control: no-cache Host: download.visualstudio.microsoft.com
2024-10-25 15:24:28 UTC	641	IN	HTTP/1.1 200 OK Connection: close Content-Length: 25502344 Cache-Control: public, max-age=259200 Content-Disposition: attachment; filename=VC_redist.x64.exe; filename*=UTF-8''VC_redist.x64.exe Content-Type: application/octet-stream Etag: "0xD992347400985AB0297C6730001652BC16DE9707F7582E249CA7E5041C65B6A8" Last-Modified: Wed, 25 Sep 2024 01:04:21 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Accept-Ranges: bytes Date: Fri, 25 Oct 2024 15:24:28 GMT Via: 1.1 varnish Age: 91601 X-Served-By: cache-dfw-kdal2120073-DFW X-Cache: HIT X-Cache-Hits: 258 X-Timer: S1729869868.119696,VS0,VE0 X-CID: 3 X-CCC: US

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49762	104.119.110.121	443	6172	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp

Timestamp	Bytes transferred	Direction	Data
2024-10-25 15:24:29 UTC	161	OUT	GET /vs/17/release/vc_redist.x64.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: aka.ms Connection: Keep-Alive Cache-Control: no-cache
2024-10-25 15:24:29 UTC	581	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Server: Kestrel Location: https://download.visualstudio.microsoft.com/download/pr/368cc6bf-087b-49f9-93e6-ab05b70a58e0/814E9DA5EC5E5D6A8FA701999D1FC3BADDF7F3ADC528E202590E9B1CB73E4A11/VC_redist.x64.exe Request-Context: appId=cid-v1:26ef1154-5995-4d24-ad78-ef0b04f11587 X-Response-Cache-Status: True Expires: Fri, 25 Oct 2024 15:24:29 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 25 Oct 2024 15:24:29 GMT Connection: close Strict-Transport-Security: max-age=31536000 ; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49766	199.232.210.172	443	6172	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp

Timestamp	Bytes transferred	Direction	Data
2024-10-25 15:24:29 UTC	290	OUT	GET /download/pr/368cc6bf-087b-49f9-93e6-ab05b70a58e0/814E9DA5EC5E5D6A8FA701999D1FC3BADDF7F3ADC528E202590E9B1CB73E4A11/VC_redist.x64.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Connection: Keep-Alive Cache-Control: no-cache Host: download.visualstudio.microsoft.com
2024-10-25 15:24:30 UTC	641	IN	HTTP/1.1 200 OK Connection: close Content-Length: 25502344 Cache-Control: public, max-age=259200 Content-Disposition: attachment; filename=VC_redist.x64.exe; filename*=UTF-8''VC_redist.x64.exe Content-Type: application/octet-stream Etag: "0xD992347400985AB0297C6730001652BC16DE9707F7582E249CA7E5041C65B6A8" Last-Modified: Wed, 25 Sep 2024 01:04:21 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Accept-Ranges: bytes Date: Fri, 25 Oct 2024 15:24:30 GMT Via: 1.1 varnish Age: 91604 X-Served-By: cache-dfw-kdal2120062-DFW X-Cache: HIT X-Cache-Hits: 291 X-Timer: S1729869870.059657,VS0,VE0 X-CID: 3 X-CCC: US
2024-10-25 15:24:30 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf 5d 61 4e fb 3c 0f 1d fb 3c 0f 1d fb 3c 0f 1d 1f 4c 0c 1c f1 3c 0f 1d 1f 4c 0a 1c 6a 3c 0f 1d a9 54 0b 1c e8 3c 0f 1d a9 54 0c 1c e8 3c 0f 1d a9 54 0a 1c d7 3c 0f 1d 1f 4c 0b 1c ec 3c 0f 1d 1f 4c 09 1c f9 3c 0f 1d 1f 4c 0e 1c ea 3c 0f 1d fb 3c 0e 1d b5 3d 0f 1d 50 55 0a 1c b0 3c 0f 1d 50 55 f0 1d fa 3c 0f 1d fb 3c 98 1d f9 3c 0f 1d 50 55 0d 1c fa 3c 0f 1d 52 69 63 68 fb 3c 0f Data Ascii: MZ@!L!This program cannot be run in DOS mode.$]aN<<<L<Lj<T<T<T<L<L<L<<=PU<PU<<<PU<Rich<
2024-10-25 15:24:30 UTC	16384	IN	Data Raw: ff ff 8b f0 85 f6 0f 88 1f 01 00 00 8b 5d f4 8b 7d fc f6 45 10 02 0f 84 f4 00 00 00 83 65 10 00 85 ff 75 03 8b 7d 0c 83 fb 40 77 03 6a 40 5b 53 8d 45 f8 50 e8 7b dd ff ff 8b f0 85 f6 0f 88 e8 00 00 00 8d 45 10 50 ff 75 f8 53 57 ff 15 78 e1 44 00 85 c0 75 29 ff 15 04 e1 44 00 8b f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 68 39 01 00 00 e9 dd fe ff ff 3b d8 73 72 8b d8 3d 04 01 00 00 72 03 8d 58 07 53 8d 45 f8 50 e8 1b dd ff ff 8b f0 85 f6 0f 88 88 00 00 00 8d 45 10 50 ff 75 f8 53 57 ff 15 78 e1 44 00 85 c0 75 29 ff 15 04 e1 44 00 8b f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 68 44 01 00 00 e9 7d fe ff ff 3b d8 73 12 b8 7a 00 07 80 50 8b f0 68 49 01 00 00 e9 67 fe ff ff 3d 04 01 00 00 76 0f 8d 45 f8 Data Ascii: ]}Eeu}@wj@[SEP{EPuSWxDu)D~x@Vh9;sr=rXSEPEPuSWxDu)D~x@VhD};szPhIg=vE
2024-10-25 15:24:30 UTC	16384	IN	Data Raw: 68 48 09 45 00 6a 02 e8 c2 cc 03 00 83 c4 14 eb 19 83 7c 11 18 00 74 12 ff 36 57 68 2c 09 45 00 6a 02 e8 a7 cc 03 00 83 c4 10 6b 4d fc 38 8b 43 20 56 89 4d 18 83 c1 08 03 c1 50 e8 90 95 01 00 8b f0 85 f6 79 0b 57 68 0c 00 45 00 e9 9e fe ff ff 8b 4b 20 8b 55 18 8b 45 14 89 44 11 24 53 ff 15 f4 e1 44 00 85 f6 79 17 83 7d 1c 00 74 11 56 57 68 e4 09 45 00 6a 02 e8 51 cc 03 00 83 c4 10 5f 8b c6 5e 5b c9 c2 18 00 55 8b ec 83 ec 34 53 56 57 33 d2 8d 7d cc 6a 06 59 ff 75 08 33 c0 89 55 f4 f3 ab 89 55 f8 89 55 f0 89 55 ec 89 55 fc 89 55 e4 89 55 e8 ff 15 f0 e1 44 00 8b 7d 18 8d 45 f4 8b 5d 14 50 57 53 ff 75 10 e8 49 bb 03 00 8b f0 85 f6 79 0a 68 00 04 45 00 e9 d7 01 00 00 83 65 18 00 83 7d f4 00 0f 86 d1 01 00 00 8d 45 f0 50 57 53 ff 75 10 e8 1d bb 03 00 8b f0 85 Data Ascii: hHEj\|t6Wh,EjkM8C VMPyWhEK UED$SDy}tVWhEjQ_^[U4SVW3}jYu3UUUUUUUD}E]PWSuIyhEe}EPWSu
2024-10-25 15:24:30 UTC	16044	IN	Data Raw: 00 00 00 56 68 38 19 45 00 56 ff 75 fc 6a 00 6a 7f ff d3 6a 02 5a 3b c2 0f 84 2c fc ff ff 56 68 94 18 45 00 56 ff 75 fc 6a 00 6a 7f ff d3 83 f8 02 0f 84 03 ff ff ff 56 68 4c 19 45 00 56 ff 75 fc 6a 00 6a 7f ff d3 83 f8 02 0f 85 5b 01 00 00 c7 47 10 04 00 00 00 e9 94 00 00 00 56 68 64 19 45 00 56 ff 75 f4 6a 00 6a 7f ff d3 83 f8 02 0f 85 5d 01 00 00 8d 47 14 c7 47 0c 06 00 00 00 50 68 1c 18 45 00 ff 75 f8 e8 c5 ac 03 00 8b f0 85 f6 0f 88 34 01 00 00 8d 47 18 50 68 88 19 45 00 ff 75 f8 e8 aa ac 03 00 8b f0 85 f6 0f 88 12 01 00 00 8d 45 fc 50 68 08 fe 44 00 ff 75 f8 e8 8f ac 03 00 8b f0 85 f6 0f 88 f0 00 00 00 83 ce ff 56 68 94 18 45 00 56 ff 75 fc 6a 00 6a 7f ff d3 83 f8 02 0f 85 c2 00 00 00 c7 47 10 01 00 00 00 8b 4d f8 85 c9 74 0d 8b 01 51 ff 50 08 33 ff Data Ascii: Vh8EVujjjZ;,VhEVujjVhLEVujj[GVhdEVujj]GGPhEu4GPhEuEPhDuVhEVujjGMtQP3
2024-10-25 15:24:30 UTC	16384	IN	Data Raw: 03 00 8b f0 85 f6 0f 88 ca 00 00 00 8d 45 f8 50 ff 75 fc e8 87 70 03 00 8b f0 85 f6 0f 88 aa 00 00 00 68 e9 fd 00 00 6a 00 ff 75 f8 8d 43 04 50 e8 21 24 ff ff 8b f0 85 f6 0f 88 83 00 00 00 8b 45 f8 85 c0 74 0b 50 ff 15 30 e3 44 00 83 65 f8 00 8b 4d fc 85 c9 74 0a 8b 01 51 ff 50 08 83 65 fc 00 8b 45 08 83 c3 10 8b 4d f4 40 89 45 08 3b c1 0f 82 2f ff ff ff 33 db 8b 45 10 8b f3 89 08 8b 45 0c 89 38 8b fb 8b 45 f8 85 c0 74 07 50 ff 15 30 e3 44 00 8b 4d fc 85 c9 74 06 8b 01 51 ff 50 08 8b 4d f0 85 c9 74 06 8b 01 51 ff 50 08 85 ff 74 06 57 e8 49 46 ff ff 5f 8b c6 5e 5b c9 c2 0c 00 68 58 4f 45 00 e9 6a fe ff ff 68 38 4f 45 00 e9 60 fe ff ff 68 ec 15 45 00 e9 56 fe ff ff 68 20 4f 45 00 e9 4c fe ff ff 68 f8 4e 45 00 e9 42 fe ff ff 68 34 fd 44 00 e9 38 fe ff ff 55 Data Ascii: EPuphjuCP!$EtP0DeMtQPeEM@E;/3EE8EtP0DMtQPMtQPtWIF_^[hXOEjh8OE`hEVh OELhNEBh4D8U
2024-10-25 15:24:30 UTC	16384	IN	Data Raw: 75 0c 8b 80 9c 00 00 00 ff 34 10 ff 75 f8 e8 46 4d 01 00 8b f0 85 f6 78 60 8b 4d 08 8b 45 18 41 8b 55 0c 83 c2 10 89 4d 08 89 55 0c 3b 88 a0 00 00 00 72 ce 8b 4d 10 33 f6 8b 55 14 41 81 c2 f8 00 00 00 89 4d 10 89 55 14 3b 8f b8 00 00 00 72 91 8d 45 f4 50 8d 45 f0 50 ff 75 f8 56 ff 77 44 ff 77 4c e8 3f 7a 03 00 8b f0 81 fe 02 00 07 80 75 11 33 f6 e9 70 01 00 00 68 d8 5b 45 00 e9 5e 01 00 00 85 f6 78 2e 83 7d f4 00 0f 84 58 01 00 00 ff 75 f4 8b 45 1c 68 d2 00 00 a0 c7 43 1c 01 00 00 00 6a 02 83 20 00 e8 6d 27 ff ff 83 c4 0c e9 34 01 00 00 68 1c 5c 45 00 e9 22 01 00 00 39 4f 2c 75 08 89 4d 1c 39 4f 34 74 03 89 55 1c 51 ff 77 54 e8 a7 ee fe ff 85 c0 74 0e 83 3b 07 75 18 e8 c2 69 00 00 85 c0 75 06 83 4b 14 03 eb 09 83 3b 07 75 04 83 4b 14 02 83 4b 14 04 33 c9 Data Ascii: u4uFMx`MEAUMU;rM3UAMU;rEPEPuVwDwL?zu3ph[E^x.}XuEhCj m'4h\E"9O,uM9O4tUQwTt;uiuK;uKK3
2024-10-25 15:24:30 UTC	16384	IN	Data Raw: 00 00 00 33 c9 39 8b f0 03 00 00 75 29 50 e8 27 fb ff ff 8b f0 85 f6 79 07 68 54 89 45 00 eb d6 8b 45 08 50 ff 15 f0 e0 44 00 33 c9 8b c1 89 45 08 eb 03 8b 45 08 39 8b 70 04 00 00 74 2a 8d 4d fc 51 8d 4d f0 51 8d 4d f8 51 8d 4d e4 51 8d 4d ec 51 50 53 e8 d5 4b 01 00 8b f0 8d 83 b8 00 00 00 56 50 e8 f8 67 ff ff 8b 45 08 85 c0 74 0c 50 e8 c5 fa ff ff 85 f6 78 3a 8b f0 85 f6 78 34 83 7d f8 00 75 2e 83 7d f0 00 75 28 83 7d fc 02 74 22 83 bb 80 04 00 00 00 74 19 ff b3 b0 04 00 00 8d 83 10 04 00 00 50 8d 83 b8 00 00 00 50 e8 52 4b 01 00 83 7d e8 00 74 33 83 7d e4 00 75 0d 83 bb 2c 04 00 00 00 75 04 33 c9 eb 02 8b cf 85 f6 78 0a 83 7d f8 00 75 04 33 c0 eb 02 8b c7 ff 75 fc ff 75 f0 51 50 53 e8 b1 4e 01 00 83 7d e0 00 74 0b ff b3 b0 04 00 00 e8 b1 61 00 00 83 a3 Data Ascii: 39u)P'yhTEEPD3EE9pt*MQMQMQMQMQPSKVPgEtPx:x4}u.}u(}t"tPPRK}t3}u,u3x}u3uuQPSN}ta
2024-10-25 15:24:31 UTC	16384	IN	Data Raw: ff 77 04 e8 b6 a3 ff ff 8b f0 85 f6 79 0f 68 08 c1 45 00 56 e8 22 89 02 00 59 59 eb 03 8b 75 f8 ff 15 b0 e3 44 00 5f 8b c6 5e c9 c2 04 00 55 8b ec 83 ec 0c 53 56 8b 75 08 8d 45 f8 57 33 db c7 45 f4 01 00 00 00 89 5d fc 8b fb ff 76 04 89 5d f8 50 8d 45 fc 50 e8 77 7f 02 00 85 c0 79 0a 68 7c ce 45 00 e9 d6 00 00 00 8b 06 83 e8 01 74 78 83 e8 01 74 54 83 e8 01 0f 85 a3 00 00 00 ff 76 08 8d 45 f8 50 8d 45 fc 50 e8 44 7f 02 00 85 c0 79 0a 68 2c cf 45 00 e9 a3 00 00 00 39 5e 08 76 1d 8b 46 0c ff 34 b8 8d 45 f8 50 8d 45 fc 50 e8 4c 7f 02 00 85 c0 78 0a 47 3b 7e 08 72 e3 6a 18 eb 5e 68 60 cf 45 00 eb 76 ff 76 08 8d 45 f8 50 8d 45 fc 50 e8 f9 7e 02 00 85 c0 79 07 68 98 ce 45 00 eb 5b 6a 15 eb 38 ff 76 08 8d 45 f8 50 8d 45 fc 50 e8 da 7e 02 00 85 c0 79 07 68 d0 ce Data Ascii: wyhEV"YYuD_^USVuEW3E]v]PEPwyh\|EtxtTvEPEPDyh,E9^vF4EPEPLxG;~rj^h`EvvEPEP~yhE[j8vEPEP~yh
2024-10-25 15:24:31 UTC	16384	IN	Data Raw: fe ff 8b f0 85 f6 78 42 39 5d 10 74 2c 68 00 02 00 00 53 53 ff 75 f8 ff 37 ff 75 10 e8 af 0d 00 00 8b f0 85 f6 79 23 8b 45 fc 89 07 81 fe 7a 00 07 80 75 16 83 c6 70 eb 11 8b 45 fc be ea 00 07 80 89 07 eb 05 be 57 00 07 80 ff 75 f8 e8 53 27 fe ff 5f 8b c6 5e 5b c9 c2 10 00 55 8b ec 8b 55 0c 53 56 57 33 ff bb ac d5 45 00 6a 04 8b cf 5e 8b 04 8b 3b 04 8a 75 5d 41 3b ce 75 f3 f7 45 14 03 00 00 00 75 26 be 05 40 00 80 56 68 42 03 00 00 68 c0 d5 45 00 8b fe e8 6a 08 fe ff 68 5c dc 45 00 56 e8 93 48 02 00 59 59 eb 2e 8b 45 20 85 c0 75 1e be 05 40 00 80 56 68 46 03 00 00 68 c0 d5 45 00 8b fe e8 3d 08 fe ff 68 98 dc 45 00 eb d1 89 30 eb 05 bf 02 40 00 80 8b c7 5f 5e 5b 5d c2 1c 00 55 8b ec 8b 55 0c 33 c9 85 d2 74 10 8b 45 08 8b 40 0c 8b 80 cc 02 00 00 89 02 eb 05 Data Ascii: xB9]t,hSSu7uy#EzupEWuS'_^[UUSVW3Ej^;u]A;uEu&@VhBhEjh\EVHYY.E u@VhFhE=hE0@_^[]UU3tE@
2024-10-25 15:24:31 UTC	16384	IN	Data Raw: 68 84 04 46 00 50 e8 3f df fd ff 8b f0 83 c4 10 85 f6 79 0a 68 a4 04 46 00 e9 4c 01 00 00 33 db 53 ff 75 fc 57 e8 09 df fd ff 8b f0 85 f6 79 0c 68 c8 04 46 00 e9 30 01 00 00 33 db 8b 45 f4 85 c0 74 33 53 50 8d 45 fc 68 ec 04 46 00 50 e8 f7 de fd ff 8b f0 83 c4 10 85 f6 79 0a 68 0c 05 46 00 e9 04 01 00 00 53 ff 75 fc 57 e8 c3 de fd ff 8b f0 85 f6 78 ba 8b 45 f0 85 c0 74 33 53 50 8d 45 fc 68 30 05 46 00 50 e8 bd de fd ff 8b f0 83 c4 10 85 f6 79 0a 68 54 05 46 00 e9 ca 00 00 00 53 ff 75 fc 57 e8 89 de fd ff 8b f0 85 f6 78 80 8b 45 ec 85 c0 74 37 53 50 8d 45 fc 68 78 05 46 00 50 e8 83 de fd ff 8b f0 83 c4 10 85 f6 79 0a 68 98 05 46 00 e9 90 00 00 00 53 ff 75 fc 57 e8 4f de fd ff 8b f0 85 f6 0f 88 42 ff ff ff 8b 45 e8 85 c0 74 34 53 50 8d 45 fc 68 bc 05 46 00 Data Ascii: hFP?yhFL3SuWyhF03Et3SPEhFPyhFSuWxEt3SPEh0FPyhTFSuWxEt7SPEhxFPyhFSuWOBEt4SPEhF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	56558	52.222.214.120	443	6172	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp

Timestamp	Bytes transferred	Direction	Data
2024-10-25 15:24:43 UTC	204	OUT	GET /files/open-source/ghost-trap/ghost-trap-installer-1.5.10.03.exe HTTP/1.1 Accept: / User-Agent: InnoDownloadPlugin/1.5 Host: cdn1.papercut.com Connection: Keep-Alive Cache-Control: no-cache
2024-10-25 15:24:43 UTC	1107	IN	HTTP/1.1 200 OK Content-Type: application/x-msdownload Content-Length: 47184925 Connection: close Last-Modified: Fri, 09 Aug 2024 02:51:52 GMT x-goog-generation: 1723171912622785 x-goog-metageneration: 1 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 47184925 x-goog-hash: crc32c=qcvA8g== x-goog-hash: md5=a+xm0gefpEAlJ3cKwgNwhQ== x-goog-storage-class: STANDARD Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Type Access-Control-Expose-Headers: Access-Control-Allow-Origin X-GUploader-UploadID: AHmUCY0q1nf-gy_4r07YviAfHyQG5iRcyyle9FD47R7d9xJsOYw4KXVuOFdsAo9KvD9DwApgYVKAgwrkhA Server: UploadServer Date: Fri, 25 Oct 2024 15:24:43 GMT Expires: Fri, 25 Oct 2024 15:40:22 GMT Cache-Control: public, max-age=3600 ETag: "6bec66d2079fa4402527770ac2037085" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f3e00d74aa4544d776f78a159416d17a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P3 X-Amz-Cf-Id: sn9SBlCZ-NfBIRAPfkfkmzzg7yhAPBRvn1180g4DGesLJV2yo_2unQ== Age: 2661 X-Robots-Tag: noindex, noarchive
2024-10-25 15:24:43 UTC	15277	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-10-25 15:24:43 UTC	16384	IN	Data Raw: 57 72 69 74 65 53 74 72 69 6e 67 41 73 41 6e 73 69 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 08 32 40 00 01 00 03 50 74 72 02 00 02 b8 12 40 00 02 00 05 56 61 6c 75 65 02 00 00 9c 10 40 00 0c 00 0f 4d 61 78 43 68 61 72 73 49 6e 63 4e 75 6c 6c 02 00 00 cc 10 40 00 08 00 08 43 6f 64 65 50 61 67 65 02 00 02 00 73 00 28 9c 4a 00 11 57 72 69 74 65 53 74 72 69 6e 67 41 73 41 6e 73 69 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 08 32 40 00 01 00 03 50 74 72 02 00 00 54 11 40 00 02 00 03 4f 66 73 02 00 02 b8 12 40 00 0c 00 05 56 61 6c 75 65 02 00 00 9c 10 40 00 08 00 0f 4d 61 78 43 68 61 72 73 49 6e 63 4e 75 6c 6c 02 00 02 00 85 00 28 9c 4a 00 11 57 72 69 74 65 53 74 72 69 6e 67 41 73 41 6e 73 69 03 00 00 Data Ascii: WriteStringAsAnsiSelf2@Ptr@Value@MaxCharsIncNull@CodePages(JWriteStringAsAnsiSelf2@PtrT@Ofs@Value@MaxCharsIncNull(JWriteStringAsAnsi
2024-10-25 15:24:43 UTC	16384	IN	Data Raw: 24 08 8b 44 24 08 2b 44 24 04 3b f8 76 0c 8b 44 24 08 2b 44 24 04 2b f8 eb 02 33 ff 80 3c 24 00 74 20 8b 1e f6 c3 01 75 2f 8b d3 83 ea 02 83 ca 01 8b c3 f0 0f b1 16 3b d8 75 e7 c6 44 24 01 01 eb 16 8b 1e 8b d3 83 ea 02 8b c3 f0 0f b1 16 3b d8 75 ef c6 44 24 01 01 80 7c 24 01 00 0f 84 6c ff ff ff 80 3c 24 00 74 0f e8 c5 c9 ff ff 89 46 08 c7 46 04 01 00 00 00 0f b6 04 24 83 c4 10 5d 5f 5e 5b c3 8d 40 00 53 56 8b f0 8b c6 e8 f5 fc ff ff ff 4e 04 83 7e 04 00 75 30 33 c0 89 46 08 8b 1e 8b d3 4a 8b c3 f0 0f b1 16 3b d8 75 f1 f7 c3 fe ff ff ff 74 14 8b c6 e8 35 00 00 00 8b 1d f8 d8 4a 00 33 c9 33 d2 ff 53 10 5e 5b c3 90 53 8b d8 83 3d f8 d8 4a 00 00 75 07 b0 1a e8 15 e8 ff ff 8b c3 e8 8a 00 00 00 e8 99 ff ff ff 5b c3 8d 40 00 53 56 57 55 8b f8 be 01 00 00 00 8b Data Ascii: $D$+D$;vD$+D$+3<$t u/;uD$;uD$\|$l<$tFF$]_^[@SVN~u03FJ;ut5J33S^[S=Ju[@SVWU
2024-10-25 15:24:43 UTC	16384	IN	Data Raw: d2 74 10 8b 48 fc 85 c9 74 09 8b 12 50 e8 1d eb ff ff 58 83 e8 08 e8 bc a7 ff ff 58 c3 8b c0 85 d2 74 0a 83 7a f8 00 7c 29 f0 ff 42 f8 53 8b 18 85 db 74 1a 83 7b f8 00 7e 14 f0 ff 4b f8 75 0e 50 52 89 ca ff 43 f8 e8 8f ff ff ff 5a 58 89 10 5b c3 91 92 e9 6a fe ff ff c3 90 85 c0 74 0a 83 78 f8 00 7c 04 f0 ff 40 f8 c3 90 53 56 57 55 83 c4 e4 89 0c 24 8b da 8b f0 85 db 0f 84 e4 00 00 00 83 3e 00 75 11 8b c6 8b 0c 24 8b d3 e8 8d ff ff ff e9 ce 00 00 00 8b 06 83 e8 08 8b 40 04 89 44 24 04 8b c3 83 e8 08 8b 40 04 89 44 24 08 8b 44 24 04 03 44 24 08 89 44 24 0c 8b 04 24 0f b6 78 01 03 f8 8b c7 8b 68 02 8b 50 06 85 d2 74 04 8b 3a eb 02 33 ff 8b 44 24 0c f7 ed 89 44 24 10 8b 44 24 10 99 f7 7c 24 0c 3b e8 74 05 e8 c1 b2 ff ff 83 44 24 10 08 83 7c 24 10 00 7d 05 e8 Data Ascii: tHtPXXtz\|)BSt{~KuPRCZX[jtx\|@SVWU$>u$@D$@D$D$D$D$$xhPt:3D$D$D$\|$;tD$\|$}
2024-10-25 15:24:43 UTC	16384	IN	Data Raw: 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 b4 0a 41 00 dc 76 40 00 dc 76 40 00 dc 76 40 00 dc 76 40 00 dc 76 40 00 dc 76 40 00 dc 76 40 00 dc 76 40 00 dc 76 40 00 dc 76 40 00 dc 76 40 00 dc 76 40 00 dc 76 40 00 00 00 09 00 66 08 41 00 41 00 f4 ff 7e 08 41 00 4d 00 ff ff a5 08 41 00 ca 00 0c 00 dd 08 41 00 42 00 f4 ff 05 09 41 00 42 00 f4 ff 2f 09 41 00 41 00 f4 ff 6c 09 41 00 41 00 f4 ff a9 09 41 00 41 00 f4 ff f5 09 41 00 41 00 f4 ff 0d 00 0f 54 4d 75 6c 74 69 57 61 69 74 45 76 65 6e 74 18 00 28 9c 4a 00 06 43 72 65 61 74 65 03 00 44 0a 41 00 08 00 00 02 00 27 00 b4 0a 41 00 07 44 65 73 74 72 6f 79 03 00 00 00 00 00 08 00 01 08 44 0a 41 00 00 00 04 53 65 6c 66 02 00 02 00 38 00 28 9c 4a 00 07 Data Ascii: @@@@@@@}@}@Av@v@v@v@v@v@v@v@v@v@v@v@v@fAA~AMAABAB/AAlAAAAAATMultiWaitEvent(JCreateDA'ADestroyDASelf8(J
2024-10-25 15:24:43 UTC	16384	IN	Data Raw: 07 07 07 02 02 02 0c 02 02 02 02 0a 0c 0c 0c 0c 02 02 0a 0a 02 02 0a 0a 0c 02 02 0c 0a 0a 02 07 07 07 07 07 07 07 07 02 02 07 02 02 07 07 07 07 15 07 0c 0c 0c 0c 0c 0c 0c 01 1a 0c 0c 0c 0c 0a 07 07 07 07 07 07 07 07 07 07 07 07 07 02 02 01 01 02 02 02 02 02 02 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 02 02 07 07 07 02 07 07 07 07 07 02 07 07 07 07 07 02 02 0c 07 0a 0c 0c 0c 0c 0a 0a 0c 0c 0a 0c 0c 0c 07 07 0c 0c 07 02 02 02 02 02 02 02 02 02 0c 0c 02 07 07 07 02 02 07 02 02 02 02 02 02 02 02 02 02 02 02 02 05 05 05 05 05 05 05 05 05 05 05 18 06 06 06 06 15 1a 02 02 02 02 02 02 02 02 02 02 05 05 05 05 05 05 05 05 05 06 18 18 02 02 02 02 07 07 07 0a 0a 0c 0a 0a 0c 0a 0a 15 0a 0c 02 02 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 03 03 03 03 03 03 Data Ascii:
2024-10-25 15:24:43 UTC	16384	IN	Data Raw: 00 ec 86 41 00 00 00 0f 53 79 73 74 65 6d 2e 53 79 73 55 74 69 6c 73 00 00 00 00 02 00 00 00 24 88 41 00 00 00 00 00 00 00 00 00 2c 88 41 00 20 89 41 00 3f 88 41 00 6c 88 41 00 00 00 00 00 82 88 41 00 24 00 00 00 f4 7b 41 00 f8 7e 40 00 00 7f 40 00 04 2f 42 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 34 2e 42 00 ac 2e 42 00 78 2e 42 00 0e 00 00 00 00 00 01 00 00 00 b8 12 40 00 1c 00 00 00 00 00 00 00 00 00 00 02 00 02 9c 10 40 00 18 00 00 00 09 45 72 72 6f 72 43 6f 64 65 02 00 02 b8 12 40 00 1c 00 00 00 04 50 61 74 68 02 00 00 00 02 00 8e 88 41 00 44 00 f4 ff cf 88 41 00 44 00 f4 ff 02 00 0b 45 49 6e 4f 75 74 45 72 72 6f 72 41 00 28 9c 4a 00 06 43 72 65 61 74 65 03 00 00 00 00 00 0c 00 03 08 1c 89 41 00 00 00 04 Data Ascii: ASystem.SysUtils$A,A A?AlAA${A~@@/B@@@@@}@}@4.B.Bx.B@@ErrorCode@PathADADEInOutErrorA(JCreateA
2024-10-25 15:24:43 UTC	16384	IN	Data Raw: 24 85 c0 74 05 83 e8 04 8b 00 85 c0 75 04 b0 01 eb 28 8b 04 24 0f b7 00 66 89 44 24 06 8d 44 24 06 e8 bd b0 ff ff 84 c0 75 0c 66 83 7c 24 06 5f 74 04 33 c0 eb 02 b0 01 34 01 84 c0 0f 85 a9 00 00 00 80 7c 24 04 00 74 57 8b 04 24 85 c0 74 05 83 e8 04 8b 00 8b f8 83 ef 02 0f 8c 89 00 00 00 47 be 02 00 00 00 8b 04 24 0f b7 44 70 fe 66 89 44 24 08 8d 44 24 08 e8 af b0 ff ff 84 c0 75 14 66 83 7c 24 08 5f 74 0c 66 83 7c 24 08 2e 74 04 33 c0 eb 02 b0 01 84 c0 74 51 46 4f 75 c8 eb 49 8b 04 24 85 c0 74 05 83 e8 04 8b 00 8b f8 83 ef 02 7c 36 47 be 02 00 00 00 8b 04 24 0f b7 44 70 fe 66 89 44 24 0a 8d 44 24 0a e8 5c b0 ff ff 84 c0 75 0c 66 83 7c 24 0a 5f 74 04 33 c0 eb 02 b0 01 84 c0 74 06 46 4f 75 d0 b3 01 8b c3 83 c4 0c 5f 5e 5b c3 8d 40 00 b9 1f 85 eb 51 f7 e1 89 Data Ascii: $tu($fD$D$uf\|$_t34\|$tW$tG$DpfD$D$uf\|$_tf\|$.t3tQFOuI$t\|6G$DpfD$D$\uf\|$_t3tFOu_^[@Q
2024-10-25 15:24:43 UTC	16384	IN	Data Raw: 89 45 ec 33 c0 55 68 18 0d 42 00 64 ff 30 64 89 20 8d 8d cc fe ff ff 8b 45 08 8b 40 0c 33 d2 e8 13 f8 ff ff 33 c0 89 45 fc 66 c7 45 e2 00 00 66 c7 45 e0 00 00 66 c7 45 de 00 00 66 c7 45 dc 00 00 c6 45 d7 00 8b 55 e8 8b 45 ec e8 c3 fb ff ff bf 01 00 00 00 8d 9d cc fe ff ff 8b 45 08 66 83 78 06 20 74 17 80 3b 01 75 07 66 83 7b 02 20 74 0b 8b 55 e8 8b 45 ec e8 97 fb ff ff 0f b6 03 83 f8 08 0f 87 e9 03 00 00 ff 24 85 3c 08 42 00 32 0c 42 00 f7 0b 42 00 1e 0c 42 00 e9 08 42 00 18 0b 42 00 68 09 42 00 33 0a 42 00 18 0b 42 00 65 08 42 00 e9 cd 03 00 00 83 ff 40 7d 20 80 3b 00 74 1b 6a 01 8d 4d f8 8b 55 e8 8b 45 ec e8 dd fd ff ff 84 c0 75 3f 33 db e9 71 04 00 00 8b 55 e8 8b 45 ec e8 73 fd ff ff 8d 45 f0 50 8b 4d e8 8b 09 49 ba 01 00 00 00 8b 45 ec e8 a4 9f fe ff Data Ascii: E3UhBd0d E@33EfEfEfEfEEUEEfx t;uf{ tUE$<B2BBBBBhB3BBeB@} ;tjMUEu?3qUEsEPMIE
2024-10-25 15:24:43 UTC	16384	IN	Data Raw: 8b 46 10 50 e8 86 c4 fe ff 8b 46 14 50 e8 7d c4 fe ff 8b 46 20 e8 21 36 fe ff 84 db 7e 07 8b c6 e8 3a 3b fe ff 5e 5b c3 8d 40 00 8b 40 10 50 e8 fb c6 fe ff c3 8b c0 8b 40 10 50 e8 0f c7 fe ff c3 8b c0 8b 40 14 50 e8 03 c7 fe ff c3 8b c0 8b 50 18 52 8b 40 10 50 e8 63 c7 fe ff c3 8b c0 8b 50 18 52 8b 40 14 50 e8 53 c7 fe ff c3 8b c0 8b ca f0 0f c1 08 03 ca 2b ca 8b c1 c3 8d 40 00 53 56 57 55 83 c4 f8 8b e8 b3 01 e8 b0 c4 fe ff 8b f8 3b 7d 24 0f 84 91 00 00 00 8b c5 e8 8a ff ff ff 8b 45 28 89 44 24 04 8b d4 8b 45 20 e8 09 fe ff ff 8b 04 24 83 78 0c 00 0f 97 c3 84 db 74 29 b8 01 00 00 00 f0 0f c1 45 0c 83 c0 01 eb 1a 8d 45 0c ba ff ff 00 00 e8 93 ff ff ff 8b f0 85 f6 74 07 8b c5 e8 76 ff ff ff 8d 45 0c ba 01 00 ff ff e8 79 ff ff ff 3d ff ff 00 00 75 d2 8b c5 Data Ascii: FPFP}F !6~:;^[@@P@P@PPR@PcPR@PS+@SVWU;}$E(D$E $xt)EEtvEy=u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	56617	34.111.87.71	443	6764	C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 15:24:53 UTC	77	OUT	HEAD / HTTP/1.1 Host: pmitc.papercut.com User-Agent: Go-http-client/1.1
2024-10-25 15:24:53 UTC	672	IN	HTTP/1.1 200 OK X-Cloud-Trace-Context: ed7ae32536b309520d64da07f2c9bff7 Date: Fri, 25 Oct 2024 15:24:53 GMT Content-Type: text/html Server: Google Frontend Via: 1.1 google X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: frame-ancestors 'self' https://*.multiverse.papercut.com https://multiverse.papercut.com https://multiverse.papercut.software Feature-Policy: fullscreen 'self' X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains X-Robots-Tag: noindex, nofollow Transfer-Encoding: chunked Alt-Svc: clear Connection: close

Target ID:	0
Start time:	11:24:03
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\papercut-hive.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\papercut-hive.exe"
Imagebase:	0x4d0000
File size:	32'219'600 bytes
MD5 hash:	7253BD3220CD819A8C822EBCFBD03DED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:24:03
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp" /SL5="$1047A,31229352,845824,C:\Users\user\Desktop\papercut-hive.exe"
Imagebase:	0xb00000
File size:	3'385'968 bytes
MD5 hash:	6F986EF33F81F6A1000EEAF12445651D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:24:04
Start date:	25/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""netstat" -anb > "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\~execwithresult.txt""
Imagebase:	0x7ff796710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:24:04
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:24:04
Start date:	25/10/2024
Path:	C:\Windows\System32\NETSTAT.EXE
Wow64 process (32bit):	false
Commandline:	"netstat" -anb
Imagebase:	0x7ff7686b0000
File size:	39'936 bytes
MD5 hash:	7FDDD6681EA81CE26E64452336F479E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:24:04
Start date:	25/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /C wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value > "C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\antivirus-info.log" 2>&1
Imagebase:	0x7ff796710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:24:04
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:24:04
Start date:	25/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value
Imagebase:	0x7ff69a130000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:24:48
Start date:	25/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"taskkill.exe" /f /im "pc-print-client-service.exe"
Imagebase:	0x7ff632ac0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:24:49
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:24:49
Start date:	25/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"taskkill.exe" /f /im "pc-print-client.exe"
Imagebase:	0x7ff7ebcb0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:24:49
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:24:50
Start date:	25/10/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	"net.exe" start spooler
Imagebase:	0x7ff6c8370000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:24:50
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:24:50
Start date:	25/10/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 start spooler
Imagebase:	0x7ff78f0a0000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:24:52
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe" -installPrintQueue -printerId="PaperCut Printer" -printerName="PaperCut Printer" "-driverFilePath=C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf" -logFile="C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log"
Imagebase:	0xa30000
File size:	14'236'272 bytes
MD5 hash:	F65100B9805BF914F9F77AA08566AFAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:24:53
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe printui.dll,PrintUIEntry /ia /m "PaperCut Global PostScript - NTNS" /f C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\PCGlobal.inf /u
Imagebase:	0x7ff7d3490000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:24:54
Start date:	25/10/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{4744f51b-c3b4-8c45-9965-84928136fda2}\pcglobal.inf" "9" "48fde5adf" "000000000000015C" "WinSta0\Default" "0000000000000144" "208" "c:\users\user\appdata\local\temp\is-b2r1d.tmp\client\pc-global-print-driver"
Imagebase:	0x7ff6a6e60000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:24:55
Start date:	25/10/2024
Path:	C:\Windows\System32\PrintIsolationHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\PrintIsolationHost.exe -Embedding
Imagebase:	0x7ff60ef00000
File size:	77'312 bytes
MD5 hash:	6770F8087D1E082ACFCF610CD078CDC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	11:24:56
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe printui.dll,PrintUIEntry /y /if /b "PaperCut Printer" /x /n "PaperCut Printer" /m "PaperCut Global PostScript - NTNS" /r http://localhost:9265/printers/papercutpocket /u /q
Imagebase:	0x7ff7d3490000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:24:56
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe printui.dll,PrintUIEntry /q /y /n "PaperCut Printer"
Imagebase:	0x7ff7d3490000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:24:56
Start date:	25/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe printui.dll,PrintUIEntry /q /Sr /n "PaperCut Printer" /a C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\printer-settings.bin p h i r g u d c 2
Imagebase:	0x7ff7d3490000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report papercut-hive.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Prs295.tmp

C:\Users\user\AppData\Local\Temp\Setup Log 2024-10-25 #001.txt

C:\Users\user\AppData\Local\Temp\is-7B4BH.tmp\papercut-hive.tmp

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\antivirus-info.log

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\.gitattributes

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\pcglobal.cat

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\pcglobal.inf

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\pcglobal.ppd

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\PC-Global-Print-Driver\pcntns.ppd

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\pc-print-client.exe

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\printer-settings-us-ca.bin

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\client\printer-settings.bin

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\data\config\cloud-region.conf

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\ghost-trap-installer-1.5.10.03.exe

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\idp.dll

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\post.bmp

C:\Users\user\AppData\Local\Temp\is-B2R1D.tmp\queue_install.log

Windows Analysis Report
papercut-hive.exe